diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 00000000..810a3446
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,39 @@
+name: Lint
+on:
+  push:
+    branches:
+      - "main"
+      - "test/**"
+      - "release/**"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "**.go"
+      - "go.*"
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.23.2"
+
+      - name: Format code
+        run: |
+          make format
+          git diff --exit-code ||
+            (echo "Code is not formatted. Please run 'make format' and commit the changes." && exit 1)
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        with:
+          version: v2.2.2
+
+    timeout-minutes: 10
diff --git a/.golangci.yaml b/.golangci.yaml
new file mode 100644
index 00000000..cb5f6dc4
--- /dev/null
+++ b/.golangci.yaml
@@ -0,0 +1,13 @@
+version: "2"
+linters:
+  default: none
+  enable:
+    # - errcheck
+    - govet
+    - ineffassign
+    - staticcheck
+    - unused
+formatters:
+  enable:
+    - gofmt
+    # - goimports
diff --git a/.mise.lock b/.mise.lock
index a6e50d32..fb481735 100644
--- a/.mise.lock
+++ b/.mise.lock
@@ -6,6 +6,13 @@ backend = "core:go"
 "go1.23.10.darwin-arm64.tar.gz" = "sha256:25c64bfa8a8fd8e7f62fb54afa4354af8409a4bb2358c2699a1003b733e6fce5"
 "go1.23.10.linux-amd64.tar.gz" = "sha256:535f9f81802499f2a7dbfa70abb8fda3793725fcc29460f719815f6e10b5fd60"
 
+[tools.golangci-lint]
+version = "2.2.2"
+backend = "aqua:golangci/golangci-lint"
+
+[tools.golangci-lint.checksums]
+"golangci-lint-2.2.2-linux-amd64.tar.gz" = "sha256:c27fbde948a87d326feacd21df2f61a9c54dbd2e3bfa185c0a1cd6917a6f964f"
+
 [tools.protoc]
 version = "27.3"
 backend = "aqua:protocolbuffers/protobuf/protoc"
diff --git a/.mise.toml b/.mise.toml
index 88883a4a..dd06c592 100644
--- a/.mise.toml
+++ b/.mise.toml
@@ -3,6 +3,7 @@ experimental = true
 
 [tools]
 go = "1.23"
+golangci-lint = "2.2.2"
 protoc = "27.3"
 protoc-gen-go = "1.34.2"
 protoc-gen-go-grpc = "1.5.1"
diff --git a/Makefile b/Makefile
index 8bcf3f5c..8052dab3 100644
--- a/Makefile
+++ b/Makefile
@@ -89,6 +89,14 @@ test-clean:
 vet:
 	go vet ./...
 
+.PHONY: format
+format:
+	go fmt ./...
+
+.PHONY: lint
+lint:
+	golangci-lint run
+
 .PHONY: docs-image-push
 docs-image:
 	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(DOCS_IMAGE)" ./docs
diff --git a/internal/machine/docker/server.go b/internal/machine/docker/server.go
index a9a64dac..f991fe1b 100644
--- a/internal/machine/docker/server.go
+++ b/internal/machine/docker/server.go
@@ -80,11 +80,11 @@ func NewServer(cli *client.Client, db *sqlx.DB, internalDNSIP func() netip.Addr,
 		db:            db,
 		internalDNSIP: internalDNSIP,
 	}
-	
+
 	for _, opt := range opts {
 		opt(s)
 	}
-	
+
 	return s
 }
 
diff --git a/internal/machine/machine.go b/internal/machine/machine.go
index 313cde6c..de30fa06 100644
--- a/internal/machine/machine.go
+++ b/internal/machine/machine.go
@@ -251,7 +251,7 @@ func NewMachine(config *Config) (*Machine, error) {
 	internalDNSIP := func() netip.Addr {
 		return m.IP()
 	}
-	m.docker = machinedocker.NewServer(dockerCli, db, internalDNSIP, 
+	m.docker = machinedocker.NewServer(dockerCli, db, internalDNSIP,
 		machinedocker.WithNetworkReady(m.IsNetworkReady),
 		machinedocker.WithWaitForNetworkReady(m.WaitForNetworkReady))
 	m.localMachineServer = newGRPCServer(m, c, m.docker)
@@ -373,7 +373,7 @@ func (m *Machine) Run(ctx context.Context) error {
 				// It can be reset when leaving the cluster and then re-initialised again with a new configuration.
 				case <-m.initialised:
 					var err error
-					
+
 					// Reset networkReady channel for the new cluster configuration
 					m.networkReadyMu.Lock()
 					m.networkReady = make(chan struct{})
@@ -800,11 +800,11 @@ func (m *Machine) IsNetworkReady() bool {
 		// If machine is not initialized, there's no network to check
 		return true
 	}
-	
+
 	// Check if network is ready by checking if the networkReady channel has been closed
 	m.networkReadyMu.RLock()
 	defer m.networkReadyMu.RUnlock()
-	
+
 	select {
 	case <-m.networkReady:
 		return true
@@ -820,12 +820,12 @@ func (m *Machine) WaitForNetworkReady(ctx context.Context) error {
 		// If machine is not initialized, there's no network to wait for
 		return nil
 	}
-	
+
 	// Get a copy of the channel to wait on
 	m.networkReadyMu.RLock()
 	networkReady := m.networkReady
 	m.networkReadyMu.RUnlock()
-	
+
 	// Wait for network to be ready or context to be cancelled
 	select {
 	case <-networkReady:
diff --git a/internal/machine/network/wireguard_linux.go b/internal/machine/network/wireguard_linux.go
index e2f3331a..7fab975d 100644
--- a/internal/machine/network/wireguard_linux.go
+++ b/internal/machine/network/wireguard_linux.go
@@ -129,7 +129,7 @@ func (n *WireGuardNetwork) configureDevice(config Config) error {
 		// rotations and connection disruptions.
 		n.peers = make(map[string]*peer, len(config.Peers))
 		wgPeers := make(map[string]*wgtypes.Peer, len(dev.Peers))
-		for i, _ := range dev.Peers {
+		for i := range dev.Peers {
 			wgPeers[secret.Secret(dev.Peers[i].PublicKey[:]).String()] = &dev.Peers[i]
 		}
 		for _, pc := range config.Peers {
diff --git a/pkg/client/compose/project.go b/pkg/client/compose/project.go
index f76f5c8e..12e04876 100644
--- a/pkg/client/compose/project.go
+++ b/pkg/client/compose/project.go
@@ -5,7 +5,7 @@ package compose
 import (
 	"context"
 	"fmt"
-	
+
 	composecli "github.com/compose-spec/compose-go/v2/cli"
 	"github.com/compose-spec/compose-go/v2/types"
 )
@@ -27,7 +27,7 @@ func LoadProject(ctx context.Context, paths []string, opts ...composecli.Project
 		composecli.WithExtension(PortsExtensionKey, PortsSource{}),
 		composecli.WithExtension(MachinesExtensionKey, MachinesSource{}),
 	}
-	
+
 	options, err := composecli.NewProjectOptions(
 		paths,
 		append(defaultOpts, opts...)...,
@@ -35,15 +35,15 @@ func LoadProject(ctx context.Context, paths []string, opts ...composecli.Project
 	if err != nil {
 		return nil, fmt.Errorf("create compose parser options: %w", err)
 	}
-	
+
 	project, err := options.LoadProject(ctx)
 	if err != nil {
 		return nil, err
 	}
-	
+
 	if project, err = transformServicesPortsExtension(project); err != nil {
 		return nil, err
 	}
-	
+
 	return project, nil
 }