diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..fc38784
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,30 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-merge-conflict
+      - id: mixed-line-ending
+        args: [--fix=lf]
+
+  - repo: https://github.com/AleksaC/hadolint-py
+    rev: v2.15.1
+    hooks:
+      - id: hadolint
+
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.11.0.1
+    hooks:
+      - id: shellcheck
+
+  # No upstream equivalent: a distro added under distros/ but left out of a
+  # Woodpecker matrix silently never gets built.
+  - repo: local
+    hooks:
+      - id: check-distros
+        name: distros match the woodpecker matrices
+        entry: ci/check-distros.sh
+        language: system
+        pass_filenames: false
diff --git a/.woodpecker/pre-commit.yaml b/.woodpecker/pre-commit.yaml
index b6239c8..e4446ad 100644
--- a/.woodpecker/pre-commit.yaml
+++ b/.woodpecker/pre-commit.yaml
@@ -3,9 +3,9 @@ when:
 
 steps:
   - name: pre-commit
-    image: "docker.io/almalinux:9"
+    image: "git.unkin.net/unkin/almalinux9-gobuilder:20260606"
     commands:
-      - ./pre-commit.sh
+      - uvx pre-commit run --all-files
     backend_options:
       kubernetes:
         serviceAccountName: default
diff --git a/.woodpecker/test.yaml b/.woodpecker/test.yaml
deleted file mode 100644
index 152ab47..0000000
--- a/.woodpecker/test.yaml
+++ /dev/null
@@ -1,36 +0,0 @@
-when:
-  - event: pull_request
-
-matrix:
-  include:
-    # One entry per distro. Adding a distro: add distros/<name>/ and one entry here.
-    - DISTRO: alma9
-      BASE_IMAGE_NAME: almalinux9
-      TAG_SUFFIX: alma9
-      DEFAULT: "true"
-
-steps:
-  # The test stage runs test.sh inside the freshly built image, so a failed assertion
-  # fails the build. No docker daemon required.
-  - name: test
-    image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
-    settings:
-      repo: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder"
-      target: test
-      dry_run: true
-      build_args:
-        BASE_IMAGE_NAME: "${BASE_IMAGE_NAME}"
-        DISTRO: "${DISTRO}"
-      buildkit_config: |
-        [registry."artifactapi.k8s.syd1.au.unkin.net"]
-          ca = ["/etc/docker/certs.d/artifactapi.k8s.syd1.au.unkin.net/ca.crt"]
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 1Gi
-            cpu: 1
-          limits:
-            memory: 4Gi
-            cpu: 2
diff --git a/Dockerfile b/Dockerfile
index b160ba6..d03f216 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,6 +8,10 @@ ARG DISTRO=alma9
 ARG GO_CACHE_PLUGIN_VERSION=v0.1.0
 ARG GO_CACHE_PLUGIN_SHA256=0eb23d06a0dcf395559cb6447864579c220e60148fdcd6a6f841c2b17169b9b8
 COPY distros/${DISTRO}/ /tmp/distro/
+# DL3041: versions are pinned by the estate dnf repos, not here. SC2086: $PACKAGES is a
+# word list on purpose. DL4006: the only pipe ends in sha256sum, whose status is the
+# pipeline's, and set -e catches it.
+# hadolint ignore=DL3041,DL4006,SC2086
 RUN set -eux; \
     . /tmp/distro/distro.env; \
     dnf install -y $PACKAGES; \
@@ -18,12 +22,3 @@ RUN set -eux; \
     chmod 0755 /usr/local/bin/go-cache-plugin; \
     rm -rf /var/cache/dnf /tmp/distro
 CMD ["/bin/bash"]
-
-# Built only via `--target test`; assertions run as a build step so a broken image
-# fails the build, with no docker daemon needed in CI.
-FROM image AS test
-ARG DISTRO=alma9
-COPY distros/${DISTRO}/distro.env test.sh /tmp/test/
-RUN cd /tmp/test && ./test.sh
-
-FROM image AS final
diff --git a/Makefile b/Makefile
index 6a76311..e9577ff 100644
--- a/Makefile
+++ b/Makefile
@@ -2,11 +2,13 @@ REGISTRY := artifactapi.k8s.syd1.au.unkin.net/docker-internal
 DISTROS  := $(notdir $(wildcard distros/*))
 VERSION  ?= $(patsubst v%,%,$(or $(shell git describe --tags --exact-match 2>/dev/null),0.1.0-dev))
 
-.PHONY: build test clean patch minor major
+.PHONY: build clean pre-commit patch minor major
 build: $(addprefix build-,$(DISTROS))
-test:  $(addprefix test-,$(DISTROS))
 clean: $(addprefix clean-,$(DISTROS))
 
+pre-commit:
+	@uvx pre-commit run --all-files
+
 # Not .PHONY: GNU make skips implicit-rule search for phony targets.
 
 build-%:
@@ -14,11 +16,6 @@ build-%:
 	docker build --build-arg "BASE_IMAGE_NAME=$$BASE_IMAGE_NAME" --build-arg "DISTRO=$*" \
 	  -t "$(REGISTRY)/$$IMAGE:$(VERSION)-$$TAG_SUFFIX" .
 
-test-%:
-	@set -eu; . ./distros/$*/distro.env; \
-	docker build --target test --progress plain \
-	  --build-arg "BASE_IMAGE_NAME=$$BASE_IMAGE_NAME" --build-arg "DISTRO=$*" .
-
 clean-%:
 	@set -eu; . ./distros/$*/distro.env; \
 	docker rmi "$(REGISTRY)/$$IMAGE:$(VERSION)-$$TAG_SUFFIX" 2>/dev/null || true
diff --git a/README.md b/README.md
index f74a4d1..1f0aaee 100644
--- a/README.md
+++ b/README.md
@@ -17,13 +17,14 @@ The `container-base` release this image builds on is `BASE_VERSION` in the `Dock
 ## Adding a distro
 
 1. `distros/<name>/distro.env` — `BASE_IMAGE_NAME`, `IMAGE`, `TAG_SUFFIX`, `DEFAULT`, `PACKAGES`, `GO_MIN`.
-2. One `include` entry in each of `.woodpecker/{build,test,docker}.yaml`.
+2. One `include` entry in each of `.woodpecker/{build,docker}.yaml`.
 
-`pre-commit.sh` fails if step 2 is forgotten, or if more than one distro claims `DEFAULT`.
+The `check-distros` pre-commit hook fails if step 1 or 2 is incomplete, or if more than
+one distro claims `DEFAULT`.
 
 ## Make
 
     make build          # build every distro
-    make test           # build the test stage of every distro (assertions run in-image)
+    make pre-commit     # uvx pre-commit run --all-files
     make build-alma9    # one distro
     make patch|minor|major
diff --git a/ci/check-distros.sh b/ci/check-distros.sh
new file mode 100755
index 0000000..44f8e66
--- /dev/null
+++ b/ci/check-distros.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Every distros/<name>/ needs a complete distro.env and an entry in every Woodpecker
+# matrix, or a newly added distro silently never gets built.
+set -uo pipefail
+
+KEYS="BASE_IMAGE_NAME IMAGE TAG_SUFFIX DEFAULT ESTATE_REPO PACKAGES GO_MIN"
+WORKFLOWS=(.woodpecker/build.yaml .woodpecker/docker.yaml)
+
+fail=0
+for d in distros/*/; do
+  n=$(basename "$d")
+  for k in $KEYS; do
+    grep -q "^${k}=" "${d}distro.env" || { echo "${d}distro.env: missing ${k}"; fail=1; }
+  done
+  for wf in "${WORKFLOWS[@]}"; do
+    grep -q "DISTRO: ${n}\$" "$wf" || { echo "${wf}: distro ${n} missing from matrix"; fail=1; }
+  done
+done
+
+# Exactly one distro owns the unsuffixed :<version> and :latest tags.
+defaults=$(grep -l 'DEFAULT="true"' distros/*/distro.env | wc -l)
+[ "$defaults" -eq 1 ] || { echo "expected exactly one distro with DEFAULT=\"true\", found ${defaults}"; fail=1; }
+
+exit "$fail"
diff --git a/pre-commit.sh b/pre-commit.sh
deleted file mode 100755
index 937de53..0000000
--- a/pre-commit.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-# Guards the one mistake this layout invites: a distro added under distros/ but left
-# out of a .woodpecker matrix, so it silently never gets built.
-set -uo pipefail
-
-REQUIRED_KEYS="BASE_IMAGE_NAME IMAGE TAG_SUFFIX DEFAULT ESTATE_REPO PACKAGES GO_MIN"
-WORKFLOWS=".woodpecker/build.yaml .woodpecker/test.yaml .woodpecker/docker.yaml"
-
-fail=0
-for d in distros/*/; do
-  n=${d#distros/}; n=${n%/}
-  for k in $REQUIRED_KEYS; do
-    grep -q "^${k}=" "${d}distro.env" || { echo "${d}distro.env: missing ${k}"; fail=1; }
-  done
-  for wf in $WORKFLOWS; do
-    grep -q "DISTRO: ${n}\$" "$wf" || { echo "${wf}: distro ${n} missing from matrix"; fail=1; }
-  done
-done
-
-# Exactly one distro owns the unsuffixed :<version> and :latest tags.
-n=$(grep -l 'DEFAULT="true"' distros/*/distro.env | wc -l)
-[ "$n" -eq 1 ] || { echo "expected exactly one distro with DEFAULT=\"true\", found ${n}"; fail=1; }
-
-for s in ./*.sh; do bash -n "$s" || fail=1; done
-
-[ "$fail" -eq 0 ] || { echo "FAILED"; exit 1; }
-echo "PASS"
diff --git a/test.sh b/test.sh
deleted file mode 100755
index 0d5273d..0000000
--- a/test.sh
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-# In-image assertions for the gobuilder image. Run via `docker build --target test`.
-set -uo pipefail
-
-ARTIFACTAPI=https://artifactapi.k8s.syd1.au.unkin.net
-. ./distro.env
-
-fail=0
-check() {
-  local name=$1; shift
-  if out=$("$@" 2>&1); then
-    echo "ok       $name"
-  else
-    echo "NOT OK   $name"
-    printf '%s\n' "$out" | sed 's/^/           /'
-    fail=1
-  fi
-}
-
-# Inherited from container-base: no -k and no --cacert.
-check "internal CA trusted (artifactapi)" \
-  curl -fsS -o /dev/null "$ARTIFACTAPI/api/v1/local/$ESTATE_REPO/repodata/repomd.xml"
-
-for p in $PACKAGES; do
-  check "package $p installed" rpm -q "$p"
-done
-
-# GOCACHEPROG is only enabled by default from Go 1.24, so the toolchain floor matters.
-go_min_ok() {
-  local have
-  have=$(go env GOVERSION 2>/dev/null | awk '{sub(/^go/,"",$1); print $1}') || return 1
-  [ "$(printf '%s\n%s\n' "$GO_MIN" "$have" | sort -V | head -1)" = "$GO_MIN" ]
-}
-check "go >= $GO_MIN (have $(go env GOVERSION 2>/dev/null | awk '{print $1}'))" go_min_ok
-
-# gcc is what `go test -race` needs.
-check "gcc runs" gcc --version
-check "nfpm runs" nfpm --version
-check "go-cache-plugin on PATH" command -v go-cache-plugin
-check "go-cache-plugin executable" test -x /usr/local/bin/go-cache-plugin
-# `version` prints correctly but exits 2, so assert on its output.
-check "go-cache-plugin runs" bash -c 'go-cache-plugin version 2>&1 | grep -q "^go-cache-plugin version v"'
-
-# cgo must actually link, which is the thing -race depends on.
-check "cgo builds" bash -c 'cd "$(mktemp -d)" && go mod init t >/dev/null &&
-  printf "package main\n\nimport \"C\"\n\nfunc main() {}\n" > m.go && CGO_ENABLED=1 go build ./...'
-
-[ "$fail" -eq 0 ] || { echo "FAILED"; exit 1; }
-echo "PASS"