diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..2e63b82
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,17 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-merge-conflict
+      - id: mixed-line-ending
+        args: [--fix=lf]
+
+  - repo: https://github.com/dnephin/pre-commit-golang
+    rev: v0.5.1
+    hooks:
+      - id: go-fmt
+      - id: go-vet
+      - id: go-unit-tests
diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
index 4126eb7..fa6d13f 100644
--- a/.woodpecker/build.yaml
+++ b/.woodpecker/build.yaml
@@ -2,21 +2,6 @@ when:
   - event: [pull_request, push]
 
 steps:
-  - name: test
-    image: golang:1.25
-    commands:
-      - go test -race ./...
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2
-
   # Validate the image builds without pushing. The CA-baked buildx plugin trusts
   # the internal registry's CA; the plain woodpeckerci plugin fails x509 here.
   - name: build-check
diff --git a/.woodpecker/pre-commit.yaml b/.woodpecker/pre-commit.yaml
new file mode 100644
index 0000000..98ffe88
--- /dev/null
+++ b/.woodpecker/pre-commit.yaml
@@ -0,0 +1,18 @@
+when:
+  - event: [pull_request, push]
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    commands:
+      - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
diff --git a/.woodpecker/test.yaml b/.woodpecker/test.yaml
new file mode 100644
index 0000000..eed695e
--- /dev/null
+++ b/.woodpecker/test.yaml
@@ -0,0 +1,18 @@
+when:
+  - event: [pull_request, push]
+
+steps:
+  - name: test
+    image: golang:1.25
+    commands:
+      - make test
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
diff --git a/Makefile b/Makefile
index fe8acbf..087d740 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ GOFLAGS := -ldflags="-s -w -X main.version=$(VERSION)"
 OS      ?= $(shell go env GOOS)
 ARCH    ?= $(shell go env GOARCH)
 
-.PHONY: all build test test-integration lint fmt clean docker patch minor major _tag
+.PHONY: all build test test-integration lint fmt pre-commit clean docker patch minor major _tag
 
 all: build
 
@@ -27,6 +27,12 @@ lint:
 fmt:
 	gofmt -w .
 
+# Run the pre-commit hooks across the whole tree. uvx fetches pre-commit on
+# demand; falls back to a bare pre-commit on PATH if uvx is absent.
+pre-commit:
+	@if command -v uvx >/dev/null 2>&1; then uvx pre-commit run --all-files; \
+	else pre-commit run --all-files; fi
+
 clean:
 	rm -rf $(DIST)