diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 0000000..b0802ba
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,16 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+max_line_length = 80
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+# shellcheck, shfmt
+[[shell]]
+simplify = true
+space_redirects = true
+switch_case_indent = true
diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml
new file mode 100644
index 0000000..8263752
--- /dev/null
+++ b/.github/workflows/pre-commit.yaml
@@ -0,0 +1,47 @@
+---
+name: pre-commit
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      # For development, and debugging of the workflow.
+      - force_ci/pre-commit/**
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - id: checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - id: setup-python
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.11
+
+      - name: Install shellcheck, shfmt
+        run: |
+          sudo apt-get update && \
+          sudo apt-get install -y shellcheck shfmt
+
+      - id: pre-commit
+        uses: pre-commit/action@v3.0.1
+
+      - id: suggest-changes
+        uses: parkerbxyz/suggest-changes@v2
+        # Push changes made by pre-commit hooks as suggestions.
+        with:
+          comment:
+            Please run `pre-commit run -a` or commit the suggested changes.
+        # Only run for pull requests, and when pre-commit failed.
+        if: |-
+          failure() && steps.pre-commit.conclusion == 'failure' &&
+          github.event_name == 'pull_request'
diff --git a/.markdownlint.yaml b/.markdownlint.yaml
new file mode 100644
index 0000000..81fc844
--- /dev/null
+++ b/.markdownlint.yaml
@@ -0,0 +1,9 @@
+# Default state for all rules
+default: true
+# Path to configuration file to extend
+extends: null
+
+# MD013/line-length
+MD013:
+  line_length: 80
+  stern: true
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..244d995
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,74 @@
+# vim:ts=2:sw=2:et:ai:sts=2
+
+default_install_hook_types:
+  - pre-push
+
+default_language_version:
+  node: 20.19.2
+
+repos:
+  # Generic.
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: check-case-conflict
+      - id: check-docstring-first
+      - id: check-executables-have-shebangs
+      - id: check-json
+      - id: check-shebang-scripts-are-executable
+      - id: check-merge-conflict
+      - id: check-symlinks
+      - id: check-toml
+      - id: check-xml
+      - id: check-yaml
+      - id: debug-statements
+      - id: destroyed-symlinks
+      - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: fix-byte-order-marker
+      - id: mixed-line-ending
+      - id: requirements-txt-fixer
+      - id: trailing-whitespace
+
+  # Python.
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.17.3
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: v1.14.1
+    hooks:
+      - id: mypy
+        args: [--strict, "--scripts-are-modules"]
+
+  # Shell scripts.
+  - repo: local
+    hooks:
+      # Needs `apt install shfmt` or `brew install shfmt`.
+      - id: shfmt
+        name: shfmt
+        description: Shell source code formatter
+        language: system
+        entry: shfmt
+        args: [-w]
+        types: [shell]
+        exclude_types: [csh, tcsh, zsh]
+
+      # Needs `apt install shellcheck` or `brew install shellcheck`.
+      - id: shellcheck
+        name: shellcheck
+        description: Static analysis tool for shell scripts
+        language: system
+        entry: shellcheck
+        args: [-f, gcc, -x]
+        types: [shell]
+
+  # Markdown
+  - repo: https://github.com/igorshubovych/markdownlint-cli
+    rev: v0.43.0
+    hooks:
+      - id: markdownlint
diff --git a/.ruff.toml b/.ruff.toml
new file mode 100644
index 0000000..7d7477a
--- /dev/null
+++ b/.ruff.toml
@@ -0,0 +1,35 @@
+# vim:ts=2:sw=2:et:ai:sts=2
+
+line-length = 80
+indent-width = 2
+target-version = "py311"
+
+exclude = [
+  "ansible/.collections",
+]
+
+[format]
+# XXX(Tina): Do we want to keep this?
+quote-style = "double"
+
+[lint]
+select = [
+  # pycodestyle
+  "E",
+  # Pyflakes
+  "F",
+  # pyupgrade
+  "UP",
+  # flake8-bugbear
+  "B",
+  # flake8-simplify
+  "SIM",
+  # isort
+  "I",
+]
+
+[lint.isort]
+# Leave an empty line between direct and from import
+lines-between-types = 1
+# Leave two empty lines after imports
+lines-after-imports = 2
diff --git a/pass b/pass
index 47dd51f..8001710 100755
--- a/pass
+++ b/pass
@@ -1,7 +1,11 @@
 #!/bin/sh
 # vim:ts=2:sw=2:et:ai:sts=2
 
+set -e
+
 BASEDIR="$(dirname "$0")"
-export PASSWORD_STORE_DIR="$(realpath "$BASEDIR/../secrets")"
-export PASSWORD_STORE_GPG_OPTS="--trust-model=always"
+PASSWORD_STORE_DIR="$(realpath "$BASEDIR/../secrets")"
+PASSWORD_STORE_GPG_OPTS="--trust-model=always"
+
+export PASSWORD_STORE_DIR PASSWORD_STORE_GPG_OPTS
 exec pass "$@"
diff --git a/unlock-luks b/unlock-luks
index fe6da7d..80e20fa 100755
--- a/unlock-luks
+++ b/unlock-luks
@@ -22,7 +22,7 @@ SHORT_HOST="${HOST%%.*}"
 
 SECRET=
 for key in "$HOST" "$SHORT_HOST"; do
-  SECRET=$("$PASS_CMD" "$key/luks" 2>/dev/null) || continue
+  SECRET=$("$PASS_CMD" "$key/luks" 2> /dev/null) || continue
   echo "Using secret: '$key/luks'" >&2
   break
 done
@@ -39,5 +39,6 @@ SSH_OPTS=(
   "$@"
 )
 
-tr -d '\n' <<<"$SECRET" | \
+# shellcheck disable=SC2029
+tr -d '\n' <<< "$SECRET" |
   ssh "${SSH_OPTS[@]}" "$HOST" "$REMOTE_CMD" || fail "Operation failed"