diff --git a/.github/workflows/autobump.yaml b/.github/workflows/autobump.yaml
index 36d3100..a0fbdc8 100644
--- a/.github/workflows/autobump.yaml
+++ b/.github/workflows/autobump.yaml
@@ -3,7 +3,7 @@ name: Autobump
 on:
   workflow_dispatch:
   schedule:
-    - cron:  '0 20 * * *'
+    - cron: '0 20 * * *'
 jobs:
   bump:
     runs-on: ubuntu-latest
@@ -62,5 +62,5 @@ jobs:
           git reset --hard upstream/${RESET_BRANCH}
           git push -fv -u origin $WORK_BRANCH
           export TREE_DIR=$PWD/packages
-          
+
           luet autobump-github
diff --git a/.github/workflows/build-arm64.yaml b/.github/workflows/build-arm64.yaml
index 4afd6f4..0f96964 100644
--- a/.github/workflows/build-arm64.yaml
+++ b/.github/workflows/build-arm64.yaml
@@ -1,13 +1,12 @@
 name: Build ARM64
 concurrency:
   group: "master-arm64-build"
-  #cancel-in-progress: true
 
 on:
   push:
-    branches: [ main ]
+    branches:
+      - main
 jobs:
-
   build:
     runs-on: ARM64
     env:
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 16787c8..7837639 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -1,13 +1,12 @@
 name: Build
 concurrency:
   group: "master-build"
-  #cancel-in-progress: true
 
 on:
   push:
-    branches: [ main ]
+    branches:
+      - main
 jobs:
-
   build:
     runs-on: fast
     env:
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
new file mode 100644
index 0000000..8783d82
--- /dev/null
+++ b/.github/workflows/lint.yaml
@@ -0,0 +1,13 @@
+name: Lint
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+permissions: read-all
+jobs:
+  call-workflow:
+    uses: kairos-io/linting-composite-action/.github/workflows/reusable-linting.yaml@8dd82218a024735daac578d2588522a5b4bb2614  # v0.0.9
+    with:
+      yamldirs: ".github/workflows/ packages/static/kairos-overlay-files/files"
+      is-go: false
diff --git a/.yamllint b/.yamllint
new file mode 100644
index 0000000..cf93263
--- /dev/null
+++ b/.yamllint
@@ -0,0 +1,21 @@
+extends: default
+
+rules:
+  # 80 chars should be enough, but don't fail if a line is longer
+  line-length:
+    max: 305
+    level: warning
+
+  # accept both     key:
+  #                   - item
+  #
+  # and             key:
+  #                 - item
+  indentation:
+    indent-sequences: whatever
+
+  truthy:
+    check-keys: false
+
+  document-start:
+    present: false
diff --git a/packages/dracut/kairos-network/files/90kairos-network/module-setup.sh b/packages/dracut/kairos-network/files/90kairos-network/module-setup.sh
index bedd26f..4092b6e 100644
--- a/packages/dracut/kairos-network/files/90kairos-network/module-setup.sh
+++ b/packages/dracut/kairos-network/files/90kairos-network/module-setup.sh
@@ -22,6 +22,7 @@ depends() {
 
     # shellcheck disable=SC2144
     # add network-legacy module if it exists
+    # shellcheck disable=SC2154
     if [ -d "${dracutbasedir}"/modules.d/??network-legacy ]; then
         network_handler="network-legacy"
     fi
diff --git a/packages/k8s/kubeadm/install-k8s.sh b/packages/k8s/kubeadm/install-k8s.sh
index 0acb098..f67bdff 100755
--- a/packages/k8s/kubeadm/install-k8s.sh
+++ b/packages/k8s/kubeadm/install-k8s.sh
@@ -4,14 +4,14 @@ set -euxo pipefail
 RELEASE=$1
 DOWNLOAD_DIR=$2
 ARCH=$3
-cd $DOWNLOAD_DIR
-sudo curl -L --remote-name-all https://dl.k8s.io/release/${RELEASE}/bin/linux/${ARCH}/{kubeadm,kubelet,kubectl}
+cd "$DOWNLOAD_DIR"
+sudo curl -L --remote-name-all https://dl.k8s.io/release/"${RELEASE}"/bin/linux/"${ARCH}"/{kubeadm,kubelet,kubectl}
 sudo chmod +x {kubeadm,kubelet,kubectl}
 cd -
 
-cat files/etc/systemd/system/kubelet.service | sed "s:/usr/bin:${DOWNLOAD_DIR}:g" | sudo tee /etc/systemd/system/kubelet.service
+sed "s:/usr/bin:${DOWNLOAD_DIR}:g" files/etc/systemd/system/kubelet.service | sudo tee /etc/systemd/system/kubelet.service
 sudo mkdir -p /etc/systemd/system/kubelet.service.d
-cat files/etc/systemd/system/kubelet.service.d/10-kubeadm.conf  | sed "s:/usr/bin:${DOWNLOAD_DIR}:g" | sudo tee /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
+sed "s:/usr/bin:${DOWNLOAD_DIR}:g" files/etc/systemd/system/kubelet.service.d/10-kubeadm.conf | sudo tee /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
 mkdir -p  /etc/default
 cp files/etc/default/kubelet /etc/default
 systemctl enable kubelet 
diff --git a/packages/kernels/linux-tegra/nvbuild.sh b/packages/kernels/linux-tegra/nvbuild.sh
index 42b190a..141df68 100644
--- a/packages/kernels/linux-tegra/nvbuild.sh
+++ b/packages/kernels/linux-tegra/nvbuild.sh
@@ -37,6 +37,7 @@ set -e
 SCRIPT_DIR="$(dirname $(readlink -f "${0}"))"
 SCRIPT_NAME="$(basename "${0}")"
 
+# shellcheck disable=SC1091
 . "${SCRIPT_DIR}/nvcommon_build.sh"
 
 function usage {
diff --git a/packages/static/kairos-overlay-files/collection.yaml b/packages/static/kairos-overlay-files/collection.yaml
index 752ed6c..24cf130 100644
--- a/packages/static/kairos-overlay-files/collection.yaml
+++ b/packages/static/kairos-overlay-files/collection.yaml
@@ -1,4 +1,4 @@
 packages:
   - name: "kairos-overlay-files"
     category: "static"
-    version: "1.3.4"
+    version: "1.4.0"
diff --git a/packages/static/kairos-overlay-files/files/system/oem/00_rootfs.yaml b/packages/static/kairos-overlay-files/files/system/oem/00_rootfs.yaml
index 3f6100e..6bce583 100644
--- a/packages/static/kairos-overlay-files/files/system/oem/00_rootfs.yaml
+++ b/packages/static/kairos-overlay-files/files/system/oem/00_rootfs.yaml
@@ -143,7 +143,7 @@ stages:
     - if: '[ ! -f "/run/cos/recovery_mode" ] && [ -f "/sbin/openrc" ]'
       name: "Restore /etc/machine-id for openrc systems"
       commands:
-        - dbus-uuidgen --ensure # This makes sure that the machine-id exists and its valid
+        - dbus-uuidgen --ensure  # This makes sure that the machine-id exists and its valid
         - cat /var/lib/dbus/machine-id > /etc/machine-id
   fs:
     - if: '[ ! -f "/run/cos/recovery_mode" ] && [ ! -s /usr/local/etc/machine-id ] '
diff --git a/packages/static/kairos-overlay-files/files/system/oem/00_rootfs_uki.yaml b/packages/static/kairos-overlay-files/files/system/oem/00_rootfs_uki.yaml
index 3f8e59f..d6ca466 100644
--- a/packages/static/kairos-overlay-files/files/system/oem/00_rootfs_uki.yaml
+++ b/packages/static/kairos-overlay-files/files/system/oem/00_rootfs_uki.yaml
@@ -59,4 +59,4 @@ stages:
       environment_file: /run/cos/cos-layout.env
       environment:
         RW_PATHS: "/var /etc /srv /home"
-        OVERLAY: "tmpfs:25%"
\ No newline at end of file
+        OVERLAY: "tmpfs:25%"
diff --git a/packages/static/kairos-overlay-files/files/system/oem/05_network.yaml b/packages/static/kairos-overlay-files/files/system/oem/05_network.yaml
index bd186f4..32cba7d 100644
--- a/packages/static/kairos-overlay-files/files/system/oem/05_network.yaml
+++ b/packages/static/kairos-overlay-files/files/system/oem/05_network.yaml
@@ -1,10 +1,10 @@
 name: "Default network configuration"
 stages:
   rootfs.before:
-    - name: "Enable systemd-network config files for DHCP" # Needed if systemd-networkd runs in the initramfs!
+    - name: "Enable systemd-network config files for DHCP"  # Needed if systemd-networkd runs in the initramfs!
       if: '[ -e "/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ] || [ -e "/usr/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ]'
       directories:
-        - path: "/etc/systemd/network/" # doesnt exist on initramfs
+        - path: "/etc/systemd/network/"  # doesnt exist on initramfs
           permissions: 0775
           owner: 0
           group: 0
@@ -32,7 +32,7 @@ stages:
             [DHCP]
             ClientIdentifier=mac
       commands:
-        - networkctl reload # make sure it reloads our config files
+        - networkctl reload  # make sure it reloads our config files
   initramfs:
     - name: "Enable systemd-network config files for DHCP"
       if: '[ -e "/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ] || [ -e "/usr/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ]'
@@ -60,7 +60,7 @@ stages:
             [DHCP]
             ClientIdentifier=mac
       commands:
-        - networkctl reload # make sure it reloads our config files
+        - networkctl reload  # make sure it reloads our config files
     - name: "Disable NetworkManager and wicked"
       if: '[ -e "/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ] || [ -e "/usr/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ]'
       systemctl:
@@ -82,12 +82,12 @@ stages:
     - name: "Reload systemd-networkd config"
       if: '[ -e "/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ] || [ -e "/usr/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ]'
       commands:
-        - networkctl reload # make sure it reloads our config files
+        - networkctl reload  # make sure it reloads our config files
   fs:
     - name: "Reload systemd-networkd config"
       if: '[ -e "/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ] || [ -e "/usr/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ]'
       commands:
-        - networkctl reload # make sure it reloads our config files
+        - networkctl reload  # make sure it reloads our config files
 #     dns:
 #      path: /etc/resolv.conf
 #      nameservers:
diff --git a/packages/static/kairos-overlay-files/files/system/oem/09_openrc_services.yaml b/packages/static/kairos-overlay-files/files/system/oem/09_openrc_services.yaml
index acb50ca..a2e8996 100644
--- a/packages/static/kairos-overlay-files/files/system/oem/09_openrc_services.yaml
+++ b/packages/static/kairos-overlay-files/files/system/oem/09_openrc_services.yaml
@@ -109,7 +109,7 @@ stages:
           ██╔═██╗ ██╔══██║██║██╔══██╗██║   ██║╚════██║
           ██║  ██╗██║  ██║██║██║  ██║╚██████╔╝███████║
           ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝
-                                                      
+
 
           Kernel \r on an \m (\l)
         permissions: 0755
diff --git a/packages/static/kairos-overlay-files/files/system/oem/09_systemd_services.yaml b/packages/static/kairos-overlay-files/files/system/oem/09_systemd_services.yaml
index 2dd058e..c4e4801 100644
--- a/packages/static/kairos-overlay-files/files/system/oem/09_systemd_services.yaml
+++ b/packages/static/kairos-overlay-files/files/system/oem/09_systemd_services.yaml
@@ -46,12 +46,12 @@ stages:
             [Unit]
             Description=cOS system configuration
             Before=getty.target
-            
+
             [Service]
             Type=oneshot
             RemainAfterExit=yes
             ExecStart=/usr/bin/kairos-agent run-stage boot
-            
+
             [Install]
             WantedBy=multi-user.target
         - path: /etc/systemd/system/cos-setup-fs.service
@@ -65,12 +65,12 @@ stages:
             After=local-fs.target
             Wants=local-fs.target
             Before=sysinit.target
-            
+
             [Service]
             Type=oneshot
             RemainAfterExit=yes
             ExecStart=/usr/bin/kairos-agent run-stage fs
-            
+
             [Install]
             WantedBy=sysinit.target
         - path: /etc/systemd/system/cos-setup-network.service
@@ -81,12 +81,12 @@ stages:
             [Unit]
             Description=cOS setup after network
             After=network-online.target
-            
+
             [Service]
             Type=oneshot
             RemainAfterExit=yes
             ExecStart=/usr/bin/kairos-agent run-stage network
-            
+
             [Install]
             WantedBy=multi-user.target
         - path: /etc/systemd/system/cos-setup-reconcile.service
@@ -96,7 +96,7 @@ stages:
           content: |
             [Unit]
             Description=cOS setup reconciler
-            
+
             [Service]
             Nice=19
             IOSchedulingClass=2
@@ -106,7 +106,7 @@ stages:
             TimeoutStopSec=180
             KillMode=process
             KillSignal=SIGINT
-            
+
             [Install]
             WantedBy=multi-user.target
         - path: /etc/systemd/system/cos-setup-reconcile.timer
@@ -116,12 +116,12 @@ stages:
           content: |
             [Unit]
             Description=cOS setup reconciler
-            
+
             [Timer]
             OnBootSec=5min
             OnUnitActiveSec=60min
             Unit=cos-setup-reconcile.service
-            
+
             [Install]
             WantedBy=multi-user.target
     - name: "Enable systemd services"
diff --git a/packages/static/kairos-overlay-files/files/system/oem/10_accounting.yaml b/packages/static/kairos-overlay-files/files/system/oem/10_accounting.yaml
index c954c2f..27d3694 100644
--- a/packages/static/kairos-overlay-files/files/system/oem/10_accounting.yaml
+++ b/packages/static/kairos-overlay-files/files/system/oem/10_accounting.yaml
@@ -45,7 +45,7 @@ stages:
   initramfs.after:
     # Run this in the after stage so it doesnt collide with other initramfs changes to the /etc/inittab
     # Otherwise this can lead to 2 steps modifying the inittab at the same time and overriding or not cleaning it properly
-    - name: "Enable serial login for alpine" # https://wiki.alpinelinux.org/wiki/Enable_Serial_Console_on_Boot
+    - name: "Enable serial login for alpine"  # https://wiki.alpinelinux.org/wiki/Enable_Serial_Console_on_Boot
       if: '[ -e /sbin/openrc ]'
       commands:
         - sed -i -e 's/ttyS0.*//g' /etc/inittab
diff --git a/packages/static/kairos-overlay-files/files/system/oem/11_RPI.yaml b/packages/static/kairos-overlay-files/files/system/oem/11_RPI.yaml
index ce063c8..6a1a074 100644
--- a/packages/static/kairos-overlay-files/files/system/oem/11_RPI.yaml
+++ b/packages/static/kairos-overlay-files/files/system/oem/11_RPI.yaml
@@ -8,4 +8,4 @@ stages:
     - name: "Set a safe date before user creation for RPI without hardware clocks"
       if: '[ -f "/sbin/openrc" ] && [ -f "/proc/device-tree/model" ] && grep -i "Raspberry Pi" "/proc/device-tree/model"'
       commands:
-        - date -s "2006-08-14 02:34:56-06:00"
\ No newline at end of file
+        - date -s "2006-08-14 02:34:56-06:00"
diff --git a/packages/static/kairos-overlay-files/files/system/oem/25_autologin.yaml b/packages/static/kairos-overlay-files/files/system/oem/25_autologin.yaml
index b75392c..718a3ef 100644
--- a/packages/static/kairos-overlay-files/files/system/oem/25_autologin.yaml
+++ b/packages/static/kairos-overlay-files/files/system/oem/25_autologin.yaml
@@ -34,4 +34,4 @@ stages:
         - sed -i -e 's/tty1.*//g' /etc/inittab
         - sed -i -e 's/ttyS0.*//g' /etc/inittab
         - echo "tty1::respawn:/sbin/agetty --autologin root -i --noclear tty1" >> /etc/inittab
-        - echo "ttyS0::respawn:/sbin/agetty --autologin root -i --noclear ttyS0" >> /etc/inittab
\ No newline at end of file
+        - echo "ttyS0::respawn:/sbin/agetty --autologin root -i --noclear ttyS0" >> /etc/inittab
diff --git a/packages/static/kairos-overlay-files/files/system/oem/50_recovery.yaml b/packages/static/kairos-overlay-files/files/system/oem/50_recovery.yaml
index 82c4697..b750861 100644
--- a/packages/static/kairos-overlay-files/files/system/oem/50_recovery.yaml
+++ b/packages/static/kairos-overlay-files/files/system/oem/50_recovery.yaml
@@ -22,7 +22,7 @@ stages:
       commands:
         - |
           . /etc/os-release
-          [ -f "/etc/kairos-release" ] && . /etc/kairos-release 
+          [ -f "/etc/kairos-release" ] && . /etc/kairos-release
           echo >> /etc/issue
           echo "You are booting from recovery mode. Run 'kairos-agent reset' to reset the system to $VERSION" >> /etc/issue
           echo " or 'kairos-agent upgrade' to upgrade the active partition" >> /etc/issue
diff --git a/packages/static/kairos-overlay-files/files/system/oem/52_installer.yaml b/packages/static/kairos-overlay-files/files/system/oem/52_installer.yaml
index 8029b52..58d68b3 100644
--- a/packages/static/kairos-overlay-files/files/system/oem/52_installer.yaml
+++ b/packages/static/kairos-overlay-files/files/system/oem/52_installer.yaml
@@ -52,8 +52,8 @@ stages:
         [ -f "/sbin/openrc" ]
       commands:
         - rc-service kairos-webui start
-    - if: | 
+    - if: |
         ([ -f /run/cos/live_mode ] || [ -f /run/cos/uki_install_mode ]) && \
         ( [ -e "/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ] || [ -e "/usr/sbin/systemctl" ] || [ -e "/usr/bin/systemctl" ] )
       commands:
-        - systemctl start kairos-webui
\ No newline at end of file
+        - systemctl start kairos-webui
diff --git a/packages/system/suc-upgrade/suc-upgrade.sh b/packages/system/suc-upgrade/suc-upgrade.sh
index c536ba7..860c403 100644
--- a/packages/system/suc-upgrade/suc-upgrade.sh
+++ b/packages/system/suc-upgrade/suc-upgrade.sh
@@ -4,14 +4,18 @@ HOST_DIR="${HOST_DIR:-/host}"
 
 if [ "$FORCE" != "true" ]; then
     if [ -f "/etc/kairos-release" ]; then
+      # shellcheck disable=SC1091
       UPDATE_VERSION=$(source /etc/kairos-release && echo "${KAIROS_VERSION}")
     else
+      # shellcheck disable=SC1091
       UPDATE_VERSION=$(source /etc/os-release && echo "${KAIROS_VERSION}")
     fi
 
     if [ -f "/etc/kairos-release" ]; then
+      # shellcheck disable=SC1091
       CURRENT_VERSION=$(source "${HOST_DIR}"/etc/kairos-release && echo "${KAIROS_VERSION}")
     else
+      # shellcheck disable=SC1091
       CURRENT_VERSION=$(source "${HOST_DIR}"/etc/os-release && echo "${KAIROS_VERSION}")
     fi
 
@@ -23,8 +27,8 @@ if [ "$FORCE" != "true" ]; then
     fi
 fi
 
-mount --rbind $HOST_DIR/dev /dev
-mount --rbind $HOST_DIR/run /run
+mount --rbind "$HOST_DIR"/dev /dev
+mount --rbind "$HOST_DIR"/run /run
 
 recovery_mode=false
 while [[ "$#" -gt 0 ]]; do