diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0062fa638..413395449 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -43,6 +43,10 @@ jobs:
           check-latest: true
       - name: Check out code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          # Full history is required for golangci-lint's merge-base
+          # (new-issues) gating to diff a PR against the default branch.
+          fetch-depth: 0
       - name: Cache Go modules
         uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         id: go-mod-cache
@@ -53,6 +57,10 @@ jobs:
             ${{ runner.os }}-go-
       - name: Get dependencies
         run: make download
+      - name: Lint
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        with:
+          version: v2.5.0
       - name: Build
         run: make build
       - name: Run unit tests
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 000000000..b1568d5c6
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,53 @@
+# Copyright The Notary Project Authors.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+version: "2"
+
+run:
+  timeout: 5m
+
+# Adopt linting incrementally: only fail on issues introduced by a PR relative
+# to its merge base with the default branch, not on the pre-existing backlog.
+# Remove `new-from-merge-base` once the backlog under `make lint` is cleared to
+# enforce linting across the whole tree.
+issues:
+  new-from-merge-base: origin/main
+  max-issues-per-linter: 0
+  max-same-issues: 0
+
+linters:
+  # Start conservative: the default set plus a few high-signal linters.
+  # Expand this list over time as the codebase is cleaned up.
+  default: standard
+  enable:
+    - bodyclose
+    - misspell
+    - revive
+    - unconvert
+    - whitespace
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - std-error-handling
+    paths:
+      - test/e2e
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/notaryproject/notation
diff --git a/Makefile b/Makefile
index a2e8fe596..27fe65d18 100644
--- a/Makefile
+++ b/Makefile
@@ -71,6 +71,10 @@ e2e-covdata:
 	export GO_INSTRUMENT_FLAGS='-coverpkg "github.com/notaryproject/notation/v2/internal/...,github.com/notaryproject/notation/v2/cmd/..."'; \
 	$(MAKE) e2e && go tool covdata textfmt -i=$$GOCOVERDIR -o "$(CURDIR)/test/e2e/coverage.txt"
 
+.PHONY: lint
+lint: ## run golangci-lint (install: https://golangci-lint.run/welcome/install/)
+	golangci-lint run
+
 .PHONY: clean
 clean:
 	git status --ignored --short | grep '^!! ' | sed 's/!! //' | xargs rm -rf