diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..12d7152
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,11 @@
+name: ci
+on:
+  pull_request:
+  push:
+    branches: [main]
+jobs:
+  ci:
+    uses: SilexConsulting/.github/.github/workflows/gitops-ci.yml@main
+    with:
+      kubernetes: true
+      terraform: false
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..9b3f8d3
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,11 @@
+# gitleaks config for CI (GIT-24). Extends the default ruleset; allowlists files that
+# legitimately contain key-shaped placeholders or ciphertext (not real plaintext secrets).
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Documented example secret template + SOPS-encrypted files"
+paths = [
+  '''bootstrap/argocd/secrets\.yaml$''',   # example (real secrets live in secrets.enc.yaml, SOPS)
+  '''.*\.enc\.yaml$''',                     # SOPS-encrypted
+]
diff --git a/.markdownlint.json b/.markdownlint.json
new file mode 100644
index 0000000..b1cfa6d
--- /dev/null
+++ b/.markdownlint.json
@@ -0,0 +1,17 @@
+{
+  "default": true,
+  "MD001": false,
+  "MD009": false,
+  "MD012": false,
+  "MD013": false,
+  "MD022": false,
+  "MD025": false,
+  "MD026": false,
+  "MD031": false,
+  "MD032": false,
+  "MD033": false,
+  "MD034": false,
+  "MD040": false,
+  "MD041": false,
+  "MD060": false
+}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..b2bcf00
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,40 @@
+# Local checks (union of the repo's original hooks + GIT-24 additions).
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-merge-conflict
+      - id: check-yaml
+        args: [--allow-multiple-documents]
+  - repo: https://github.com/adrienverge/yamllint
+    rev: v1.35.1
+    hooks:
+      - id: yamllint
+  - repo: https://github.com/igorshubovych/markdownlint-cli
+    rev: v0.41.0
+    hooks:
+      - id: markdownlint
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.10.0.1
+    hooks:
+      - id: shellcheck
+  - repo: https://github.com/pre-commit/mirrors-prettier
+    rev: v3.3.3
+    hooks:
+      - id: prettier
+        additional_dependencies:
+          - prettier@3.3.3
+        types_or: [yaml, markdown]
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.21.2
+    hooks:
+      - id: gitleaks
+  - repo: local
+    hooks:
+      - id: sops-encrypted
+        name: "sops-encrypted (enc.yaml must be encrypted)"
+        entry: "bash -c 'for f in \"$@\"; do grep -Eq \"sops:|ENC\\[\" \"$f\" || { echo \"not-encrypted $f\"; exit 1; }; done' --"
+        language: system
+        files: "\\.enc\\.yaml$"
diff --git a/.yamllint b/.yamllint
new file mode 100644
index 0000000..baea090
--- /dev/null
+++ b/.yamllint
@@ -0,0 +1,14 @@
+extends: relaxed
+rules:
+  line-length: disable
+  document-start: disable
+  trailing-spaces:
+    level: warning
+  new-line-at-end-of-file:
+    level: warning
+# Helm chart templates and encrypted files are not plain YAML.
+ignore: |
+  **/charts/**
+  **/templates/**
+  *.enc.yaml
+  demo/**