diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index ce0d168..adbd2de 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -48,10 +48,14 @@ jobs:
       - name: Download tun2socks for embedding
         run: make download-tun2socks
 
+      - name: Install lint tools
+        run: make install-lint-tools
+
+      - name: Check formatting
+        run: make fmt-check
+
       - name: Lint
-        uses: golangci/golangci-lint-action@v9
-        with:
-          version: v2.10.1
+        run: make lint
 
   test-linux:
     name: Test (Linux)
diff --git a/Makefile b/Makefile
index 94a8cac..9d5af9c 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ BINARY_UNIX=$(BINARY_NAME)_unix
 TUN2SOCKS_VERSION=v2.5.2
 TUN2SOCKS_BIN_DIR=internal/sandbox/bin
 
-.PHONY: all build build-ci build-linux test test-ci clean deps install-lint-tools setup setup-ci run fmt lint release release-minor release-beta download-tun2socks help
+.PHONY: all build build-ci build-linux test test-ci clean deps install-lint-tools install-hooks setup setup-ci run fmt fmt-check lint release release-minor release-beta download-tun2socks help
 
 all: build
 
@@ -77,7 +77,13 @@ install-lint-tools:
 	go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
 	@echo "Linting tools installed"
 
-setup: deps install-lint-tools
+install-hooks:
+	@echo "Installing git hooks..."
+	cp scripts/pre-commit .git/hooks/pre-commit
+	chmod +x .git/hooks/pre-commit
+	@echo "Git hooks installed"
+
+setup: deps install-lint-tools install-hooks
 	@echo "Development environment ready"
 
 setup-ci: deps install-lint-tools
@@ -90,6 +96,16 @@ fmt:
 	@echo "Formatting code..."
 	gofumpt -w .
 
+fmt-check:
+	@echo "Checking formatting..."
+	@UNFORMATTED=$$(gofumpt -l .); \
+	if [ -n "$$UNFORMATTED" ]; then \
+		echo "The following files need formatting (run 'make fmt'):"; \
+		echo "$$UNFORMATTED"; \
+		exit 1; \
+	fi
+	@echo "All files are formatted."
+
 lint:
 	@echo "Linting code..."
 	golangci-lint run --allow-parallel-runners
@@ -119,10 +135,12 @@ help:
 	@echo "  clean              - Clean build artifacts"
 	@echo "  deps               - Download dependencies"
 	@echo "  install-lint-tools - Install linting tools"
-	@echo "  setup              - Setup development environment"
+	@echo "  install-hooks      - Install git pre-commit hook"
+	@echo "  setup              - Setup development environment (includes hooks)"
 	@echo "  setup-ci           - Setup CI environment"
 	@echo "  run                - Build and run"
 	@echo "  fmt                - Format code"
+	@echo "  fmt-check          - Check formatting (non-destructive, for CI)"
 	@echo "  lint               - Lint code"
 	@echo "  release            - Create patch release (v0.0.X)"
 	@echo "  release-minor      - Create minor release (v0.X.0)"
diff --git a/cmd/greywall/main.go b/cmd/greywall/main.go
index 61442a1..f73d8a7 100644
--- a/cmd/greywall/main.go
+++ b/cmd/greywall/main.go
@@ -1096,7 +1096,7 @@ profiles, first save a copy with --learning or copy the output of "profiles show
 					}
 					switch strings.ToLower(strings.TrimSpace(choice)) {
 					case "d", "discard":
-						if writeErr := os.WriteFile(profilePath, originalData, 0o600); writeErr != nil {
+						if writeErr := os.WriteFile(profilePath, originalData, 0o600); writeErr != nil { //nolint:gosec // user-specified profile path - intentional
 							return fmt.Errorf("failed to restore original profile: %w", writeErr)
 						}
 						fmt.Println("Changes discarded.")
diff --git a/scripts/pre-commit b/scripts/pre-commit
new file mode 100755
index 0000000..53a5f58
--- /dev/null
+++ b/scripts/pre-commit
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Pre-commit hook: run gofumpt and golangci-lint before every commit.
+# Install with: make install-hooks
+
+set -euo pipefail
+
+export PATH="$PATH:$(go env GOPATH)/bin"
+
+echo "[greywall] Running pre-commit checks..."
+
+if ! command -v gofumpt &>/dev/null; then
+  echo "[greywall] gofumpt not found — run 'make setup' to install linting tools"
+  exit 1
+fi
+
+if ! command -v golangci-lint &>/dev/null; then
+  echo "[greywall] golangci-lint not found — run 'make setup' to install linting tools"
+  exit 1
+fi
+
+echo "[greywall] Checking formatting..."
+UNFORMATTED=$(gofumpt -l .)
+if [ -n "$UNFORMATTED" ]; then
+  echo "[greywall] The following files need formatting (run 'make fmt'):"
+  echo "$UNFORMATTED"
+  exit 1
+fi
+
+echo "[greywall] Running linter..."
+golangci-lint run --allow-parallel-runners
+
+echo "[greywall] All checks passed."