diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b602a547..56a54ab1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,19 @@ on:
   push:
 
 jobs:
+  style-checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 1.21
+      - name: Format
+        run: |
+          if [[ "$(make check_format | wc -l)" -gt 0 ]]; then
+            exit 1
+          fi
+
   test:
     runs-on: ubuntu-latest
     steps:
diff --git a/Makefile b/Makefile
index 1ca5a620..fa053a9e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 PKG_NAME=github.com/SwissDataScienceCenter/renku-gateway
 
-.PHONY: build clean tests format
+.PHONY: build clean tests format check_format tidy
 
 build: internal/login/spec.gen.go
 	go mod download
@@ -20,3 +20,9 @@ internal/login/spec.gen.go: apispec.yaml
 
 format:
 	gofmt -l -w cmd internal tools
+
+check_format:
+	gofmt -l cmd internal tools
+
+tidy:
+	go mod tidy -e
diff --git a/internal/revproxy/main_test.go b/internal/revproxy/main_test.go
index 02bd2ddd..c2b2d859 100644
--- a/internal/revproxy/main_test.go
+++ b/internal/revproxy/main_test.go
@@ -1020,7 +1020,7 @@ func TestInternalSvcRoutes(t *testing.T) {
 		{
 			Path: "/ui-server/api/data/repositories/https%3A%2F%2Fexample.org%2Fgroup%2Frepo",
 			Expected: TestResults{
-				Path:            "/api/data/repositories/https%3A%2F%2Fexample.org%2Fgroup%2Frepo",
+				Path:             "/api/data/repositories/https%3A%2F%2Fexample.org%2Fgroup%2Frepo",
 				VisitedServerIDs: []string{"upstream"},
 			},
 		},
diff --git a/internal/revproxy/middlewares.go b/internal/revproxy/middlewares.go
index 1e1c4112..97fe40aa 100644
--- a/internal/revproxy/middlewares.go
+++ b/internal/revproxy/middlewares.go
@@ -255,7 +255,7 @@ func notebooksAnonymousID(sessions *sessions.SessionStore) echo.MiddlewareFunc {
 			// NOTE: The anonymous session ID must start with a letter, otherwise when we use it to create sessions in k8s
 			// things fail because a label value must start with a letter. That is why we add `anon-` here to the value.
 			// Note that valid values for a label in k8s are [a-zA-Z0-9], also -_. and it must start with a letter.
-			c.Request().Header.Set("Renku-Auth-Anon-Id", "anon-" + session.ID)
+			c.Request().Header.Set("Renku-Auth-Anon-Id", "anon-"+session.ID)
 			return next(c)
 		}
 	}