diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
new file mode 100644
index 00000000..2a02117c
--- /dev/null
+++ b/.github/workflows/golangci-lint.yml
@@ -0,0 +1,22 @@
+name: golangci-lint
+on:
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: stable
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: v1.61
+          args: --timeout=30m
diff --git a/caller/main.go b/caller/main.go
index f1d54cff..c24875fa 100644
--- a/caller/main.go
+++ b/caller/main.go
@@ -5,8 +5,9 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"log"
 	"os/exec"
+
+	log "github.com/sirupsen/logrus"
 )
 
 var proxyURL = flag.String("proxy-url", "", "")
@@ -32,7 +33,9 @@ func main() {
 
 	go func() {
 		fmt.Println("writing to stdin")
-		io.WriteString(stdin, *proxyLogin)
+		if _, err := io.WriteString(stdin, *proxyLogin); err != nil {
+			log.WithError(err).Error("Failed to write to stdin")
+		}
 		closeErr = stdin.Close()
 	}()
 
@@ -51,7 +54,9 @@ func main() {
 		fmt.Println(scanner.Text())
 	}
 
-	cmd.Wait()
+	if err := cmd.Wait(); err != nil {
+		log.WithError(err).Error("failed to wait for cmd")
+	}
 
 	if closeErr != nil {
 		fmt.Printf("error when closing stdin pipe: %s\n", closeErr)
diff --git a/http-client.go b/http-client.go
index c80f4995..7dff1a92 100644
--- a/http-client.go
+++ b/http-client.go
@@ -24,11 +24,11 @@ func (p Proxy) BasicAuthorizationHeader() string {
 	return "Basic " + encodedAuth
 }
 
-func (p Proxy) HttpTransport() http.Transport {
+func (p Proxy) HttpTransport() *http.Transport {
 	proxyURLFunc := func(r *http.Request) (*url.URL, error) {
 		return url.Parse(p.URL)
 	}
-	transport := http.Transport{
+	transport := &http.Transport{
 		Proxy: proxyURLFunc,
 		TLSClientConfig: &tls.Config{
 			InsecureSkipVerify: true,
diff --git a/public_root_of_trust.go b/public_root_of_trust.go
index ae8f20b9..12409216 100644
--- a/public_root_of_trust.go
+++ b/public_root_of_trust.go
@@ -32,7 +32,7 @@ func GetSigstorePublicTufTargets(usage sigtuf.UsageKind, proxy Proxy) ([]sigtuf.
 	}
 	if proxy.URL != "" {
 		transport := proxy.HttpTransport()
-		httpClient.Transport = &transport
+		httpClient.Transport = transport
 	} else {
 		httpClient.Transport = &http.Transport{
 			TLSClientConfig: &tls.Config{