diff --git a/.ansible-lint.yml b/.ansible-lint.yml
new file mode 100644
index 0000000..846d42b
--- /dev/null
+++ b/.ansible-lint.yml
@@ -0,0 +1,9 @@
+---
+skip_list:
+  - var-naming[no-role-prefix]
+  - galaxy[no-changelog]
+  - galaxy[version-incorrect]
+  - meta-runtime[unsupported-version]
+exclude_paths:
+  - actionlint.yml
+  - .github/
diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 0000000..984b0d9
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,8 @@
+# The is primarily used to alter the behaviour of linters executed by super-linter.
+# See https://editorconfig.org/
+
+# shfmt will default to indenting shell scripts with tabs,
+# define the indent as 2 spaces
+[bin/*]
+indent_style = space
+indent_size = 2
diff --git a/.github/linters/actionlint.yml b/.github/linters/actionlint.yml
new file mode 100644
index 0000000..a423db9
--- /dev/null
+++ b/.github/linters/actionlint.yml
@@ -0,0 +1,26 @@
+# Configuration for file paths. The keys are glob patterns to match to file
+# paths relative to the repository root. The values are the configurations for
+# the file paths. Note that the path separator is always '/'.
+# The following configurations are available.
+#
+# "ignore" is an array of regular expression patterns. Matched error messages
+# are ignored. This is similar to the "-ignore" command line option.
+paths:
+#  .github/workflows/**/*.yml:
+#    ignore: []
+
+  .github/workflows/cleanup-ci-resources.yml:
+    ignore: [ "string should not be empty" ]
+
+  .github/workflows/test-backup-restore.yml:
+    ignore: [ "string should not be empty" ]
+
+  .github/workflows/test-ha.yml:
+    ignore: [ "string should not be empty" ]
+
+  .github/workflows/test-singlenode.yml:
+    ignore: [ "string should not be empty" ]
+
+  .github/workflows/test-upgrade.yml:
+    ignore: [ "string should not be empty" ]
+
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..e51c31b
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,47 @@
+---
+name: Lint
+
+on:  # yamllint disable-line rule:truthy
+  workflow_call:
+
+permissions:
+  contents: read
+  packages: read
+  # To report GitHub Actions status checks
+  statuses: write
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+      # To report GitHub Actions status checks
+      statuses: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # super-linter needs the full git history to get the
+          # list of files that changed across commits
+          fetch-depth: 0
+          submodules: true
+
+      - name: Run ansible-lint
+        uses: ansible/ansible-lint@v25.4.0
+
+      - name: Load super-linter configuration
+        # Use grep inverse matching to exclude eventual comments in the .env file
+        # because the GitHub Actions command to set environment variables doesn't
+        # support comments.
+        # yamllint disable-line rule:line-length
+        # Ref: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions#setting-an-environment-variable
+        run: grep -v '^#' super-linter.env >> "$GITHUB_ENV"
+        if: always()
+
+      - name: Run super-linter
+        uses: super-linter/super-linter@v7.3.0
+        if: always()
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
new file mode 100644
index 0000000..d890bff
--- /dev/null
+++ b/.github/workflows/pr.yml
@@ -0,0 +1,26 @@
+---
+    name: Build and test PR
+
+    permissions:
+      contents: read
+      packages: read
+      # To report GitHub Actions status checks
+      statuses: write
+
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+
+    on:
+      pull_request:
+        types:
+          - opened
+          - synchronize
+          - ready_for_review
+          - reopened
+        branches:
+          - main
+
+    jobs:
+      lint:
+        uses: ./.github/workflows/lint.yml
diff --git a/.yamllint.yml b/.yamllint.yml
new file mode 100644
index 0000000..3220260
--- /dev/null
+++ b/.yamllint.yml
@@ -0,0 +1,24 @@
+---
+extends: default
+
+rules:
+  brackets:
+    forbid: non-empty
+  comments:
+    # https://github.com/prettier/prettier/issues/6780
+    min-spaces-from-content: 1
+  # https://github.com/adrienverge/yamllint/issues/384
+  comments-indentation: false
+  document-start: disable
+  # 160 chars was the default used by old E204 rule, but
+  # you can easily change it or disable in your .yamllint file.
+  line-length:
+    max: 160
+  # We are adding an extra space inside braces as that's how prettier does it
+  # and we are trying not to fight other linters.
+  braces:
+    min-spaces-inside: 0 # yamllint defaults to 0
+    max-spaces-inside: 1 # yamllint defaults to 0
+  octal-values:
+    forbid-implicit-octal: true # yamllint defaults to false
+    forbid-explicit-octal: true # yamllint defaults to false
diff --git a/README.md b/README.md
index 04fe4ca..6db8e0f 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,20 @@
 # caas-rstudio-server
 
-This repository adapts [RStudio](https://posit.co/products/open-source/rstudio/) for use within the 
+This repository adapts [RStudio](https://posit.co/products/open-source/rstudio/) for use within the
 Cluster-as-a-Service system of the [Azimuth Cloud Portal](https://github.com/azimuth-cloud/azimuth).
 
+## Developing locally
+
+To run the GitHub Actions linters locally, use:
+
+```sh
+docker run --rm \
+    -e RUN_LOCAL=true \
+    --env-file "super-linter.env" \
+    -v "$(pwd)":/tmp/lint \
+    ghcr.io/super-linter/super-linter:v7.3.0
+```
+
+```sh
+ansible-lint -c .ansible-lint.yml
+```
diff --git a/actionlint.yml b/actionlint.yml
new file mode 100644
index 0000000..ed97d53
--- /dev/null
+++ b/actionlint.yml
@@ -0,0 +1 @@
+---
diff --git a/ansible.cfg b/ansible.cfg
index 9853c5e..aa282bc 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -4,5 +4,5 @@ gathering = smart
 forks = 30
 host_key_checking = False
 remote_tmp = /tmp
-collections_path = collections
-roles_path = roles
+collections_path = .ansible/collections
+roles_path = .ansible/roles
diff --git a/roles/cluster_infra/tasks/main.yml b/roles/cluster_infra/tasks/main.yml
index 2f6b106..44ec2b9 100644
--- a/roles/cluster_infra/tasks/main.yml
+++ b/roles/cluster_infra/tasks/main.yml
@@ -1,31 +1,35 @@
 ---
 
 - name: Install Terraform binary
-  include_role:
+  ansible.builtin.include_role:
     name: azimuth_cloud.terraform.install
 
 - name: Make Terraform project directory
-  file:
+  ansible.builtin.file:
     path: "{{ terraform_project_path }}"
     state: directory
+    mode: "0755 "
 
 - name: Write backend type configuration
-  copy:
+  ansible.builtin.copy:
     content: |
       terraform {
         backend "{{ terraform_backend_type }}" { }
       }
     dest: "{{ terraform_project_path }}/backend.tf"
+    mode: "0644"
 
 - name: Write backend configuration options
-  copy:
+  ansible.builtin.copy:
     content: "{{ terraform_backend_config | to_json }}"
     dest: "{{ terraform_project_path }}/backend_config.json"
+    mode: "0644"
 
 - name: Template Terraform files into project directory
-  template:
+  ansible.builtin.template:
     src: "{{ item }}.j2"
     dest: "{{ terraform_project_path }}/{{ item }}"
+    mode: "0644"
   loop:
     - outputs.tf
     - providers.tf
@@ -38,5 +42,5 @@
     state: "{{ terraform_state }}"
     backend_config_files:
       - "{{ terraform_project_path }}/backend_config.json"
-    force_init: yes
-    init_reconfigure: yes
+    force_init: true
+    init_reconfigure: true
diff --git a/rstudio.yml b/rstudio.yml
index 2b4ffd7..36ca3f4 100644
--- a/rstudio.yml
+++ b/rstudio.yml
@@ -7,7 +7,7 @@
     - cluster_infra
   post_tasks:
     - name: Wait for RStudio to become available
-      uri:
+      ansible.builtin.uri:
         url: "http://{{ zenith_fqdn_rstudio }}"
         method: GET
         follow_redirects: safe
@@ -24,9 +24,9 @@
       delay: 10
       until: "rstudio_uri is not failed"
       when: (cluster_state | default('present')) == 'present'
-    
+
     - name: Wait for Monitoring to become available
-      uri:
+      ansible.builtin.uri:
         url: "http://{{ zenith_fqdn_monitoring }}"
         method: GET
         follow_redirects: safe
diff --git a/super-linter.env b/super-linter.env
new file mode 100644
index 0000000..4e0e168
--- /dev/null
+++ b/super-linter.env
@@ -0,0 +1,17 @@
+# Detect that default branch is devel when running locally
+DEFAULT_BRANCH=main
+
+# Don't validate JSCPD
+VALIDATE_JSCPD=false
+
+# Don't validate JS standard because it conflicts with JS prettier
+VALIDATE_JAVASCRIPT_STANDARD=false
+
+# Don't validate Ansible because ansible-lint is more flexible
+VALIDATE_ANSIBLE=false
+
+# Don't validate YAML prettier because yamllint is sufficient
+VALIDATE_YAML_PRETTIER=false
+
+# Don't validate using kubeconform because it wants an appTemplate schema
+VALIDATE_KUBERNETES_KUBECONFORM=false
diff --git a/ui-meta/rstudio.yml b/ui-meta/rstudio.yml
index e2881e2..88edeb9 100644
--- a/ui-meta/rstudio.yml
+++ b/ui-meta/rstudio.yml
@@ -1,10 +1,10 @@
 name: "rstudio"
 label: "R-Studio Server"
-description: >- 
+description: >-
   Run an R-Studio Server instance for easy web-based access to an R-Studio environment running on cloud hardware.
 logo: https://raw.githubusercontent.com/rstudio/hex-stickers/main/thumbs/RStudio.png
 
-parameters: 
+parameters:
   - name: cluster_flavor
     kind: "cloud.size"
     label: "Machine size"
@@ -34,7 +34,7 @@ parameters:
     immutable: true
 
 usage_template: |-
-  The RStudio Server web interface can be accessed from the services list. 
+  The RStudio Server web interface can be accessed from the services list.
   The `data` directory within RStudio interface should be used to store any long-lived research data.
 
 services: