diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
index f591665..92f0927 100644
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1 +1,2 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-funding.json
 github: [mrshmllow]
diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml
index be9538c..532a13b 100644
--- a/.github/actions/setup-nix/action.yml
+++ b/.github/actions/setup-nix/action.yml
@@ -1,8 +1,8 @@
----
+# yaml-language-server: $schema=https://www.schemastore.org/github-action.json
 name: Set up Nix
 description: |
-  Sets up the Nix environment for wire, removing unnecessary bloat and installing Nix along with proper
-  substituters being set
+  Sets up the Nix environment for wire, removing unnecessary bloat
+  and installing Nix along with proper substituters being set
 runs:
   using: "composite"
   steps:
diff --git a/.github/labeler.yml b/.github/labeler.yml
index 2f3a4ee..38beb68 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -1,3 +1,4 @@
+# yaml-language-server: $schema=https://www.schemastore.org/pull-request-labeler.json
 docs-page:
   - changed-files:
       - any-glob-to-any-file:
diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index 73bb8f2..0290218 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -1,4 +1,4 @@
----
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
 name: autofix.ci
 on:
   pull_request:
@@ -50,7 +50,9 @@ jobs:
             uv-${{ runner.os }}-${{ hashFiles('**/uv.lock') }}
             uv-${{ runner.os }}
       - name: setup sqlx
-        run: nix develop -L -v -c sqlx database setup --source ./crates/core/src/cache/migrations/
+        run: |
+          nix develop -L -v -c sqlx database setup \
+            --source ./crates/core/src/cache/migrations/
       - name: autofix sqlx
         run: nix develop -L -v -c cargo sqlx prepare --workspace
       - name: clippy --fix
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1cd08e4..90c1efd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,4 +1,4 @@
----
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
 name: "Build"
 on:
   pull_request:
@@ -24,7 +24,6 @@ jobs:
     if: needs.pre-job.outputs.should_skip != 'true'
     outputs:
       packages: ${{ steps.x86_64.outputs.packages }}
-      tests: ${{ steps.tests.outputs.tests }}
     steps:
       - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
         with:
@@ -32,12 +31,11 @@ jobs:
       - uses: ./.github/actions/setup-nix
       - name: Find package jobs
         id: x86_64
-        run: echo "packages=$(nix eval .#hydraJobs.packages.x86_64-linux --apply "builtins.attrNames" --json)" >> "$GITHUB_OUTPUT"
-      - name: Find test Jobs
-        id: tests
-        run: echo "tests=$(nix eval .#hydraJobs.tests --apply "builtins.attrNames" --json)" >> "$GITHUB_OUTPUT"
+        run: |
+          echo "packages=$(nix eval .#hydraJobs.packages.x86_64-linux \
+            --apply builtins.attrNames --json)" >> "$GITHUB_OUTPUT"
   build-key-agent-aarch64:
-    runs-on: ubuntu-26.04-arm
+    runs-on: ubuntu-24.04-arm
     permissions:
       id-token: write
     needs: pre-job
@@ -48,7 +46,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/setup-nix
       - name: Build
-        run: nix build --print-build-logs --print-out-paths .#packages.aarch64-linux.agent
+        run: nix build -L --print-out-paths .#packages.aarch64-linux.agent
   build-key-agent-x86_64:
     runs-on: ubuntu-latest
     permissions:
@@ -61,7 +59,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/setup-nix
       - name: Build
-        run: nix build --print-build-logs --print-out-paths .#packages.x86_64-linux.agent
+        run: nix build -L --print-out-paths .#packages.x86_64-linux.agent
   build:
     runs-on: ${{ matrix.arch.runner }}
     needs:
@@ -89,29 +87,8 @@ jobs:
       - uses: ./.github/actions/setup-nix
       - name: Build
         run: |
-          nix build --print-build-logs --print-out-paths .#hydraJobs.packages.${ARCH}.${MATRIX_PACKAGE}
+          nix build -L --print-out-paths \
+            .#hydraJobs.packages."${ARCH}"."${MATRIX_PACKAGE}"
         env:
           MATRIX_PACKAGE: ${{ matrix.package }}
           ARCH: ${{ matrix.arch.id }}
-  tests:
-    # tests is too heavy, disable temporarily
-    if: false
-    runs-on: ubuntu-latest
-    needs:
-      - find-jobs
-      - build-key-agent-x86_64
-    permissions:
-      id-token: write
-    strategy:
-      matrix:
-        test: ${{ fromJSON(needs.find-jobs.outputs.tests) }}
-    steps:
-      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/setup-nix
-      - name: Test
-        run: |
-          nix build --print-build-logs --print-out-paths .#hydraJobs.tests.${MATRIX_TEST}
-        env:
-          MATRIX_TEST: ${{ matrix.test }}
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 38ae263..9374635 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -1,3 +1,4 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
 name: "Pull Request Labeler"
 on:
   - pull_request
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 1cfeb60..36d4413 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -1,4 +1,4 @@
----
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
 name: "Pages"
 on:
   push:
@@ -18,12 +18,14 @@ jobs:
         uses: fkirc/skip-duplicate-actions@04a1aebece824b56e6ad6a401d015479cd1c50b3
   deploy:
     runs-on: ubuntu-latest
+    needs: pre-job
     permissions:
       id-token: write
     environment:
       name: production
       url: https://wire.forall.systems/
-    if: github.actor != 'dependabot[bot]' && needs.pre-job.outputs.should_skip != 'true'
+    if: github.actor != 'dependabot[bot]'
+      && needs.pre-job.outputs.should_skip != 'true'
     steps:
       - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
         with:
diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index 3bcdfc2..076074c 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -1,4 +1,4 @@
----
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
 name: "PR Preview"
 on:
   push:
@@ -26,7 +26,10 @@ jobs:
       - name: Locate Base Ref
         id: base-ref
         run: |
-          echo "base-ref=$(gh api /repos/${{ github.repository }}/pulls/${NEEDS_GET_PR_OUTPUTS_NUMBER} | jq -r '.base.ref')" >> "$GITHUB_OUTPUT"
+          repo="${{ github.repository }}"
+          echo "base-ref=$(gh api /repos/"$repo"/pulls/\
+            "${NEEDS_GET_PR_OUTPUTS_NUMBER}" \
+            | jq -r '.base.ref')" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NEEDS_GET_PR_OUTPUTS_NUMBER: ${{ needs.get-pr.outputs.number }}
@@ -82,4 +85,5 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          command: pages deploy ./result/ --project-name wire-docs --branch pr-${{ needs.get-pr.outputs.number }}
+          command: pages deploy ./result/ --project-name wire-docs
+            --branch pr-${{ needs.get-pr.outputs.number }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 42ca071..cf64ab7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,4 +1,4 @@
----
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
 name: "Test"
 on:
   pull_request:
diff --git a/.yamllint.yaml b/.yamllint.yaml
new file mode 100644
index 0000000..fca3462
--- /dev/null
+++ b/.yamllint.yaml
@@ -0,0 +1,11 @@
+extends: default
+ignore: |
+  doc/pnpm-lock.yaml
+rules:
+  line-length:
+    max: 160
+  truthy:
+    check-keys: false
+  document-start:
+    present: false
+  comments-indentation: disable
diff --git a/Cargo.toml b/Cargo.toml
index 848c7d4..81bc74f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,3 +1,4 @@
+#:schema https://json.schemastore.org/cargo.json
 [workspace]
 members = ["crates/key_agent", "crates/core", "crates/cli", "crates/nix_client"]
 resolver = "2"
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index 8a04a82..e42c233 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -1,3 +1,4 @@
+#:schema https://json.schemastore.org/cargo.json
 [package]
 name = "wire"
 version.workspace = true
diff --git a/crates/core/Cargo.toml b/crates/core/Cargo.toml
index 7d390a9..9fdae43 100644
--- a/crates/core/Cargo.toml
+++ b/crates/core/Cargo.toml
@@ -1,3 +1,4 @@
+#:schema https://json.schemastore.org/cargo.json
 [package]
 name = "wire-core"
 version.workspace = true
diff --git a/crates/key_agent/Cargo.toml b/crates/key_agent/Cargo.toml
index ccef814..909213b 100644
--- a/crates/key_agent/Cargo.toml
+++ b/crates/key_agent/Cargo.toml
@@ -1,3 +1,4 @@
+#:schema https://json.schemastore.org/cargo.json
 [package]
 name = "wire-key-agent"
 edition.workspace = true
diff --git a/crates/nix_client/Cargo.toml b/crates/nix_client/Cargo.toml
index 8332669..adaf1d1 100644
--- a/crates/nix_client/Cargo.toml
+++ b/crates/nix_client/Cargo.toml
@@ -1,3 +1,4 @@
+#:schema https://json.schemastore.org/cargo.json
 [package]
 name = "wire-nix-client"
 edition.workspace = true
diff --git a/doc/package.json b/doc/package.json
index 4e4de71..542cd1b 100644
--- a/doc/package.json
+++ b/doc/package.json
@@ -1,4 +1,5 @@
 {
+  "$schema": "https://json.schemastore.org/package.json",
   "name": "wire-docs",
   "version": "1.3.0",
   "type": "module",
diff --git a/doc/snippets/guides/example-action.yml b/doc/snippets/guides/example-action.yml
index 09c99c0..06f6fe4 100644
--- a/doc/snippets/guides/example-action.yml
+++ b/doc/snippets/guides/example-action.yml
@@ -1,3 +1,4 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
 name: Build
 
 on:
@@ -26,7 +27,9 @@ jobs:
           nix_path: nixpkgs=channel:nixos-unstable
           extra_nix_config: |
             # Install binary cache as described in the install wire guide
-            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= cache.forall.systems:5PmD7QO4MSF8YgyRZtkSGXRDo96H3bybIf2SsQh8ScI=
+            trusted-public-keys = \
+              cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= \
+              cache.forall.systems:5PmD7QO4MSF8YgyRZtkSGXRDo96H3bybIf2SsQh8ScI=
             substituters = https://cache.nixos.org/ https://cache.forall.systems
 
             # Again, include additional architectures if you have multiple
diff --git a/nix/hooks.nix b/nix/hooks.nix
index 855dccd..0d2b7ff 100644
--- a/nix/hooks.nix
+++ b/nix/hooks.nix
@@ -45,6 +45,16 @@
                 ''
               );
             };
+            taplo = {
+              enable = true;
+              name = "taplo check";
+              files = "\\.toml$";
+              entry = lib.getExe (
+                pkgs.writeShellScriptBin "taplo-check" ''
+                  ${lib.getExe pkgs.taplo} check
+                ''
+              );
+            };
             machete = {
               enable = true;
               name = "cargo-machete";
@@ -57,6 +67,14 @@
                 configPath = "typos.toml";
               };
             };
+            actionlint = {
+              enable = true;
+              files = "^\\.github/workflows/.*\\.(yml|yaml)$";
+            };
+            yamllint = {
+              enable = true;
+              settings.configPath = ".yamllint.yaml";
+            };
 
           };
 
diff --git a/taplo.toml b/taplo.toml
new file mode 100644
index 0000000..f5c0923
--- /dev/null
+++ b/taplo.toml
@@ -0,0 +1 @@
+exclude = [".direnv/**"]
diff --git a/tests/nix/pyproject.toml b/tests/nix/pyproject.toml
index 14a294c..09bef04 100644
--- a/tests/nix/pyproject.toml
+++ b/tests/nix/pyproject.toml
@@ -1,3 +1,4 @@
+#:schema https://json.schemastore.org/pyproject.json
 [project]
 name = "wire-vm-tests"
 version = "0.0.0"
diff --git a/typos.toml b/typos.toml
index 36d9c5e..d0b7af9 100644
--- a/typos.toml
+++ b/typos.toml
@@ -1,3 +1,4 @@
+#:schema https://raw.githubusercontent.com/crate-ci/typos/master/config.schema.json
 [files]
 extend-exclude = ["COPYING"]