diff --git a/.github/workflows/prv.yml b/.github/workflows/prv.yml
index 57a603f..376ca22 100644
--- a/.github/workflows/prv.yml
+++ b/.github/workflows/prv.yml
@@ -10,6 +10,20 @@ env:
   BISCUIT_PRIVATE_KEY: ed25519-private/869fb6eef6b04ee212479b344690549c9e77bde6c3412b5badcd8b65f89d8c70
 
 jobs:
+  lint:
+    name: Lint
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: DeterminateSystems/nix-installer-action@c5a866b6ab867e88becbed4467b93592bce69f8a # v21
+      - run: nix run github:nicknovitski/nix-develop .#workflow
+      - run: deno install --frozen
+
+      - run: deno lint
+
   test:
     runs-on: ubuntu-latest
 
diff --git a/deno.lock b/deno.lock
index 49bc7d4..9af6503 100644
--- a/deno.lock
+++ b/deno.lock
@@ -2,7 +2,9 @@
   "version": "5",
   "specifiers": {
     "jsr:@std/assert@*": "1.0.14",
+    "jsr:@std/assert@^1.0.18": "1.0.18",
     "jsr:@std/internal@^1.0.10": "1.0.10",
+    "jsr:@std/internal@^1.0.12": "1.0.12",
     "npm:@biscuit-auth/biscuit-wasm@0.6": "0.6.0",
     "npm:playwright@1.57.0": "1.57.0"
   },
@@ -10,11 +12,14 @@
     "@std/assert@1.0.14": {
       "integrity": "68d0d4a43b365abc927f45a9b85c639ea18a9fab96ad92281e493e4ed84abaa4",
       "dependencies": [
-        "jsr:@std/internal"
+        "jsr:@std/internal@^1.0.10"
       ]
     },
     "@std/assert@1.0.18": {
-      "integrity": "270245e9c2c13b446286de475131dc688ca9abcd94fc5db41d43a219b34d1c78"
+      "integrity": "270245e9c2c13b446286de475131dc688ca9abcd94fc5db41d43a219b34d1c78",
+      "dependencies": [
+        "jsr:@std/internal@^1.0.12"
+      ]
     },
     "@std/internal@1.0.10": {
       "integrity": "e3be62ce42cab0e177c27698e5d9800122f67b766a0bea6ca4867886cbde8cf7"
diff --git a/flake.nix b/flake.nix
index 17dc92b..339e4f0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -15,11 +15,17 @@
       in
       {
         devShells.default = pkgs.mkShell {
-          buildInputs = [
+          nativeBuildInputs = [
             pkgs.deno
             pkgs.google-cloud-sdk
           ];
         };
+
+        devShells.workflow = pkgs.mkShell {
+          nativeBuildInputs = [
+            pkgs.deno
+          ];
+        };
       }
     );
 }
diff --git a/main.ts b/main.ts
index 1864ec8..fee0c58 100644
--- a/main.ts
+++ b/main.ts
@@ -19,7 +19,7 @@ const port: number = parseInt(Deno.env.get("PORT") ?? "3000", 10);
  * Biscuit private and public keys. These are used to sign and verify
  * authorization tokens.
  */
-const { privateKey, publicKey } = (() => {
+const { privateKey: _, publicKey } = (() => {
   const privateKeyString = Deno.env.get("BISCUIT_PRIVATE_KEY");
   if (!privateKeyString) {
     throw new Error("BISCUIT_PRIVATE_KEY environment variable is not set");
@@ -92,7 +92,7 @@ Deno.serve({ port }, async (req) => {
       allow if user($u);
     `;
 
-    const authz = (auth as any).buildAuthenticated(token);
+    const authz = auth.buildAuthenticated(token);
     try {
       authz.authorizeWithLimits({
         max_facts: 1000, // default: 1000
@@ -131,7 +131,7 @@ Deno.serve({ port }, async (req) => {
       allow if user($u);
     `;
 
-    const authz = (auth as any).buildAuthenticated(token);
+    const authz = auth.buildAuthenticated(token);
     try {
       authz.authorizeWithLimits({});
     } catch (error: unknown) {
@@ -272,8 +272,8 @@ async function doCapture(request: CaptureRequest): Promise<Uint8Array> {
     console.error({ url: request.input }, error);
 
     try {
-      const image = await page.screenshot({ type: 'jpeg', quality: 10 });
-      console.info(image.toString('base64'));
+      const image = await page.screenshot({ type: "jpeg", quality: 10 });
+      console.info(image.toString("base64"));
     } catch {
       // ignore
     }