diff --git a/.gitignore b/.gitignore
index 2769fd6a..1c128b16 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,6 +39,7 @@ test-coverage.out
 # Don't ignore this file itself, or other specific dotfiles
 !.gitignore
 !.github/
+!.tangled/
 !.golangci.yaml
 
 # Don't commit your (default location) creds
diff --git a/.tangled/workflows/golang-build-and-test.yaml b/.tangled/workflows/golang-build-and-test.yaml
new file mode 100644
index 00000000..6bb4c019
--- /dev/null
+++ b/.tangled/workflows/golang-build-and-test.yaml
@@ -0,0 +1,28 @@
+when:
+  - event: ["pull_request"]
+  - event: ["push"]
+    branch: ["main"]
+engine: "microvm"
+clone:
+  depth: 1
+
+dependencies:
+  - go
+  - gnumake
+  - gcc
+  - pkg-config
+  - cacert
+
+environment:
+  GOEXPERIMENT: "loopvar"
+steps:
+  - name: "build"
+    command: |
+      set -euo pipefail
+      go version
+      make build
+  - name: "test"
+    command: |
+      set -euo pipefail
+      make test
+
diff --git a/.tangled/workflows/golang-lint.yaml b/.tangled/workflows/golang-lint.yaml
new file mode 100644
index 00000000..118c6612
--- /dev/null
+++ b/.tangled/workflows/golang-lint.yaml
@@ -0,0 +1,24 @@
+when:
+  - event: ["pull_request"]
+  - event: ["push"]
+    branch: ["main"]
+engine: "microvm"
+clone:
+  depth: 1
+
+dependencies:
+  - go
+  - gnumake
+  - gcc
+  - pkg-config
+  - cacert
+
+environment:
+  GOEXPERIMENT: "loopvar"
+steps:
+  - name: "lint"
+    command: |
+      set -euo pipefail
+      go version
+      make lint
+
diff --git a/Makefile b/Makefile
index 3aaa933f..bc1c1e5d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
 
-SHELL = /bin/bash
+SHELL = /usr/bin/env bash
 .SHELLFLAGS = -o pipefail -c
 
 # base path for Lexicon document tree (for lexgen)