diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..31bb67e
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  pull_request: null
+  push:
+    branches:
+      - master
+
+jobs:
+  multiple_checks:
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout repo
+        uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - run: go version
+
+      - name: Lint
+        run: make lint
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Tidy
+        run: go mod tidy
+
+      - name: Fail if changes
+        run: git diff-index --exit-code HEAD
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 0000000..632ce4e
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,27 @@
+run:
+  tests: false
+  timeout: 10m
+
+linters-settings:
+  revive:
+    rules:
+      - name: unused-parameter
+        severity: warning
+        disabled: true
+
+  gomoddirectives:
+    replace-allow-list:
+      - github.com/linode/linodego
+
+  govet:
+    disable:
+      - shadow
+  dupl:
+    threshold: 100
+
+linters:
+  fast: false
+  enable:
+    - gofumpt
+    - goimports
+    - gosec
diff --git a/Makefile b/Makefile
index dfe421b..0b5ab64 100644
--- a/Makefile
+++ b/Makefile
@@ -4,9 +4,28 @@ LINODE_DEBUG ?= 0
 # The path to the pubkey to configure the E2E testing instance with.
 TEST_PUBKEY ?= ~/.ssh/id_rsa.pub
 
+SKIP_DOCKER       ?= 0
+
+GOLANGCILINT      := golangci-lint
+GOLANGCILINT_IMG  := golangci/golangci-lint:latest
+GOLANGCILINT_ARGS := run
+
 # Whether to cleanup the Linode instance used in the testing
 CLEANUP_TEST_LINODE_INSTANCE ?= false
 
+lint:
+ifeq ($(SKIP_DOCKER), 1)
+	$(GOLANGCILINT) $(GOLANGCILINT_ARGS)
+else
+	docker run --rm -v $(shell pwd):/app -w /app $(GOLANGCILINT_IMG) $(GOLANGCILINT) $(GOLANGCILINT_ARGS)
+endif
+
+fmt:
+	gofumpt -w -l .
+
+fix-lint: fmt
+	$(GOLANGCILINT) $(GOLANGCILINT_ARGS) --fix
+
 # Installs dependencies required to run the remote E2E suite.
 test-deps:
 	pip3 install --upgrade ansible -r https://raw.githubusercontent.com/linode/ansible_linode/main/requirements.txt
diff --git a/client.go b/client.go
index 0ecca9f..3df414a 100644
--- a/client.go
+++ b/client.go
@@ -13,9 +13,11 @@ import (
 	"github.com/go-resty/resty/v2"
 )
 
-const APIHost = "169.254.169.254"
-const APIProto = "http"
-const APIVersion = "v1"
+const (
+	APIHost    = "169.254.169.254"
+	APIProto   = "http"
+	APIVersion = "v1"
+)
 
 // Client represents an instance of a Linode Metadata Service client.
 type Client struct {
@@ -79,7 +81,6 @@ func NewClient(ctx context.Context, opts ...ClientOption) (*Client, error) {
 	}
 
 	result.updateHostURL()
-
 	result.setUserAgent(userAgent)
 
 	if clientOpts.ManagedToken && clientOpts.StartingToken == "" {
@@ -137,7 +138,7 @@ func (c *Client) updateHostURL() {
 }
 
 // middlewareTokenRefresh handles automatically refreshing managed tokens.
-func (c *Client) middlewareTokenRefresh(rc *resty.Client, r *resty.Request) error {
+func (c *Client) middlewareTokenRefresh(_ *resty.Client, r *resty.Request) error {
 	// Don't run this middleware when generating tokens
 	if r.URL == "token" {
 		return nil
diff --git a/errors.go b/errors.go
index 5c1a36d..6fb1a9a 100644
--- a/errors.go
+++ b/errors.go
@@ -2,9 +2,10 @@ package metadata
 
 import (
 	"fmt"
-	"github.com/go-resty/resty/v2"
 	"net/http"
 	"strings"
+
+	"github.com/go-resty/resty/v2"
 )
 
 // APIError is the error-set returned by the Linode API when presented with an invalid request