diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index a3ab754..9e54351 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -22,4 +22,3 @@
 
   "onCreateCommand": "bash .devcontainer/post-install.sh"
 }
-
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
new file mode 100644
index 0000000..362cc43
--- /dev/null
+++ b/.github/workflows/pre-commit.yml
@@ -0,0 +1,33 @@
+name: pre-commit
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # The Go hooks (go-fmt, go-vet) are skipped here: Go formatting and vetting
+    # are already enforced by the golangci-lint workflow (lint.yml), and the
+    # dnephin/pre-commit-golang go-vet hook is incompatible with this repo's
+    # module layout (fails with "no Go files in <root>"). This job scopes
+    # pre-commit to the Python (ruff) and generic hooks that run reliably.
+    env:
+      SKIP: go-fmt,go-vet
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
+      - run: uvx pre-commit run --all-files --show-diff-on-failure
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index f4cccc9..a944254 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,3 +1,10 @@
+ci:
+  # Go formatting/vetting is enforced by the golangci-lint workflow (lint.yml).
+  # The dnephin/pre-commit-golang go-vet hook is also incompatible with this
+  # repo's single-root-go.mod layout (fails with "no Go files in <root>"), so
+  # skip both Go hooks on pre-commit.ci to keep it green.
+  skip: [go-fmt, go-vet]
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
@@ -5,6 +12,7 @@ repos:
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-yaml
+        args: [--allow-multiple-documents]
       - id: check-merge-conflict
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
diff --git a/hack/boilerplate.go.txt b/hack/boilerplate.go.txt
index 221dcbe..4671de8 100644
--- a/hack/boilerplate.go.txt
+++ b/hack/boilerplate.go.txt
@@ -12,4 +12,4 @@ distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-*/
\ No newline at end of file
+*/
diff --git a/plugin/examples/with-cw.py b/plugin/examples/with-cw.py
index 96c341f..b5c639e 100644
--- a/plugin/examples/with-cw.py
+++ b/plugin/examples/with-cw.py
@@ -14,7 +14,6 @@
 @app.cell
 def check_mount():
     import os
-    import subprocess
 
     # Check default mount location
     mount_dir = "/home/marimo/notebooks/mounts"
diff --git a/plugin/kubectl_marimo/deploy.py b/plugin/kubectl_marimo/deploy.py
index 1047f9a..6fbf8dd 100644
--- a/plugin/kubectl_marimo/deploy.py
+++ b/plugin/kubectl_marimo/deploy.py
@@ -122,11 +122,11 @@ def ensure_cw_credentials(namespace: str | None) -> bool:
         return False
 
     # Step 4: Show what we're about to do
-    click.echo(f"\nS3 Credentials:")
+    click.echo("\nS3 Credentials:")
     click.echo(f"  Namespace:    {ns_display}")
     click.echo(f"  Secret:       {secret_name} (will create)")
     click.echo(f"  Source:       ~/.s3cfg [{section}]")
-    click.echo(f"  Access Key:   ***")
+    click.echo("  Access Key:   ***")
 
     # Step 5: Confirm with user if in interactive terminal
     if sys.stdin.isatty():
diff --git a/plugin/tests/test_deploy.py b/plugin/tests/test_deploy.py
index 202386a..8678ff5 100644
--- a/plugin/tests/test_deploy.py
+++ b/plugin/tests/test_deploy.py
@@ -482,7 +482,7 @@ def test_uses_namespace_for_section_lookup(self, mocker, tmp_path):
         mocker.patch("os.path.expanduser", return_value=str(s3cfg))
         mocker.patch("os.path.exists", return_value=True)
         mocker.patch("sys.stdin.isatty", return_value=False)
-        mock_echo = mocker.patch("kubectl_marimo.deploy.click.echo")
+        mocker.patch("kubectl_marimo.deploy.click.echo")
 
         mock_result = mocker.Mock()
         mock_result.returncode = 0
diff --git a/plugin/tests/test_status.py b/plugin/tests/test_status.py
index 98acf38..e4c7cae 100644
--- a/plugin/tests/test_status.py
+++ b/plugin/tests/test_status.py
@@ -1,9 +1,7 @@
 """Tests for status command."""
 
 import json
-from pathlib import Path
 
-from click.testing import CliRunner
 
 from kubectl_marimo.status import show_status, format_elapsed