diff --git a/.editorconfig b/.editorconfig
index d53519aa..223e7a27 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -25,5 +25,5 @@ indent_size = 4
 max_line_length = 80
 
 [*.yaml]
-indent_size = 4
+indent_size = 2
 
diff --git a/.github/workflows/gerrit-verify.yaml b/.github/workflows/gerrit-verify.yaml
index aab6e84f..b043f268 100644
--- a/.github/workflows/gerrit-verify.yaml
+++ b/.github/workflows/gerrit-verify.yaml
@@ -43,7 +43,8 @@ on:
         type: string
 
 concurrency:
-  group: ${{ github.event.inputs.GERRIT_CHANGE_ID || github.run_id }}
+  # yamllint disable-line rule:line-length
+  group: ${{ github.workflow }}-${{ github.event.inputs.GERRIT_BRANCH}}-${{ github.event.inputs.GERRIT_CHANGE_ID || github.run_id }}
   cancel-in-progress: true
 
 jobs:
@@ -51,7 +52,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clear votes
-        uses: lfit/gerrit-review-action@v0.3
+        # yamllint disable-line rule:line-length
+        uses: lfit/gerrit-review-action@9627b9a144f2a2cad70707ddfae87c87dce60729  # v0.8
         with:
           host: ${{ vars.LFIT_GERRIT_SERVER }}
           username: ${{ vars.LFIT_GERRIT_SSH_USER }}
@@ -62,6 +64,21 @@ jobs:
           vote-type: clear
 
 
+  lint:
+    needs: clear-vote
+    # yamllint disable-line rule:line-length
+    uses: lfit/releng-reusable-workflows/.github/workflows/compose-repo-linting.yaml@main
+    with:
+      GERRIT_BRANCH: ${{ inputs.GERRIT_BRANCH }}
+      GERRIT_CHANGE_ID: ${{ inputs.GERRIT_CHANGE_ID }}
+      GERRIT_CHANGE_NUMBER: ${{ inputs.GERRIT_CHANGE_NUMBER }}
+      GERRIT_CHANGE_URL: ${{ inputs.GERRIT_CHANGE_URL }}
+      GERRIT_EVENT_TYPE: ${{ inputs.GERRIT_EVENT_TYPE }}
+      GERRIT_PATCHSET_NUMBER: ${{ inputs.GERRIT_PATCHSET_NUMBER }}
+      GERRIT_PATCHSET_REVISION: ${{ inputs.GERRIT_PATCHSET_REVISION }}
+      GERRIT_PROJECT: ${{ inputs.GERRIT_PROJECT }}
+      GERRIT_REFSPEC: ${{ inputs.GERRIT_REFSPEC }}
+
   prepare:
     needs: clear-vote
     runs-on: ubuntu-latest
@@ -81,7 +98,7 @@ jobs:
           pipx run tox -e clean,build
       - name: Record the path of wheel distribution
         id: wheel-distribution
-        run: echo "path=$(ls dist/*.whl)" >> $GITHUB_OUTPUT
+        run: echo "path=$(ls dist/*.whl)" >> "$GITHUB_OUTPUT"
       - name: Store the distribution files for use in other stages
         # `tests` and `publish` will use the same pre-built distributions,
         # so we make sure to release the exact same package that was tested
@@ -91,21 +108,6 @@ jobs:
           path: dist/
           retention-days: 1
 
-  pre-commit:
-    needs: clear-vote
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout change
-        uses: lfit/checkout-gerrit-change-action@v0.3
-        with:
-          gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
-      - name: Configure Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.8'
-      - name: Run static analysis and format checkers
-        run: pipx run pre-commit run --all-files --show-diff-on-failure
-
   test:
     needs: prepare
     runs-on: ubuntu-latest
@@ -116,9 +118,12 @@ jobs:
           - "3.9"
     steps:
       - name: Checkout change
-        uses: lfit/checkout-gerrit-change-action@v0.3
+        # yamllint disable-line rule:line-length
+        uses: lfit/checkout-gerrit-change-action@54d751e8bd167bc91f7d665dabe33fae87aaaa63  # v0.9
         with:
           gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
+          gerrit-project: ${{ inputs.GERRIT_PROJECT }}
+          gerrit-url: ${{ vars.GERRIT_URL }}
           delay: "0s"
       - name: Configure Python
         uses: actions/setup-python@v5
@@ -144,11 +149,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout change
-        uses: lfit/checkout-gerrit-change-action@v0.3
+        # yamllint disable-line rule:line-length
+        uses: lfit/checkout-gerrit-change-action@54d751e8bd167bc91f7d665dabe33fae87aaaa63  # v0.9
         with:
           gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
+          gerrit-project: ${{ inputs.GERRIT_PROJECT }}
+          gerrit-url: ${{ vars.GERRIT_URL }}
           delay: "0s"
-          fetch-depth: "0"
       - name: Configure Python
         uses: actions/setup-python@v5
         id: setup-python
@@ -164,11 +171,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout change
-        uses: lfit/checkout-gerrit-change-action@v0.3
+        # yamllint disable-line rule:line-length
+        uses: lfit/checkout-gerrit-change-action@54d751e8bd167bc91f7d665dabe33fae87aaaa63  # v0.9
         with:
           gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
+          gerrit-project: ${{ inputs.GERRIT_PROJECT }}
+          gerrit-url: ${{ vars.GERRIT_URL }}
           delay: "0s"
-          fetch-depth: "0"
       - name: Configure Python
         uses: actions/setup-python@v5
         id: setup-python
@@ -183,11 +192,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout change
-        uses: lfit/checkout-gerrit-change-action@v0.3
+        # yamllint disable-line rule:line-length
+        uses: lfit/checkout-gerrit-change-action@54d751e8bd167bc91f7d665dabe33fae87aaaa63  # v0.9
         with:
           gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
+          gerrit-project: ${{ inputs.GERRIT_PROJECT }}
+          gerrit-url: ${{ vars.GERRIT_URL }}
           delay: "0s"
-          fetch-depth: "0"
       - name: Configure Python
         uses: actions/setup-python@v5
         id: setup-python
@@ -199,7 +210,7 @@ jobs:
 
   vote:
     if: ${{ always() }}
-    needs: [prepare, pre-commit, test, docs, docs-linkcheck, license]
+    needs: [prepare, test, docs, docs-linkcheck, license, lint]
     runs-on: ubuntu-latest
     steps:
       - name: Get workflow conclusion
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 463cfb90..b4827364 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,8 +20,8 @@ jobs:
           pipx run tox -e clean,build
       - name: Configure TWINE
         run: |
-          echo "TWINE_USERNAME=__token__" >> $GITHUB_ENV
-          echo "TWINE_PASSWORD=${{ secrets.PYPI_API_TOKEN }}" >> $GITHUB_ENV
+          echo "TWINE_USERNAME=__token__" >> "$GITHUB_ENV"
+          echo "TWINE_PASSWORD=${{ secrets.PYPI_API_TOKEN }}" >> "$GITHUB_ENV"
       - name: Publish to PyPI
         run: >-
           pipx run tox -e publish -- --repository pypi
@@ -29,9 +29,9 @@ jobs:
         id: tag
         uses: devops-actions/action-get-tag@v1.0.2
       - name: Convert tag
-        run: >-
+        run: |
           VER=$(echo "${{ steps.tag.outputs.tag }}" | tr . -)
-          echo "ANCHOR=${VER}" >> $GITHUB_ENV
+          echo "ANCHOR=${VER}" >> "$GITHUB_ENV"
       - name: Generate reno report
         run: |
           # fetch last 30 changes
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 65220495..9986c0b5 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -21,7 +21,7 @@ repos:
   - repo: https://github.com/ambv/black
     rev: 24.4.2
     hooks:
-    - id: black
+      - id: black
 
   - repo: https://github.com/PyCQA/isort
     rev: 5.13.2
@@ -43,3 +43,8 @@ repos:
           - types-requests
           - types-six
           - types-PyYAML
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: ea8102762106cdca9c88829f1295b39a544706f3  # frozen: v1.6.26
+    hooks:
+      - id: actionlint