diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
new file mode 100644
index 0000000..a49f9d4
--- /dev/null
+++ b/.github/workflows/golangci-lint.yml
@@ -0,0 +1,49 @@
+# ------------------------------------------------------------------------
+# SPDX-FileCopyrightText: Copyright © 2024 The Protobom Authors
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: Apache-2.0
+# ------------------------------------------------------------------------
+# This workflow uses actions that are not certified by
+# GitHub. They are provided by a third-party and are
+# governed by separate terms of service, privacy policy,
+# and support documentation.
+# ------------------------------------------------------------------------
+---
+name: golangci-lint
+
+on:
+  pull_request:
+    branches: main
+    types:
+      - opened
+      - reopened
+      - synchronize
+
+permissions:
+  contents: read
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pull-requests: read
+      checks: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+
+      - name: Set up Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version-file: go.mod
+          cache: false
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@82d40c283aeb1f2b6595839195e95c2d6a49081b # v5.0.0
+        with:
+          install-mode: goinstall
+          version: cd890db217def69d68cf1862504bb735c0333879 # v1.57.1
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 0000000..8e5794c
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,170 @@
+# ------------------------------------------------------------------------
+# SPDX-FileCopyrightText: Copyright © 2024 The Protobom Authors
+# SPDX-FileType: SOURCE
+# SPDX-License-Identifier: Apache-2.0
+# ------------------------------------------------------------------------
+---
+# yaml-language-server: $schema=https://golangci-lint.run/jsonschema/golangci.jsonschema.json
+
+run:
+  concurrency: 6
+  go: "1.22.0"
+  timeout: 5m
+
+issues:
+  exclude-rules:
+    - path: _test\.go
+      linters:
+        - funlen
+        - goconst
+        - gocyclo
+
+  # Maximum issues count per one linter.
+  # Set to 0 to disable.
+  # Default: 50
+  max-issues-per-linter: 0
+
+  # Maximum count of issues with the same text.
+  # Set to 0 to disable.
+  # Default: 3
+  max-same-issues: 0
+
+  new-from-rev: ""
+
+linters:
+  disable-all: true
+  enable:
+    - asciicheck
+    - bodyclose
+    - cyclop
+    - dogsled
+    - dupl
+    - durationcheck
+    - errcheck
+    - errorlint
+    - exhaustive
+    - exportloopref
+    - forbidigo
+    - forcetypeassert
+    - funlen
+    - gci
+    - gochecknoglobals
+    - gochecknoinits
+    - gocognit
+    - goconst
+    - gocritic
+    - gocyclo
+    - godot
+    - godox
+    - goerr113
+    - gofmt
+    - gofumpt
+    - goheader
+    - goimports
+    - gomnd
+    - gomoddirectives
+    - gomodguard
+    - goprintffuncname
+    - gosec
+    - gosimple
+    - govet
+    - importas
+    - ineffassign
+    - lll
+    - makezero
+    - misspell
+    - nakedret
+    - nestif
+    - nilerr
+    - nlreturn
+    - noctx
+    - nolintlint
+    - paralleltest
+    - prealloc
+    - predeclared
+    - promlinter
+    - revive
+    - staticcheck
+    - stylecheck
+    - tagliatelle
+    - testpackage
+    - thelper
+    - tparallel
+    - typecheck
+    - unconvert
+    - unparam
+    - unused
+    - wastedassign
+    - whitespace
+    - wrapcheck
+    - wsl
+
+linters-settings:
+  errcheck:
+    check-type-assertions: true
+    check-blank: true
+
+  exhaustive:
+    # https://golangci-lint.run/usage/linters/#exhaustive
+    default-signifies-exhaustive: true
+
+  govet:
+    enable:
+      - fieldalignment
+
+  godox:
+    keywords:
+      - BUG
+      - FIXME
+      - HACK
+
+  gci:
+    sections:
+      - standard
+      - default
+      - prefix(github.com/protobom/storage)
+
+  gocritic:
+    enabled-checks:
+      # Diagnostic
+      - commentedOutCode
+      - nilValReturn
+      - sloppyReassign
+      - weakCond
+      - octalLiteral
+
+      # Performance
+      - appendCombine
+      - equalFold
+      - hugeParam
+      - indexAlloc
+      - rangeExprCopy
+      - rangeValCopy
+
+      # Style
+      - boolExprSimplify
+      - commentedOutImport
+      - docStub
+      - emptyFallthrough
+      - emptyStringTest
+      - hexLiteral
+      - methodExprCall
+      - stringXbytes
+      - typeAssertChain
+      - unlabelStmt
+      - yodaStyleExpr
+
+      # Opinionated
+      - builtinShadow
+      - importShadow
+      - initClause
+      - nestingReduce
+      - paramTypeCombine
+      - ptrToRefParam
+      - typeUnparen
+      - unnamedResult
+      - unnecessaryBlock
+
+  nolintlint:
+    allow-unused: false
+    require-specific: true
diff --git a/internal/backends/ent/schema/external_reference.go b/internal/backends/ent/schema/external_reference.go
index 8fe0134..0f721d7 100644
--- a/internal/backends/ent/schema/external_reference.go
+++ b/internal/backends/ent/schema/external_reference.go
@@ -16,7 +16,7 @@ type ExternalReference struct {
 	ent.Schema
 }
 
-func (ExternalReference) Fields() []ent.Field {
+func (ExternalReference) Fields() []ent.Field { //nolint: funlen
 	return []ent.Field{
 		field.String("url"),
 		field.String("comment"),
diff --git a/model/v1/storage/backend.go b/model/v1/storage/backend.go
index 69c85a8..e3dc3b3 100644
--- a/model/v1/storage/backend.go
+++ b/model/v1/storage/backend.go
@@ -8,6 +8,7 @@ package storage
 
 import (
 	"github.com/bom-squad/protobom/pkg/sbom"
+
 	"github.com/protobom/storage/pkg/options"
 )
 
diff --git a/pkg/options/options.go b/pkg/options/options.go
index 1572176..8b8dfb4 100644
--- a/pkg/options/options.go
+++ b/pkg/options/options.go
@@ -7,16 +7,16 @@
 package options
 
 type StoreOptions struct {
-	// NoClobber ensures documents with the same ID are never overwritten
-	NoClobber bool
-
 	// BackendOptions is a field to pipe system-specific options to the
 	// modules implementing the storage backend interface
-	BackendOptions interface{}
+	BackendOptions any
+
+	// NoClobber ensures documents with the same ID are never overwritten
+	NoClobber bool
 }
 
 type RetrieveOptions struct {
 	// BackendOptions is a field to pipe system-specific options to the
 	// modules implementing the storage backend interface
-	BackendOptions interface{}
+	BackendOptions any
 }