diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..1cf05e9
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,6 @@
+self-hosted-runner:
+  # Labels of our self-hosted CE runners (see the ce-ci repository)
+  labels:
+    - ce
+    - small
+    - medium
diff --git a/.github/workflows/install-compilers.yml b/.github/workflows/install-compilers.yml
index 09775e4..836c59f 100644
--- a/.github/workflows/install-compilers.yml
+++ b/.github/workflows/install-compilers.yml
@@ -66,4 +66,5 @@ jobs:
           if [[ "$FORCE" == "true" ]]; then
             FORCE_FLAG="--force"
           fi
+          # shellcheck disable=SC2086 # word-splitting the flag and filter word lists is the point
           sudo bin/ce_install --check-user nobody $ENABLE_FLAG install $FORCE_FLAG $COMPILERS
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index a664624..79666ca 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -10,6 +10,10 @@ repos:
       rev: 2.1.5
       hooks:
         - id: shellcheck
+    - repo: https://github.com/rhysd/actionlint
+      rev: v1.7.12
+      hooks:
+        - id: actionlint
     - repo: local
       hooks:
         - id: builds-up-to-date