diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 312fc6ba4..4af948c5e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -25,10 +25,13 @@ updates:
       interval: "weekly"
     commit-message:
       prefix: ":seedling:"
-    labels:
-      - "ok-to-test"
     # Ignore K8 packages as these are done manually
     ignore:
       - dependency-name: "k8s.io/api"
       - dependency-name: "k8s.io/apiextensions-apiserver"
       - dependency-name: "k8s.io/apimachinery"
+      - dependency-name: "k8s.io/client-go"
+      - dependency-name: "k8s.io/component-base"
+    labels:
+      - "ok-to-test"
+
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
new file mode 100644
index 000000000..7baade1aa
--- /dev/null
+++ b/.github/workflows/golangci-lint.yml
@@ -0,0 +1,37 @@
+name: golangci-lint
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+    branches:
+      - main
+
+permissions:
+  # Required: allow read access to the content for analysis.
+  contents: read
+  # Optional: allow read access to pull request. Use with `only-new-issues` option.
+  pull-requests: read
+  # Optional: Allow write access to checks to allow the action to annotate code in the PR.
+  checks: write
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        working-directory:
+          - ""
+          - tools/setup-envtest
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # tag=v5.0.0
+        with:
+          go-version: "1.22"
+          cache: false
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v4.1.2
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # tag=v4.0.0
+        with:
+          version: v1.57.2
+          args: --out-format=colored-line-number
+          working-directory: ${{matrix.working-directory}}
diff --git a/.github/workflows/pr-dependabot.yaml b/.github/workflows/pr-dependabot.yaml
new file mode 100644
index 000000000..c5e7d6d80
--- /dev/null
+++ b/.github/workflows/pr-dependabot.yaml
@@ -0,0 +1,35 @@
+name: PR dependabot go modules fix
+
+# This action runs on PRs opened by dependabot and updates modules.
+on:
+  pull_request:
+    branches:
+      - dependabot/**
+  push:
+    branches:
+      - dependabot/**
+  workflow_dispatch:
+
+permissions:
+  contents: write # Allow to update the PR.
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check out code
+      uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v4.1.2
+    - name: Set up Go
+      uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # tag=v5.0.0
+      with:
+        go-version: '1.22'
+    - name: Update all modules
+      run: make modules
+    - uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # tag=v9.1.4
+      name: Commit changes
+      with:
+        author_name: dependabot[bot]
+        author_email: 49699333+dependabot[bot]@users.noreply.github.com
+        default_author: github_actor
+        message: 'Update generated code'
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 74c59a6c6..e24f96210 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -1,8 +1,9 @@
-name: PR Verifier
-
 on:
   pull_request_target:
-    types: [opened, edited, reopened]
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  checks: write # Allow access to checks to write check runs.
 
 jobs:
   verify:
@@ -11,6 +12,6 @@ jobs:
     steps:
     - name: Verifier action
       id: verifier
-      uses: kubernetes-sigs/kubebuilder-release-tools@v0.4.3
+      uses: kubernetes-sigs/kubebuilder-release-tools@012269a88fa4c034a0acf1ba84c26b195c0dbab4 # tag=v0.4.3
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
index 9e0c605fc..7a427bdbe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,9 @@
 *.swp
 *.swo
 *~
+
+# Tools binaries.
+hack/tools/bin
+
+junit-report.xml
+/artifacts
diff --git a/Makefile b/Makefile
index 107e7d201..6bc225d3f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,94 @@
-test-all:
+#!/usr/bin/env bash
+
+#  Copyright 2024 The Kubernetes Authors.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+# If you update this file, please follow
+# https://suva.sh/posts/well-documented-makefiles
+
+## --------------------------------------
+## General
+## --------------------------------------
+
+SHELL:=/usr/bin/env bash
+.DEFAULT_GOAL:=help
+
+# Use GOPROXY environment variable if set
+GOPROXY := $(shell go env GOPROXY)
+ifeq ($(GOPROXY),)
+GOPROXY := https://proxy.golang.org
+endif
+export GOPROXY
+
+# Active module mode, as we use go modules to manage dependencies
+export GO111MODULE=on
+
+# Tools.
+TOOLS_DIR := hack/tools
+TOOLS_BIN_DIR := $(abspath $(TOOLS_DIR)/bin)
+GOLANGCI_LINT := $(abspath $(TOOLS_BIN_DIR)/golangci-lint)
+GO_INSTALL := ./hack/go-install.sh
+
+## --------------------------------------
+## Binaries
+## --------------------------------------
+
+GOLANGCI_LINT_BIN := golangci-lint
+GOLANGCI_LINT_VER := $(shell cat .github/workflows/golangci-lint.yml | grep [[:space:]]version: | sed 's/.*version: //')
+GOLANGCI_LINT := $(abspath $(TOOLS_BIN_DIR)/$(GOLANGCI_LINT_BIN)-$(GOLANGCI_LINT_VER))
+GOLANGCI_LINT_PKG := github.com/golangci/golangci-lint/cmd/golangci-lint
+
+$(GOLANGCI_LINT): # Build golangci-lint from tools folder.
+	GOBIN=$(TOOLS_BIN_DIR) $(GO_INSTALL) $(GOLANGCI_LINT_PKG) $(GOLANGCI_LINT_BIN) $(GOLANGCI_LINT_VER)
+
+## --------------------------------------
+## Linting
+## --------------------------------------
+
+.PHONY: lint
+lint: $(GOLANGCI_LINT) ## Lint codebase
+	$(GOLANGCI_LINT) run -v $(GOLANGCI_LINT_EXTRA_ARGS)
+	cd tools/setup-envtest; $(GOLANGCI_LINT) run -v $(GOLANGCI_LINT_EXTRA_ARGS)
+
+.PHONY: lint-fix
+lint-fix: $(GOLANGCI_LINT) ## Lint the codebase and run auto-fixers if supported by the linter.
+	GOLANGCI_LINT_EXTRA_ARGS=--fix $(MAKE) lint
+
+## --------------------------------------
+## Testing
+## --------------------------------------
+
+.PHONY: test
+test: ## Run the test.sh script which will check all.
 	TRACE=1 ./test.sh
 
-generate-modules:
+test-all:
+	$(MAKE) test
+
+.PHONY: modules
+modules: ## Runs go mod to ensure modules are up to date.
 	go mod tidy
+
+## --------------------------------------
+## Cleanup / Verification
+## --------------------------------------
+
+.PHONY: clean
+clean: ## Cleanup.
+	$(GOLANGCI_LINT) cache clean
+	$(MAKE) clean-bin
+
+.PHONY: clean-bin
+clean-bin: ## Remove all generated binaries.
+	rm -rf hack/tools/bin
diff --git a/hack/go-install.sh b/hack/go-install.sh
new file mode 100755
index 000000000..a07b8e0f1
--- /dev/null
+++ b/hack/go-install.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Copyright 2021 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+if [ -z "${1}" ]; then
+  echo "must provide module as first parameter"
+  exit 1
+fi
+
+if [ -z "${2}" ]; then
+  echo "must provide binary name as second parameter"
+  exit 1
+fi
+
+if [ -z "${3}" ]; then
+  echo "must provide version as third parameter"
+  exit 1
+fi
+
+if [ -z "${GOBIN}" ]; then
+  echo "GOBIN is not set. Must set GOBIN to install the bin in a specified directory."
+  exit 1
+fi
+
+rm -f "${GOBIN}/${2}"* || true
+
+# install the golang module specified as the first argument
+go install "${1}@${3}"
+mv "${GOBIN}/${2}" "${GOBIN}/${2}-${3}"
+ln -sf "${GOBIN}/${2}-${3}" "${GOBIN}/${2}"
diff --git a/hack/tools/.keep b/hack/tools/.keep
new file mode 100644
index 000000000..e69de29bb
diff --git a/pkg/crd/gen.go b/pkg/crd/gen.go
index 546ba9a6d..9eb4126bc 100644
--- a/pkg/crd/gen.go
+++ b/pkg/crd/gen.go
@@ -105,10 +105,10 @@ func (g Generator) Generate(ctx *genall.GenerationContext) error {
 		Collector: ctx.Collector,
 		Checker:   ctx.Checker,
 		// Perform defaulting here to avoid ambiguity later
-		IgnoreUnexportedFields: g.IgnoreUnexportedFields != nil && *g.IgnoreUnexportedFields == true,
-		AllowDangerousTypes:    g.AllowDangerousTypes != nil && *g.AllowDangerousTypes == true,
+		IgnoreUnexportedFields: g.IgnoreUnexportedFields != nil && *g.IgnoreUnexportedFields,
+		AllowDangerousTypes:    g.AllowDangerousTypes != nil && *g.AllowDangerousTypes,
 		// Indicates the parser on whether to register the ObjectMeta type or not
-		GenerateEmbeddedObjectMeta: g.GenerateEmbeddedObjectMeta != nil && *g.GenerateEmbeddedObjectMeta == true,
+		GenerateEmbeddedObjectMeta: g.GenerateEmbeddedObjectMeta != nil && *g.GenerateEmbeddedObjectMeta,
 	}
 
 	AddKnownTypes(parser)
@@ -194,7 +194,6 @@ func removeDescriptionFromMetadataProps(v *apiext.JSONSchemaProps) {
 		if meta.Description != "" {
 			meta.Description = ""
 			v.Properties["metadata"] = m
-
 		}
 	}
 }
diff --git a/pkg/deepcopy/gen.go b/pkg/deepcopy/gen.go
index c1d3b708c..a85cc8577 100644
--- a/pkg/deepcopy/gen.go
+++ b/pkg/deepcopy/gen.go
@@ -191,7 +191,6 @@ import (
 	if err != nil {
 		pkg.AddError(err)
 	}
-
 }
 
 // generateForPackage generates DeepCopy and runtime.Object implementations for
diff --git a/pkg/genall/options.go b/pkg/genall/options.go
index 658b96bb3..97d7d67a6 100644
--- a/pkg/genall/options.go
+++ b/pkg/genall/options.go
@@ -74,7 +74,6 @@ func RegistryFromOptions(optionsRegistry *markers.Registry, options []string) (*
 // further modified.  Not default generators are used if none are specified -- you can check
 // the output and rerun for that.
 func FromOptions(optionsRegistry *markers.Registry, options []string) (*Runtime, error) {
-
 	protoRt, err := protoFromOptions(optionsRegistry, options)
 	if err != nil {
 		return nil, err
diff --git a/pkg/loader/loader.go b/pkg/loader/loader.go
index f272aaae2..2c5cf4c97 100644
--- a/pkg/loader/loader.go
+++ b/pkg/loader/loader.go
@@ -489,7 +489,6 @@ func LoadRootsWithConfig(cfg *packages.Config, roots ...string) ([]*Package, err
 		p string,
 		d os.DirEntry,
 		e error) error {
-
 		if e != nil {
 			return e
 		}
@@ -518,7 +517,6 @@ func LoadRootsWithConfig(cfg *packages.Config, roots ...string) ([]*Package, err
 
 		// get the absolute path of the root
 		if !filepath.IsAbs(r) {
-
 			// if the initial value of cfg.Dir was non-empty then use it when
 			// building the absolute path to this root. otherwise use the
 			// filepath.Abs function to get the absolute path of the root based
@@ -548,7 +546,6 @@ func LoadRootsWithConfig(cfg *packages.Config, roots ...string) ([]*Package, err
 			if err := filepath.WalkDir(
 				d,
 				addNestedGoModulesToRoots); err != nil {
-
 				return nil, err
 			}
 		}
diff --git a/pkg/markers/collect.go b/pkg/markers/collect.go
index 63aa7344b..23f52e3d2 100644
--- a/pkg/markers/collect.go
+++ b/pkg/markers/collect.go
@@ -388,7 +388,6 @@ func (v markerSubVisitor) Visit(node ast.Node) ast.Visitor {
 	v.commentInd = lastCommentInd + 1
 
 	return resVisitor
-
 }
 
 // associatedCommentsFor returns the doc comment group (if relevant and present) and end-of-line comment
diff --git a/pkg/rbac/parser.go b/pkg/rbac/parser.go
index c8bbe9d54..50bdf322c 100644
--- a/pkg/rbac/parser.go
+++ b/pkg/rbac/parser.go
@@ -210,7 +210,6 @@ func GenerateRoles(ctx *genall.GenerationContext, roleName string) ([]interface{
 		var policyRules []rbacv1.PolicyRule
 		for _, key := range keys {
 			policyRules = append(policyRules, ruleMap[key].ToRule())
-
 		}
 		return policyRules
 	}
diff --git a/pkg/schemapatcher/gen.go b/pkg/schemapatcher/gen.go
index 8080aeae7..9e5a85131 100644
--- a/pkg/schemapatcher/gen.go
+++ b/pkg/schemapatcher/gen.go
@@ -92,7 +92,7 @@ func (g Generator) Generate(ctx *genall.GenerationContext) (result error) {
 		Collector: ctx.Collector,
 		Checker:   ctx.Checker,
 		// Indicates the parser on whether to register the ObjectMeta type or not
-		GenerateEmbeddedObjectMeta: g.GenerateEmbeddedObjectMeta != nil && *g.GenerateEmbeddedObjectMeta == true,
+		GenerateEmbeddedObjectMeta: g.GenerateEmbeddedObjectMeta != nil && *g.GenerateEmbeddedObjectMeta,
 	}
 
 	crdgen.AddKnownTypes(parser)
diff --git a/pkg/typescaffold/resource.go b/pkg/typescaffold/resource.go
index e4c2388ac..7024a7c8a 100644
--- a/pkg/typescaffold/resource.go
+++ b/pkg/typescaffold/resource.go
@@ -46,7 +46,7 @@ func (r *Resource) Validate() error {
 	}
 
 	if r.Kind != flect.Pascalize(r.Kind) {
-		return fmt.Errorf("Kind must be camelcase (expected %s was %s)", flect.Pascalize(r.Kind), r.Kind)
+		return fmt.Errorf("kind must be CamelCase (expected %s was %s)", flect.Pascalize(r.Kind), r.Kind)
 	}
 
 	return nil
diff --git a/pkg/version/version.go b/pkg/version/version.go
index 09c8efcf4..f2709df4a 100644
--- a/pkg/version/version.go
+++ b/pkg/version/version.go
@@ -13,6 +13,8 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 */
+
+// Package version provides the version of the main module.
 package version
 
 import (
diff --git a/pkg/webhook/parser.go b/pkg/webhook/parser.go
index 26d072920..5652b4c45 100644
--- a/pkg/webhook/parser.go
+++ b/pkg/webhook/parser.go
@@ -289,7 +289,6 @@ func (c Config) clientConfig() (admissionregv1.WebhookClientConfig, error) {
 	return admissionregv1.WebhookClientConfig{
 		URL: &url,
 	}, nil
-
 }
 
 // sideEffects returns the sideEffects config for a webhook.
@@ -486,7 +485,7 @@ func (g Generator) Generate(ctx *genall.GenerationContext) error {
 	for k, v := range versionedWebhooks {
 		var fileName string
 		if k == defaultWebhookVersion {
-			fileName = fmt.Sprintf("manifests.yaml")
+			fileName = "manifests.yaml"
 		} else {
 			fileName = fmt.Sprintf("manifests.%s.yaml", k)
 		}
diff --git a/test.sh b/test.sh
index a57bc6031..df668fd5d 100755
--- a/test.sh
+++ b/test.sh
@@ -99,11 +99,6 @@ function setup_envs {
 
 header_text "using tools"
 
-if ! which golangci-lint 2>&1 >/dev/null; then
-  curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.57.2
-  export PATH=$PATH:$(go env GOPATH)/bin
-fi
-
 # fetch the testing binaries - e.g. apiserver and etcd
 fetch_kb_tools
 
@@ -116,23 +111,7 @@ pushd cmd/controller-gen > /dev/null
 popd > /dev/null
 
 header_text "running golangci-lint"
-
-
-golangci-lint run --disable-all \
-    --enable=misspell \
-    --enable=revive \
-    --enable=govet \
-    --enable=unused \
-    --enable=goimports \
-    --enable=errcheck \
-    --enable=unparam \
-    --enable=ineffassign \
-    --enable=nakedret \
-    --enable=misspell \
-    --enable=gocyclo \
-    --enable=gosec \
-    --enable=gofmt \
-    ./pkg/... ./cmd/...
+make lint
 
 # --enable=structcheck \  # doesn't understand embedded structs
 # --enable=goconst \  # complains about constants that shouldn't be constants