diff --git a/.gitea/workflows/lint.yaml b/.gitea/workflows/lint.yaml
index ca07230..3b8e336 100644
--- a/.gitea/workflows/lint.yaml
+++ b/.gitea/workflows/lint.yaml
@@ -28,12 +28,11 @@ jobs:
             exit 0
           fi
 
-          command -v prettier >/dev/null 2>&1 || {
-            echo "prettier is required on PATH but was not found."
-            exit 1
-          }
-
-          prettier --check --ignore-unknown "${prettier_files[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            node:22-alpine \
+            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
 
   ruff:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -44,12 +43,11 @@ jobs:
       - name: Lint Python with Ruff
         shell: bash
         run: |
-          command -v ruff >/dev/null 2>&1 || {
-            echo "ruff is required on PATH but was not found."
-            exit 1
-          }
-
-          ruff check .
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/astral-sh/ruff:latest \
+            check .
 
   yamllint:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -60,12 +58,11 @@ jobs:
       - name: Lint YAML syntax
         shell: bash
         run: |
-          command -v yamllint >/dev/null 2>&1 || {
-            echo "yamllint is required on PATH but was not found."
-            exit 1
-          }
-
-          yamllint -c .yamllint .
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
 
   hadolint:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -85,9 +82,9 @@ jobs:
             exit 0
           fi
 
-          command -v hadolint >/dev/null 2>&1 || {
-            echo "hadolint is required on PATH but was not found."
-            exit 1
-          }
-
-          hadolint -c .hadolint.yaml "${dockerfiles[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            --entrypoint hadolint \
+            hadolint/hadolint:latest-debian \
+            -c .hadolint.yaml "${dockerfiles[@]}"
diff --git a/.gitea/workflows/validate.yaml b/.gitea/workflows/validate.yaml
index 9e717e0..f29dddd 100644
--- a/.gitea/workflows/validate.yaml
+++ b/.gitea/workflows/validate.yaml
@@ -17,12 +17,11 @@ jobs:
       - name: Lint YAML syntax
         shell: bash
         run: |
-          command -v yamllint >/dev/null 2>&1 || {
-            echo "yamllint is required on PATH but was not found."
-            exit 1
-          }
-
-          yamllint -c .yamllint .
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
 
   k8s:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -43,9 +42,11 @@ jobs:
             exit 0
           fi
 
-          command -v kubeconform >/dev/null 2>&1 || {
-            echo "kubeconform is required on PATH but was not found."
-            exit 1
-          }
-
-          kubeconform -strict -ignore-missing-schemas -summary "${manifests[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/yannh/kubeconform:latest \
+            -strict \
+            -ignore-missing-schemas \
+            -summary \
+            "${manifests[@]}"
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index ca07230..3b8e336 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -28,12 +28,11 @@ jobs:
             exit 0
           fi
 
-          command -v prettier >/dev/null 2>&1 || {
-            echo "prettier is required on PATH but was not found."
-            exit 1
-          }
-
-          prettier --check --ignore-unknown "${prettier_files[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            node:22-alpine \
+            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
 
   ruff:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -44,12 +43,11 @@ jobs:
       - name: Lint Python with Ruff
         shell: bash
         run: |
-          command -v ruff >/dev/null 2>&1 || {
-            echo "ruff is required on PATH but was not found."
-            exit 1
-          }
-
-          ruff check .
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/astral-sh/ruff:latest \
+            check .
 
   yamllint:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -60,12 +58,11 @@ jobs:
       - name: Lint YAML syntax
         shell: bash
         run: |
-          command -v yamllint >/dev/null 2>&1 || {
-            echo "yamllint is required on PATH but was not found."
-            exit 1
-          }
-
-          yamllint -c .yamllint .
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
 
   hadolint:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -85,9 +82,9 @@ jobs:
             exit 0
           fi
 
-          command -v hadolint >/dev/null 2>&1 || {
-            echo "hadolint is required on PATH but was not found."
-            exit 1
-          }
-
-          hadolint -c .hadolint.yaml "${dockerfiles[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            --entrypoint hadolint \
+            hadolint/hadolint:latest-debian \
+            -c .hadolint.yaml "${dockerfiles[@]}"
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
index 9e717e0..f29dddd 100644
--- a/.github/workflows/validate.yaml
+++ b/.github/workflows/validate.yaml
@@ -17,12 +17,11 @@ jobs:
       - name: Lint YAML syntax
         shell: bash
         run: |
-          command -v yamllint >/dev/null 2>&1 || {
-            echo "yamllint is required on PATH but was not found."
-            exit 1
-          }
-
-          yamllint -c .yamllint .
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
 
   k8s:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -43,9 +42,11 @@ jobs:
             exit 0
           fi
 
-          command -v kubeconform >/dev/null 2>&1 || {
-            echo "kubeconform is required on PATH but was not found."
-            exit 1
-          }
-
-          kubeconform -strict -ignore-missing-schemas -summary "${manifests[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/yannh/kubeconform:latest \
+            -strict \
+            -ignore-missing-schemas \
+            -summary \
+            "${manifests[@]}"