diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 1613925..3238cac 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -33,12 +33,11 @@ jobs:
             exit 0
           fi
 
-          command -v prettier >/dev/null 2>&1 || {
-            echo "prettier is required on PATH but was not found."
-            exit 1
-          }
-
-          prettier --check --ignore-unknown "${prettier_files[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            node:22-alpine \
+            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
 
   lint-ruff:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -49,12 +48,11 @@ jobs:
       - name: Lint Python with Ruff
         shell: bash
         run: |
-          command -v ruff >/dev/null 2>&1 || {
-            echo "ruff is required on PATH but was not found."
-            exit 1
-          }
-
-          ruff check .
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/astral-sh/ruff:latest \
+            check .
 
   lint-yaml:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -65,12 +63,11 @@ jobs:
       - name: Lint YAML syntax
         shell: bash
         run: |
-          command -v yamllint >/dev/null 2>&1 || {
-            echo "yamllint is required on PATH but was not found."
-            exit 1
-          }
-
-          yamllint -c .yamllint .
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
 
   lint-dockerfiles:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -90,12 +87,12 @@ jobs:
             exit 0
           fi
 
-          command -v hadolint >/dev/null 2>&1 || {
-            echo "hadolint is required on PATH but was not found."
-            exit 1
-          }
-
-          hadolint -c .hadolint.yaml "${dockerfiles[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            --entrypoint hadolint \
+            hadolint/hadolint:latest-debian \
+            -c .hadolint.yaml "${dockerfiles[@]}"
 
   validate:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -116,12 +113,14 @@ jobs:
             exit 0
           fi
 
-          command -v kubeconform >/dev/null 2>&1 || {
-            echo "kubeconform is required on PATH but was not found."
-            exit 1
-          }
-
-          kubeconform -strict -ignore-missing-schemas -summary "${manifests[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/yannh/kubeconform:latest \
+            -strict \
+            -ignore-missing-schemas \
+            -summary \
+            "${manifests[@]}"
 
   publish:
     needs: [lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 1613925..3238cac 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -33,12 +33,11 @@ jobs:
             exit 0
           fi
 
-          command -v prettier >/dev/null 2>&1 || {
-            echo "prettier is required on PATH but was not found."
-            exit 1
-          }
-
-          prettier --check --ignore-unknown "${prettier_files[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            node:22-alpine \
+            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
 
   lint-ruff:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -49,12 +48,11 @@ jobs:
       - name: Lint Python with Ruff
         shell: bash
         run: |
-          command -v ruff >/dev/null 2>&1 || {
-            echo "ruff is required on PATH but was not found."
-            exit 1
-          }
-
-          ruff check .
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/astral-sh/ruff:latest \
+            check .
 
   lint-yaml:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -65,12 +63,11 @@ jobs:
       - name: Lint YAML syntax
         shell: bash
         run: |
-          command -v yamllint >/dev/null 2>&1 || {
-            echo "yamllint is required on PATH but was not found."
-            exit 1
-          }
-
-          yamllint -c .yamllint .
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            cytopia/yamllint:latest \
+            -c .yamllint .
 
   lint-dockerfiles:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -90,12 +87,12 @@ jobs:
             exit 0
           fi
 
-          command -v hadolint >/dev/null 2>&1 || {
-            echo "hadolint is required on PATH but was not found."
-            exit 1
-          }
-
-          hadolint -c .hadolint.yaml "${dockerfiles[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            --entrypoint hadolint \
+            hadolint/hadolint:latest-debian \
+            -c .hadolint.yaml "${dockerfiles[@]}"
 
   validate:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -116,12 +113,14 @@ jobs:
             exit 0
           fi
 
-          command -v kubeconform >/dev/null 2>&1 || {
-            echo "kubeconform is required on PATH but was not found."
-            exit 1
-          }
-
-          kubeconform -strict -ignore-missing-schemas -summary "${manifests[@]}"
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/yannh/kubeconform:latest \
+            -strict \
+            -ignore-missing-schemas \
+            -summary \
+            "${manifests[@]}"
 
   publish:
     needs: [lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]