diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
new file mode 100644
index 0000000..2394dbe
--- /dev/null
+++ b/.github/workflows/linting.yml
@@ -0,0 +1,55 @@
+name: PR Checks
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Ruff lint & format
+    runs-on: ['self-hosted','ubuntu-22.04']
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install Ruff
+        run: pip install ruff
+
+      - name: Ruff check
+        run: ruff check .
+
+      - name: Ruff format check
+        run: ruff format --check .
+
+  security:
+    name: Dependency audit
+    runs-on: ['self-hosted','ubuntu-22.04']
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install package + pip-audit
+        run: pip install -e . pip-audit
+
+      - name: Run pip-audit
+        run: pip-audit
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index feb1f96..2f45f0b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,7 +14,7 @@ on:
 jobs:
   build:
     name: Build distribution
-    runs-on: ubuntu-latest
+    runs-on: ['self-hosted','ubuntu-22.04']
 
     steps:
       - name: Check out repository
@@ -48,7 +48,7 @@ jobs:
   publish:
     name: Publish to PyPI
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ['self-hosted','ubuntu-22.04']
 
     environment:
       name: pypi