diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 5a624db84f..7c84bd05fb 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -22,10 +22,13 @@ jobs:
 
       - uses: actions/checkout@v5
 
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v8
+      - name: Activate Hermit
+        uses: cashapp/activate-hermit@v1
         with:
-          version: v2.1.0
+          cache: "true"
+
+      - name: Run golangci-lint
+        run: ./bin/golangci-lint run ./...
 
   lint-jsonschema:
     runs-on: ubuntu-latest
diff --git a/.gitignore b/.gitignore
index 675a0da6c6..933b701151 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,6 +32,15 @@ tags
 
 /bin/*
 !/bin/.keep
+!/bin/activate-hermit
+!/bin/activate-hermit.fish
+!/bin/hermit
+!/bin/hermit.hcl
+!/bin/README.hermit.md
+!/bin/*.pkg
+!/bin/go
+!/bin/gofmt
+!/bin/golangci-lint
 /testdata/vars/v1
 /tmp
 node_modules
diff --git a/Taskfile.yml b/Taskfile.yml
index 6b56089af5..fd0711787e 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -93,7 +93,7 @@ tasks:
       - .golangci.yml
       - go.mod
     cmds:
-      - golangci-lint run
+      - "{{.BIN}}/golangci-lint run"
 
   lint:fix:
     desc: Runs golangci-lint and fixes any issues
@@ -102,7 +102,7 @@ tasks:
       - .golangci.yml
       - go.mod
     cmds:
-      - golangci-lint run --fix
+      - "{{.BIN}}/golangci-lint run --fix"
 
   format:
     desc: Runs golangci-lint and formats any Go files
@@ -111,7 +111,7 @@ tasks:
       - './**/*.go'
       - .golangci.yml
     cmds:
-      - golangci-lint fmt
+      - "{{.BIN}}/golangci-lint fmt"
 
   sleepit:build:
     desc: Builds the sleepit test helper
diff --git a/bin/.go-1.24.0.pkg b/bin/.go-1.24.0.pkg
new file mode 120000
index 0000000000..383f4511d4
--- /dev/null
+++ b/bin/.go-1.24.0.pkg
@@ -0,0 +1 @@
+hermit
\ No newline at end of file
diff --git a/bin/.golangci-lint-2.1.1.pkg b/bin/.golangci-lint-2.1.1.pkg
new file mode 120000
index 0000000000..383f4511d4
--- /dev/null
+++ b/bin/.golangci-lint-2.1.1.pkg
@@ -0,0 +1 @@
+hermit
\ No newline at end of file
diff --git a/bin/README.hermit.md b/bin/README.hermit.md
new file mode 100644
index 0000000000..e889550ba4
--- /dev/null
+++ b/bin/README.hermit.md
@@ -0,0 +1,7 @@
+# Hermit environment
+
+This is a [Hermit](https://github.com/cashapp/hermit) bin directory.
+
+The symlinks in this directory are managed by Hermit and will automatically
+download and install Hermit itself as well as packages. These packages are
+local to this environment.
diff --git a/bin/activate-hermit b/bin/activate-hermit
new file mode 100755
index 0000000000..fe28214d33
--- /dev/null
+++ b/bin/activate-hermit
@@ -0,0 +1,21 @@
+#!/bin/bash
+# This file must be used with "source bin/activate-hermit" from bash or zsh.
+# You cannot run it directly
+#
+# THIS FILE IS GENERATED; DO NOT MODIFY
+
+if [ "${BASH_SOURCE-}" = "$0" ]; then
+  echo "You must source this script: \$ source $0" >&2
+  exit 33
+fi
+
+BIN_DIR="$(dirname "${BASH_SOURCE[0]:-${(%):-%x}}")"
+if "${BIN_DIR}/hermit" noop > /dev/null; then
+  eval "$("${BIN_DIR}/hermit" activate "${BIN_DIR}/..")"
+
+  if [ -n "${BASH-}" ] || [ -n "${ZSH_VERSION-}" ]; then
+      hash -r 2>/dev/null
+    fi
+
+    echo "Hermit environment $("${HERMIT_ENV}"/bin/hermit env HERMIT_ENV) activated"
+fi
diff --git a/bin/activate-hermit.fish b/bin/activate-hermit.fish
new file mode 100755
index 0000000000..0367d2331a
--- /dev/null
+++ b/bin/activate-hermit.fish
@@ -0,0 +1,24 @@
+#!/usr/bin/env fish
+
+# This file must be sourced with "source bin/activate-hermit.fish" from Fish shell.
+# You cannot run it directly.
+#
+# THIS FILE IS GENERATED; DO NOT MODIFY
+
+if status is-interactive
+    set BIN_DIR (dirname (status --current-filename))
+
+    if "$BIN_DIR/hermit" noop > /dev/null
+        # Source the activation script generated by Hermit
+        "$BIN_DIR/hermit" activate "$BIN_DIR/.." | source
+
+        # Clear the command cache if applicable
+        functions -c > /dev/null 2>&1
+
+        # Display activation message
+        echo "Hermit environment $($HERMIT_ENV/bin/hermit env HERMIT_ENV) activated"
+    end
+else
+    echo "You must source this script: source $argv[0]" >&2
+    exit 33
+end
diff --git a/bin/go b/bin/go
new file mode 120000
index 0000000000..42b4aa39f5
--- /dev/null
+++ b/bin/go
@@ -0,0 +1 @@
+.go-1.24.0.pkg
\ No newline at end of file
diff --git a/bin/gofmt b/bin/gofmt
new file mode 120000
index 0000000000..42b4aa39f5
--- /dev/null
+++ b/bin/gofmt
@@ -0,0 +1 @@
+.go-1.24.0.pkg
\ No newline at end of file
diff --git a/bin/golangci-lint b/bin/golangci-lint
new file mode 120000
index 0000000000..766f5ce141
--- /dev/null
+++ b/bin/golangci-lint
@@ -0,0 +1 @@
+.golangci-lint-2.1.1.pkg
\ No newline at end of file
diff --git a/bin/hermit b/bin/hermit
new file mode 100755
index 0000000000..31559b7d11
--- /dev/null
+++ b/bin/hermit
@@ -0,0 +1,43 @@
+#!/bin/bash
+#
+# THIS FILE IS GENERATED; DO NOT MODIFY
+
+set -eo pipefail
+
+export HERMIT_USER_HOME=~
+
+if [ -z "${HERMIT_STATE_DIR}" ]; then
+  case "$(uname -s)" in
+  Darwin)
+    export HERMIT_STATE_DIR="${HERMIT_USER_HOME}/Library/Caches/hermit"
+    ;;
+  Linux)
+    export HERMIT_STATE_DIR="${XDG_CACHE_HOME:-${HERMIT_USER_HOME}/.cache}/hermit"
+    ;;
+  esac
+fi
+
+export HERMIT_DIST_URL="${HERMIT_DIST_URL:-https://github.com/cashapp/hermit/releases/download/stable}"
+HERMIT_CHANNEL="$(basename "${HERMIT_DIST_URL}")"
+export HERMIT_CHANNEL
+export HERMIT_EXE=${HERMIT_EXE:-${HERMIT_STATE_DIR}/pkg/hermit@${HERMIT_CHANNEL}/hermit}
+
+if [ ! -x "${HERMIT_EXE}" ]; then
+  echo "Bootstrapping ${HERMIT_EXE} from ${HERMIT_DIST_URL}" 1>&2
+  INSTALL_SCRIPT="$(mktemp)"
+  # This value must match that of the install script
+  INSTALL_SCRIPT_SHA256="09ed936378857886fd4a7a4878c0f0c7e3d839883f39ca8b4f2f242e3126e1c6"
+  if [ "${INSTALL_SCRIPT_SHA256}" = "BYPASS" ]; then
+    curl -fsSL "${HERMIT_DIST_URL}/install.sh" -o "${INSTALL_SCRIPT}"
+  else
+    # Install script is versioned by its sha256sum value
+    curl -fsSL "${HERMIT_DIST_URL}/install-${INSTALL_SCRIPT_SHA256}.sh" -o "${INSTALL_SCRIPT}"
+    # Verify install script's sha256sum
+    openssl dgst -sha256 "${INSTALL_SCRIPT}" | \
+      awk -v EXPECTED="$INSTALL_SCRIPT_SHA256" \
+      '$2!=EXPECTED {print "Install script sha256 " $2 " does not match " EXPECTED; exit 1}'
+  fi
+  /bin/bash "${INSTALL_SCRIPT}" 1>&2
+fi
+
+exec "${HERMIT_EXE}" --level=fatal exec "$0" -- "$@"
diff --git a/bin/hermit.hcl b/bin/hermit.hcl
new file mode 100644
index 0000000000..081cbe8344
--- /dev/null
+++ b/bin/hermit.hcl
@@ -0,0 +1,2 @@
+github-token-auth {
+}