diff --git a/.gitignore b/.gitignore
index a18bbd7f..921b88a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -59,3 +59,10 @@ common/common/datastructures/fuzzer_msg*
 crs_scratch/*
 tasks_storage/*
 node_data_storage/*
+
+# Serena runtime files (keep .serena/project.yml tracked)
+.serena/memories/
+.serena/*.log
+
+# WASM runtimes (downloaded for seed-gen sandbox tests)
+.wasm/
diff --git a/.hadolint.yaml b/.hadolint.yaml
new file mode 100644
index 00000000..a39e5d4f
--- /dev/null
+++ b/.hadolint.yaml
@@ -0,0 +1,12 @@
+# Hadolint configuration for Buttercup
+# https://github.com/hadolint/hadolint
+
+ignored:
+  # Pin versions in apt-get install - impractical for multi-arch builds where
+  # versions vary by base image and architecture; base image provides reproducibility
+  - DL3008
+
+trustedRegistries:
+  - docker.io
+  - ghcr.io
+  - gcr.io
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 2ff1680e..cc4fb941 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -32,6 +32,53 @@ repos:
         types_or: [python, pyi]
         args: [--fix, --exit-non-zero-on-fix]
 
+  # ShellCheck - Shell script linting (all .sh files)
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.11.0.1
+    hooks:
+      - id: shellcheck
+        args: [--severity=warning]
+
+  # shfmt - Shell script formatting (all .sh files)
+  - repo: https://github.com/scop/pre-commit-shfmt
+    rev: v3.12.0-2
+    hooks:
+      - id: shfmt
+        args: [-i, '4', -ci]
+
+  # actionlint - GitHub Actions workflow linting
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.10
+    hooks:
+      - id: actionlint
+
+  # zizmor - GitHub Actions security analysis
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v1.22.0
+    hooks:
+      - id: zizmor
+        args: [--min-severity=low, --min-confidence=medium]
+
+  # hadolint - Dockerfile linting
+  - repo: https://github.com/AleksaC/hadolint-py
+    rev: v2.14.0
+    hooks:
+      - id: hadolint
+        args: [--failure-threshold, warning]
+
+  # ty - Astral type checking (local hook)
+  - repo: local
+    hooks:
+      - id: ty
+        name: ty type checking
+        entry: >-
+          bash -c 'for dir in common orchestrator fuzzer fuzzer_runner patcher program-model seed-gen; do
+          if [[ "$1" == "$dir/"* ]]; then cd "$dir" && uv run ty check src/; exit $?; fi; done' --
+        language: system
+        types: [python]
+        files: ^(common|orchestrator|fuzzer|fuzzer_runner|patcher|program-model|seed-gen)/src/
+        pass_filenames: true
+
 # Global exclusions for files that should never be checked
 exclude: |
   (?x)^(
diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 00000000..e80e99fe
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,6 @@
+# Shellcheck configuration for Buttercup
+shell=bash
+
+# Globally disable SC1091 (source file not followed)
+# These are dynamically sourced or external files
+disable=SC1091