diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..f53d3bd
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,6 @@
+# actionlint v1.7.12 predates GitHub background/wait steps.
+paths:
+  .github/workflows/release.yaml:
+    ignore:
+      - '^unexpected key "background" for step to execute action\.'
+      - '^step must run script with "run" section or run action with "uses" section$'
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 9314776..2621b50 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -6,6 +6,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint
@@ -33,7 +36,6 @@ jobs:
 
       - name: megalinter
         uses: oxsecurity/megalinter@9949bad031045f366be2467e00e8371a7328a2e2 # v10
-        if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VALIDATE_ALL_CODEBASE: false
+          VALIDATE_ALL_CODEBASE: true
diff --git a/.mega-linter.yml b/.mega-linter.yml
index 0050ad4..d82ba58 100644
--- a/.mega-linter.yml
+++ b/.mega-linter.yml
@@ -1,4 +1,7 @@
 ENABLE_ERRORS_LINTERS:
   - ACTION_ACTIONLINT
 
+ACTION_ACTIONLINT_CONFIG_FILE: LINTER_DEFAULT
+GITHUB_COMMENT_REPORTER: false
+
 BASH_SHFMT_ARGUMENTS: ["-i", "4", "-ci", "-w"]
diff --git a/prek.toml b/prek.toml
index 887061a..44554ba 100644
--- a/prek.toml
+++ b/prek.toml
@@ -53,8 +53,6 @@ rev = "v1.7.12"
 
 [[repos.hooks]]
 id = "actionlint"
-# v1.7.12 predates GitHub's background/wait steps; GitHub validates their syntax.
-args = ['-ignore', 'unexpected key "background" for step', '-ignore', 'step must run script with "run" section or run action with "uses" section']
 files = "^\\.github/workflows/"
 
 [[repos]]