diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5665c06..fba7c35 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,10 +1,11 @@
+---
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     groups:
       gha:
-        update-types: [ "major", "minor", "patch" ]
+        update-types: ["major", "minor", "patch"]
     schedule:
       interval: "weekly"
     labels:
@@ -17,7 +18,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]   # ← only patch PRs
+        update-types: ["version-update:semver-patch"]  # only patch PRs
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
@@ -28,7 +29,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]
+        update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
@@ -39,7 +40,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]
+        update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
@@ -50,7 +51,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]
+        update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
@@ -61,7 +62,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]
+        update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
@@ -72,7 +73,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]
+        update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
@@ -83,7 +84,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]
+        update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
@@ -94,7 +95,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]
+        update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
@@ -105,7 +106,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]
+        update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
@@ -116,7 +117,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]
+        update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
@@ -127,7 +128,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]
+        update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
@@ -138,7 +139,7 @@ updates:
       interval: weekly
     groups:
       docker-patch:
-        update-types: [ "version-update:semver-patch" ]
+        update-types: ["version-update:semver-patch"]
     open-pull-requests-limit: 5
     labels:
       - docker-base-update
diff --git a/.github/workflows/build-php72-apache2.yaml b/.github/workflows/build-php72-apache2.yaml
index 5841671..ef24d18 100644
--- a/.github/workflows/build-php72-apache2.yaml
+++ b/.github/workflows/build-php72-apache2.yaml
@@ -11,13 +11,12 @@ on:
   workflow_dispatch:
 
 jobs:
-
   build-php72:
     permissions:
       packages: write
     strategy:
       matrix:
-        arch: [ 'amd64', 'arm64' ]
+        arch: ['amd64', 'arm64']
     runs-on: "ubuntu-24.04${{ matrix.arch == 'arm64' && '-arm' || '' }}"
     steps:
       - name: Checkout
diff --git a/.github/workflows/build-php82-apache2.yaml b/.github/workflows/build-php82-apache2.yaml
index 6aa3d9f..ed23e94 100644
--- a/.github/workflows/build-php82-apache2.yaml
+++ b/.github/workflows/build-php82-apache2.yaml
@@ -25,7 +25,7 @@ jobs:
       packages: write
     strategy:
       matrix:
-        arch: [ 'amd64', 'arm64' ]
+        arch: ['amd64', 'arm64']
     runs-on: "ubuntu-24.04${{ matrix.arch == 'arm64' && '-arm' || '' }}"
     steps:
       - name: Checkout
diff --git a/.github/workflows/build-php85-apache2-node24.yaml b/.github/workflows/build-php85-apache2-node24.yaml
index b34fc48..c2e1501 100644
--- a/.github/workflows/build-php85-apache2-node24.yaml
+++ b/.github/workflows/build-php85-apache2-node24.yaml
@@ -25,7 +25,7 @@ jobs:
       packages: write
     strategy:
       matrix:
-        arch: [ 'amd64', 'arm64' ]
+        arch: ['amd64', 'arm64']
     runs-on: "ubuntu-24.04${{ matrix.arch == 'arm64' && '-arm' || '' }}"
     steps:
       - name: Checkout
diff --git a/.github/workflows/build-php85-apache2.yaml b/.github/workflows/build-php85-apache2.yaml
index d255076..f6295f2 100644
--- a/.github/workflows/build-php85-apache2.yaml
+++ b/.github/workflows/build-php85-apache2.yaml
@@ -25,7 +25,7 @@ jobs:
       packages: write
     strategy:
       matrix:
-        arch: [ 'amd64', 'arm64' ]
+        arch: ['amd64', 'arm64']
     runs-on: "ubuntu-24.04${{ matrix.arch == 'arm64' && '-arm' || '' }}"
     steps:
       - name: Checkout
diff --git a/.github/workflows/delete-old-container-images.yaml b/.github/workflows/delete-old-container-images.yaml
index d800871..a2e7b07 100644
--- a/.github/workflows/delete-old-container-images.yaml
+++ b/.github/workflows/delete-old-container-images.yaml
@@ -1,3 +1,4 @@
+---
 name: Delete old container images
 
 on:
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
new file mode 100644
index 0000000..36ffb1b
--- /dev/null
+++ b/.github/workflows/validate.yml
@@ -0,0 +1,38 @@
+---
+name: Validate YAML and Markdown
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Install yamllint and markdownlint
+        run: |
+          python -m pip install --upgrade pip
+          pip install yamllint
+          npm install -g markdownlint-cli
+
+      - name: Lint YAML
+        run: yamllint $(git ls-files '*.yml' '*.yaml')
+
+      - name: Lint Markdown
+        run: markdownlint $(git ls-files '*.md')
diff --git a/.markdownlint.yaml b/.markdownlint.yaml
new file mode 100644
index 0000000..02907b2
--- /dev/null
+++ b/.markdownlint.yaml
@@ -0,0 +1,2 @@
+---
+MD013: false
diff --git a/.yamllint.yaml b/.yamllint.yaml
new file mode 100644
index 0000000..0db1ba9
--- /dev/null
+++ b/.yamllint.yaml
@@ -0,0 +1,34 @@
+---
+
+yaml-files:
+  - '*.yaml'
+  - '*.yml'
+  - '.yamllint'
+
+rules:
+  anchors: enable
+  braces: enable
+  brackets: enable
+  colons: enable
+  commas: enable
+  comments:
+    level: warning
+  comments-indentation:
+    level: warning
+  document-end: disable
+  document-start:
+    level: warning
+  empty-lines: enable
+  empty-values: disable
+  float-values: disable
+  hyphens: enable
+  indentation: enable
+  key-duplicates: enable
+  key-ordering: disable
+  line-length: disable
+  new-line-at-end-of-file: enable
+  new-lines: enable
+  octal-values: disable
+  quoted-strings: disable
+  trailing-spaces: enable
+  truthy: disable
diff --git a/README.md b/README.md
index 28c0865..0375b62 100644
--- a/README.md
+++ b/README.md
@@ -3,50 +3,57 @@
 We provide the following base containers which can be used in downstream projects:
 
 ## Apache2 containers
-**Plain Apache**</br>
+
+### Plain Apache
+
 ![Build status for plain apache2 production image](https://github.com/OpenConext/OpenConext-BaseContainers/actions/workflows/build-apache2.yaml/badge.svg)
 
-**Apache 2 with shibboleth**</br>
-![Build status for apache2 shibboleth production image](https://github.com/OpenConext/OpenConext-BaseContainers/actions/workflows/build-apache2-shibboleth.yaml/badge.svg)
+### Apache 2 with shibboleth
 
+![Build status for apache2 shibboleth production image](https://github.com/OpenConext/OpenConext-BaseContainers/actions/workflows/build-apache2-shibboleth.yaml/badge.svg)
 
 ## PHP 72 images
 
-**PROD image:**</br>
+**PROD image:**
+
 ![Build status for php72 apache2 production image](https://github.com/OpenConext/OpenConext-BaseContainers/actions/workflows/build-php72-apache2.yaml/badge.svg)
 
-**Dev images:**</br>
-![Build status for php72 apache2 node14 image](https://github.com/OpenConext/OpenConext-BaseContainers/actions/workflows/build-php72-apache2-node14-composer2.yaml/badge.svg)</br>
-![Build status for php72 apache2 node16 image](https://github.com/OpenConext/OpenConext-BaseContainers/actions/workflows/build-php72-apache2-node16-composer2.yaml/badge.svg)
+**Dev images:**
 
+![Build status for php72 apache2 node14 image](https://github.com/OpenConext/OpenConext-BaseContainers/actions/workflows/build-php72-apache2-node14-composer2.yaml/badge.svg)
+![Build status for php72 apache2 node16 image](https://github.com/OpenConext/OpenConext-BaseContainers/actions/workflows/build-php72-apache2-node16-composer2.yaml/badge.svg)
 
 ## PHP 8.2 images
 
-**PROD image:**<br>
+**PROD image:**
 
 ![Build status for php82 apache2 production image](https://github.com/OpenConext/OpenConext-BaseContainers/actions/workflows/build-php82-apache2.yaml/badge.svg)
 
-**Dev images:** </br>
+**Dev images:**
+
 ![Build status for php82 apache2 node20 image](https://github.com/OpenConext/OpenConext-BaseContainers/actions/workflows/build-php82-apache2-node20-composer2.yaml/badge.svg)
 
 ## Features
 
-- At every start, the php containers will recreate the symfony cache dir. </br>
-- You can supply the environment variable APACHE_UID. It creates the user "openconext", and starts Apache with that the supplied uid. 
-This allows for strict permissions on mounted files.
-You need to prefix the uid with a # like so:
-```
+- At every start, the php containers will recreate the symfony cache dir.
+- You can supply the environment variable APACHE_UID. It creates the user "openconext", and starts Apache with that the supplied uid.
+  This allows for strict permissions on mounted files.
+  You need to prefix the uid with a # like so:
+
+```sh
 docker run -e APACHE_UID=#1337 ghcr.io/openconext/openconext-basecontainers/php72-apache2:latest
 ```
+
 - You can supply the environment variable "HTTPD_CSP" which will set the CSP header on responses.
 - You can supply the environment variable TZ to set the timezone on the php82 containers
 - You can add PHP_MEMORY_LIMIT to override the default setting of 128M php memory limit on the php82 containers
 
 ### satosa container
 
-- At every start, the satosa container will create a new satosa user and group.</br>
-- You can supply the environment variables RUNAS_UID and RUNAS_GID to configure the chosen uid and gid inside the container.</br>
+- At every start, the satosa container will create a new satosa user and group.
+- You can supply the environment variables RUNAS_UID and RUNAS_GID to configure the chosen uid and gid inside the container.
 - Without RUNAS_UID and RUNAS_GID the container will fall back to uid=1000 and gid=1000
-```
+
+```sh
 docker run -e RUNAS_UID=1234 -e RUNAS_GID=1234 --rm ghcr.io/openconext/openconext-basecontainers/satosa:latest
 ```