diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ec7f3c7..6634b6b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,58 +6,68 @@ on:
   pull_request:
     branches: [ main ]
 
-jobs:
-
-  checks:
-    name: Project Checks
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-
-    steps:
-      - uses: actions/setup-go@v2
-        with:
-          go-version: 1.20.x
-
-      - name: Set env
-        shell: bash
-        run: |
-          echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
-          echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+env:
+  # Go version we currently use to build containerd across all CI.
+  # Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions.
+  GO_VERSION: "1.21.0"
 
-      - uses: actions/checkout@v2
-        with:
-          path: src/github.com/containerd/log
-          fetch-depth: 25
+permissions: # added using https://github.com/step-security/secure-workflows
+  contents: read
 
-      - uses: containerd/project-checks@v1
-        with:
-          working-directory: src/github.com/containerd/log
+jobs:
 
+  #
+  # golangci-lint
+  #
   linters:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
     name: Linters
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
 
     strategy:
       matrix:
-        go-version: [1.20.x]
-        os: [ubuntu-22.04]
+        os: [ubuntu-22.04, macos-12] # TODO: Add windows-2019
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/setup-go@v4
         with:
-          path: src/github.com/containerd/log
+          go-version: ${{ env.GO_VERSION }}
+          cache: false # see actions/setup-go#368
 
-      - name: Set env
-        shell: bash
-        run: |
-          echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
-          echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      - uses: actions/checkout@v3
+      - uses: golangci/golangci-lint-action@v3
+        with:
+          version: v1.52.2
+          skip-cache: true
+          args: --timeout=5m
+
+  #
+  # Project checks
+  #
+  project:
+    name: Project Checks
+    if: github.repository == 'containerd/log'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+
+    steps:
+      - uses: actions/setup-go@v4
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: false # see actions/setup-go#368
+
+      - uses: actions/checkout@v3
+        with:
+          path: src/github.com/containerd/log
+          fetch-depth: 25
 
-      - uses: golangci/golangci-lint-action@v2
+      - uses: containerd/project-checks@v1.1.0
         with:
-          version: v1.29
           working-directory: src/github.com/containerd/log
+          repo-access-token: ${{ secrets.GITHUB_TOKEN }}
 
   tests:
     name: Tests
@@ -71,7 +81,7 @@ jobs:
 
       - uses: actions/setup-go@v2
         with:
-          go-version: 1.20.x
+          go-version: ${{ env.GO_VERSION }}
 
       - name: Set env
         shell: bash
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 0000000..a695775
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,30 @@
+linters:
+  enable:
+    - exportloopref # Checks for pointers to enclosing loop variables
+    - gofmt
+    - goimports
+    - gosec
+    - ineffassign
+    - misspell
+    - nolintlint
+    - revive
+    - staticcheck
+    - tenv # Detects using os.Setenv instead of t.Setenv since Go 1.17
+    - unconvert
+    - unused
+    - vet
+    - dupword # Checks for duplicate words in the source code
+  disable:
+    - errcheck
+
+run:
+  timeout: 5m
+  skip-dirs:
+    - api
+    - cluster
+    - design
+    - docs
+    - docs/man
+    - releases
+    - reports
+    - test # e2e scripts