diff --git a/.github/workflows/_lint.yml b/.github/workflows/_lint.yml
index 2f5e92b39a..0d5edd3c54 100644
--- a/.github/workflows/_lint.yml
+++ b/.github/workflows/_lint.yml
@@ -2,6 +2,15 @@ name: pre-commit
 
 on:
   workflow_call:
+    inputs:
+      from-ref:
+        description: Start of the diff range to lint
+        required: true
+        type: string
+      to-ref:
+        description: End of the diff range to lint
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -13,5 +22,11 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
         persist-credentials: false
+        # the refs and their merge-base have to be resolvable
+        fetch-depth: 0
     - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
-    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
\ No newline at end of file
+    # master is not yet clean for end-of-file-fixer/trailing-whitespace, so lint
+    # only the changed files. Restore --all-files once the cleanup has landed.
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
+      with:
+        extra_args: --from-ref ${{ inputs.from-ref }} --to-ref ${{ inputs.to-ref }}
diff --git a/.github/workflows/branch.yml b/.github/workflows/branch.yml
index 66b78cc25b..a4c2da13b6 100644
--- a/.github/workflows/branch.yml
+++ b/.github/workflows/branch.yml
@@ -15,5 +15,10 @@ concurrency:
 jobs:
   lint:
     uses: ./.github/workflows/_lint.yml
+    with:
+      # not github.event.before: that is the all-zero SHA when the branch is
+      # first pushed. `master...HEAD` is what the branch adds, either way.
+      from-ref: origin/master
+      to-ref: ${{ github.sha }}
   build:
     uses: ./.github/workflows/_build.yml
diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml
index a112474887..e12506a221 100644
--- a/.github/workflows/merge.yml
+++ b/.github/workflows/merge.yml
@@ -11,6 +11,9 @@ permissions:
 jobs:
   lint:
     uses: ./.github/workflows/_lint.yml
+    with:
+      from-ref: ${{ github.event.before }}
+      to-ref: ${{ github.sha }}
   build:
     strategy:
       fail-fast: false
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 1ce439e35e..10b2dce2f6 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -14,6 +14,9 @@ concurrency:
 jobs:
   lint:
     uses: ./.github/workflows/_lint.yml
+    with:
+      from-ref: ${{ github.event.pull_request.base.sha }}
+      to-ref: ${{ github.event.pull_request.head.sha }}
   build:
     uses: ./.github/workflows/_build.yml
   unit-test:
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3e189a6d82..3a0a027a85 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -2,9 +2,10 @@ repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
-    -   id: check-yaml
-    # TODO add end of file fixer and whitespace fixer
+    - id: check-yaml
+    - id: end-of-file-fixer
+    - id: trailing-whitespace
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
-    rev: v1.26.1 
+    rev: v1.26.1
     hooks:
-    - id: zizmor
\ No newline at end of file
+    - id: zizmor
diff --git a/app/alarm/Readme.md b/app/alarm/Readme.md
index 1d61dc27bd..15e82c3e46 100644
--- a/app/alarm/Readme.md
+++ b/app/alarm/Readme.md
@@ -68,7 +68,7 @@ If the following "First steps" generate errors of the type
 or
 
     ERROR ..TimeoutException: Timed out waiting for a node assignment
-    
+
 then define the host name in  `config/server.properties`.
 For tests, you can use localhost:
 
@@ -115,14 +115,14 @@ but simply meant to learn about Kafka or to test connectivity.
 
     # Create new topic
     kafka/bin/kafka-topics.sh  --bootstrap-server localhost:9092 --create --replication-factor 1 --partitions 1 --topic test
-    
+
     # Topic info
     kafka/bin/kafka-topics.sh  --bootstrap-server localhost:9092 --list
     kafka/bin/kafka-topics.sh  --bootstrap-server localhost:9092 --describe
     kafka/bin/kafka-topics.sh  --bootstrap-server localhost:9092 --describe --topic test
     kafka/bin/kafka-configs.sh --bootstrap-server localhost:9092 --entity-type topics --describe
-    
-    # Produce messages for topic (no key) 
+
+    # Produce messages for topic (no key)
     kafka/bin/kafka-console-producer.sh --broker-list localhost:9092 --topic test
     Message 1
     Message 2
@@ -569,4 +569,3 @@ When functional, the file `kafka/logs/log-cleaner.log` shows periodic compaction
 		Start size: 0.1 MB (414 messages)
 		End size: 0.1 MB (380 messages)
 		8.9% size reduction (8.2% fewer messages)
-