diff --git a/.github/workflows/typos.yaml b/.github/workflows/typos.yaml
new file mode 100644
index 0000000..005a05a
--- /dev/null
+++ b/.github/workflows/typos.yaml
@@ -0,0 +1,24 @@
+name: Typos
+
+# Spell checks every file in the repo with typos (config in .typos.toml). Complements the misspell
+# linter in golangci-lint, which only sees Go files.
+
+on:
+  push:
+    branches: [ 'main' ]
+  pull_request:
+    types: ['opened', 'synchronize']
+
+permissions:
+  contents: read
+
+concurrency:
+  group: 'typos-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  typos:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: make typos
diff --git a/.typos.toml b/.typos.toml
new file mode 100644
index 0000000..6f235df
--- /dev/null
+++ b/.typos.toml
@@ -0,0 +1,28 @@
+# Configuration for typos (https://github.com/crate-ci/typos), run by `make typos` and
+# .github/workflows/typos.yaml. It checks every file type (Go, markdown, YAML, shell, makefile),
+# splitting identifiers so misspelled function and variable names are caught too - misspell in
+# golangci-lint only sees Go files and enforces UK spelling in comments; typos stays on the default
+# locale because en-gb flags US spellings baked into identifiers, headers, and the licence text.
+
+[files]
+ignore-hidden = false # the default skips dotfiles, which would leave .github/ workflows unchecked
+extend-exclude = [
+  ".git/",
+  ".claude/",
+  ".idea/",
+  ".tools/bin/",  # gitignored built tools
+  ".tools/venv/", # gitignored python venv
+  "**/vendor/",   # third-party code, including integration/testdata/azurerm/vendor
+  "**/go.sum",    # hashes
+]
+
+[default]
+extend-ignore-re = [
+  'v\d+\.\d+\.\d+-\d{14}-[0-9a-f]{12}', # go.mod pseudo-versions end in a commit hash typos tries to read
+]
+
+[default.extend-words]
+# words typos would otherwise "correct" - keep this list short and explain each entry
+decorder = "decorder" # golangci linter name
+importas = "importas" # golangci linter name
+intoto = "intoto"     # in-toto attestation files published by goreleaser
diff --git a/.yamllint.yml b/.yamllint.yml
index 2342a3a..687785f 100644
--- a/.yamllint.yml
+++ b/.yamllint.yml
@@ -3,7 +3,7 @@ extends: default
 
 ignore:
   - vendor/
-  - integration/testdata/
+  - .tools/venv/ # gitignored python venv, yamllint's own bundled configs live in here
 
 rules:
   comments:
diff --git a/README.md b/README.md
index cbf9f96..97fcdc2 100755
--- a/README.md
+++ b/README.md
@@ -215,7 +215,7 @@ Lists the tests that would be triggered for a PR without actually starting a bui
 ```bash
 tctest list 3232 
 ```
-Defaults work for both AzureRM and AWS out of the box. In most of the cases just set repositry flag.
+Defaults work for both AzureRM and AWS out of the box. In most of the cases just set repository flag.
 
 ```bash
 tctest list 3232 -r hashicorp/terraform-provider-aws
diff --git a/makefile b/makefile
index 44ac2d9..9b25d11 100644
--- a/makefile
+++ b/makefile
@@ -13,11 +13,13 @@ GOFUMPT=$(TOOLS_BIN)/gofumpt
 GOLANGCI_LINT=$(TOOLS_BIN)/golangci-lint
 
 # non-Go tools also live in .tools/bin at pinned versions, but the pins are here (dependabot
-# cannot bump them): shellcheck is a static haskell binary downloaded from its github release,
-# yamllint is python installed into a repo-local venv. both rebuild when this makefile changes.
+# cannot bump them): shellcheck and typos are static binaries downloaded from their github releases,
+# yamllint is python installed into a repo-local venv. all rebuild when this makefile changes.
 SHELLCHECK_VERSION=v0.11.0
+TYPOS_VERSION=v1.50.1
 YAMLLINT_VERSION=1.38.0
 SHELLCHECK=$(TOOLS_BIN)/shellcheck
+TYPOS=$(TOOLS_BIN)/typos
 YAMLLINT=$(TOOLS_BIN)/yamllint
 
 # golangci-lint with the azproviderlint module plugin compiled in (.tools/.custom-gcl.yml);
@@ -42,6 +44,14 @@ $(SHELLCHECK): makefile
 		curl -sSfL "https://github.com/koalaman/shellcheck/releases/download/$(SHELLCHECK_VERSION)/shellcheck-$(SHELLCHECK_VERSION).$$os.$$arch.tar.xz" \
 		| tar -xJ -O shellcheck-$(SHELLCHECK_VERSION)/shellcheck > $@ && chmod +x $@
 
+$(TYPOS): makefile
+	@echo "==> downloading typos $(TYPOS_VERSION)..."
+	@mkdir -p $(TOOLS_BIN)
+	@case "$$(uname)" in Darwin) target=apple-darwin;; *) target=unknown-linux-musl;; esac; \
+		arch=$$(uname -m); [ "$$arch" = "arm64" ] && arch=aarch64; \
+		curl -sSfL "https://github.com/crate-ci/typos/releases/download/$(TYPOS_VERSION)/typos-$(TYPOS_VERSION)-$$arch-$$target.tar.gz" \
+		| tar -xz -O ./typos > $@ && chmod +x $@
+
 $(YAMLLINT): makefile
 	@command -v python3 >/dev/null || (echo "python3 is required to install yamllint (macOS: xcode CLT; Debian/Ubuntu: apt install python3-venv)" && exit 1)
 	@echo "==> installing yamllint $(YAMLLINT_VERSION) into .tools/venv..."
@@ -64,7 +74,7 @@ install: ## Install tctest into GOPATH/bin with version info from git
 	@echo "==> installing..."
 	go install -ldflags "-X github.com/katbyte/tctest/lib/version.GitCommit=${GIT_COMMIT} -X github.com/katbyte/tctest/lib/version.Version=${GIT_VERSION}" .
 
-tools: $(ACTIONLINT) $(GOFUMPT) $(GOLANGCI_LINT) $(GOLANGCI_LINT_MODULES) $(SHELLCHECK) $(YAMLLINT) ## Install all pinned dev tools into .tools/bin
+tools: $(ACTIONLINT) $(GOFUMPT) $(GOLANGCI_LINT) $(GOLANGCI_LINT_MODULES) $(SHELLCHECK) $(TYPOS) $(YAMLLINT) ## Install all pinned dev tools into .tools/bin
 
 ##@ Formatting
 fmt: $(GOFUMPT) $(GOLANGCI_LINT) ## Fix Go formatting (gofmt, gofumpt, goimports)
@@ -100,6 +110,14 @@ shellcheck: $(SHELLCHECK) ## Check shell scripts with shellcheck
 	@echo "==> Checking shell scripts with shellcheck..."
 	@$(SHELLCHECK) scripts/*.sh .github/images/*.sh
 
+typos: $(TYPOS) ## Check all files for spelling mistakes with typos (config in .typos.toml)
+	@echo "==> Checking for typos..."
+	@$(TYPOS)
+
+typos-fix: $(TYPOS) ## Fix spelling mistakes found by typos
+	@echo "==> Fixing typos..."
+	@$(TYPOS) --write-changes
+
 depscheck: ## Check that go.mod/go.sum and vendor/ are in sync
 	@echo "==> Checking source code with go mod tidy..."
 	@go mod tidy
@@ -124,6 +142,6 @@ test: build ## Run unit and integration tests under the race detector
 	go test -race $$(go list ./... | grep -v '/integration$$') -timeout ${TEST_TIMEOUT}
 	@set -o pipefail; go test -race ./integration/ -v -timeout ${TEST_TIMEOUT} | grep -vE "^=== |--- PASS|^PASS$$"
 
-check-all: build test lint actionlint yamllint shellcheck depscheck ## Run build + test + all linters + depscheck
+check-all: build test lint actionlint yamllint shellcheck typos depscheck ## Run build + test + all linters + depscheck
 
-.PHONY: default all help fmt goimports build lint lint-fix actionlint yamllint shellcheck depscheck check-all install tools test
+.PHONY: default all help fmt goimports build lint lint-fix actionlint yamllint shellcheck typos typos-fix depscheck check-all install tools test