diff --git a/.hadolint.yaml b/.hadolint.yaml
new file mode 100644
index 0000000..da952b1
--- /dev/null
+++ b/.hadolint.yaml
@@ -0,0 +1,4 @@
+override:
+  style:
+    - DL3006   # explicit image tag version
+    - DL3018   # version pin in apk add
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4659081..e59a0c5 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -17,8 +17,13 @@ repos:
     hooks:
       - id: markdownlint
         args:
-          - -r "~MD013"                   # ignore line-length rule
+          - -r "~MD013"   # ignore line-length rule
   - repo: https://github.com/ansible-community/ansible-lint
-    rev: v6.0.2
+    rev: v6.1.0
     hooks:
       - id: ansible-lint
+        exclude: ^docker/
+  - repo: https://github.com/hadolint/hadolint
+    rev: v2.10.0
+    hooks:
+      - id: hadolint
diff --git a/docker/pi-hole/docker-compose.yml b/docker/pi-hole/docker-compose.yml
index 195fe20..d8d6fe3 100644
--- a/docker/pi-hole/docker-compose.yml
+++ b/docker/pi-hole/docker-compose.yml
@@ -14,8 +14,8 @@ services:
       TZ: Europe/Amsterdam
       WEBPASSWORD_FILE: /run/secrets/webpassword
     volumes:
-        - ./etc-pihole/:/etc/pihole/
-        - ./etc-dnsmasq.d/:/etc/dnsmasq.d/
+      - ./etc-pihole/:/etc/pihole/
+      - ./etc-dnsmasq.d/:/etc/dnsmasq.d/
     dns:
       - 127.0.0.1
       - 1.1.1.1
diff --git a/docker/pi-hole/upstream.docker-compose.yml b/docker/pi-hole/upstream.docker-compose.yml
index 47073e9..0f0cac5 100644
--- a/docker/pi-hole/upstream.docker-compose.yml
+++ b/docker/pi-hole/upstream.docker-compose.yml
@@ -16,8 +16,8 @@ services:
       # WEBPASSWORD: 'set a secure password here or it will be random'
     # Volumes store your data between container upgrades
     volumes:
-        - './etc-pihole/:/etc/pihole/'
-        - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
+      - './etc-pihole/:/etc/pihole/'
+      - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
     dns:
       - 127.0.0.1
       - 1.1.1.1