diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..6637287
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,24 @@
+name: Lint Dockerfile
+
+on:
+  push:
+    paths:
+      - Dockerfile
+      - .github/workflows/lint.yml
+  pull_request:
+    paths:
+      - Dockerfile
+      - .github/workflows/lint.yml
+  workflow_dispatch:
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+
+      - name: Run hadolint
+        run: |
+          docker run --rm -v "$PWD":/work -w /work hadolint/hadolint:latest-alpine \
+            sh -c "hadolint --version && hadolint Dockerfile"
diff --git a/.woodpecker.yml b/.woodpecker.yml
index 1248eeb..11542a9 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -11,16 +11,9 @@ when:
         - .woodpecker.yml
 
 steps:
-  - name: lint-dockerfile
-    image: hadolint/hadolint:latest-alpine
-    commands:
-      - hadolint --version
-      - hadolint Dockerfile
-
   - name: build-and-push
     image: woodpeckerci/plugin-docker-buildx
     privileged: true
-    depends_on: [lint-dockerfile]
     settings:
       repo: ${CI_REPO}
       dockerfile: Dockerfile
diff --git a/Dockerfile b/Dockerfile
index d8ecfe6..7d2b5ca 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,7 +9,7 @@ COPY --chown=$UID:0 --chmod=644 conf/nginx-site.conf /etc/nginx/conf.d/default.c
 EXPOSE 8080
 
 HEALTHCHECK --interval=30s --timeout=10s --retries=3 --start-period=10s \
-    CMD curl -fSs 127.0.0.1:8080/healthz || exit 1
+    CMD ["curl", "-fSs", "127.0.0.1:8080/healthz"]
 
 STOPSIGNAL SIGQUIT