diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 24c60ce9..c8bb601b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -7,6 +7,15 @@ default_language_version:
   node: system
 
 repos:
+  - repo: https://github.com/crate-ci/typos
+    rev: v1.50.1
+    hooks:
+      - id: typos
+        # Drop the upstream default `--write-changes` so the hook reports and
+        # fails instead of rewriting files. Keep `--force-exclude` so the
+        # excludes in typos.toml still apply to the paths prek passes in.
+        args: ["--force-exclude"]
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # 6.0.0
     hooks:
diff --git a/rust/operator-binary/src/controller/build/command.rs b/rust/operator-binary/src/controller/build/command.rs
index cb667ae2..6484e6d1 100644
--- a/rust/operator-binary/src/controller/build/command.rs
+++ b/rust/operator-binary/src/controller/build/command.rs
@@ -36,7 +36,7 @@ pub fn container_prepare_args(
     // Copy custom logging provided `log.properties` to rw config
     if let ValidatedContainerLogConfigChoice::Custom(_) = merged_config.logging.trino_container {
         let log_properties = ConfigFileName::Log;
-        // copy config files to a writeable empty folder
+        // copy config files to a writable empty folder
         args.push(format!(
             "echo copying {STACKABLE_LOG_CONFIG_DIR}/{log_properties} {rw_conf}/{log_properties}",
             rw_conf = RW_CONFIG_DIR_NAME
@@ -89,7 +89,7 @@ pub fn container_trino_args(
     catalogs: &BTreeMap<TrinoCatalogName, CatalogConfig>,
 ) -> Vec<String> {
     let mut args = vec![
-        // copy config files to a writeable empty folder
+        // copy config files to a writable empty folder
         format!(
             "echo copying {conf} to {rw_conf}",
             conf = CONFIG_DIR_NAME,
diff --git a/tests/templates/kuttl/opa-authorization/check-opa.py.j2 b/tests/templates/kuttl/opa-authorization/check-opa.py.j2
index 789cb8ee..e64e657e 100755
--- a/tests/templates/kuttl/opa-authorization/check-opa.py.j2
+++ b/tests/templates/kuttl/opa-authorization/check-opa.py.j2
@@ -359,7 +359,7 @@ TEST_DATA = [
                     [
                         1,
                         "Customer#000000001",
-                        "IVhzIApeRb ot,c,E",
+                        "IVhzIApeRb ot,c,E",  # spellchecker:disable-line
                         15,
                         "25-989-741-2988",
                         711.56,
diff --git a/typos.toml b/typos.toml
new file mode 100644
index 00000000..356c60c8
--- /dev/null
+++ b/typos.toml
@@ -0,0 +1,59 @@
+# Configuration for typos (https://github.com/crate-ci/typos), run via the prek
+# hook in .pre-commit-config.yaml.
+#
+# This file is repo-specific on purpose and is NOT rolled out by
+# operator-templating. typos has no layered configuration
+# (https://github.com/crate-ci/typos/issues/193): the nearest config file wins
+# outright and is never merged with one further up the tree, so a templated
+# config could not be extended with trino-specific entries.
+#
+# The excludes below duplicate part of the top-level `exclude:` in
+# .pre-commit-config.yaml. That is deliberate: this config has to stand on its
+# own so that a bare `typos` run in a checkout behaves like the hook does.
+#
+# Before adding an entry here, consider an in-place marker instead. Use one when
+# the word is correct at this one site and would still be a typo elsewhere:
+#
+#   # spellchecker:disable-line       at the end of the line it applies to
+#   # spellchecker:ignore-next-line   on its own line, above the offending line
+#   # spellchecker:off / :on          around a block
+#
+# Every entry below gets a one-line comment saying what the word is.
+
+[files]
+# Bare `typos` skips hidden dirs by default, but prek passes explicit paths and
+# so does check them. Turn it off so both agree.
+ignore-hidden = false
+
+extend-exclude = [
+    # `.git` itself, which ignore-hidden = false would otherwise pull in.
+    ".git/",
+    # Generated by `make regenerate-nix` (crate2nix). Contains vendored crate
+    # metadata and hashes; roughly 50 false positives on its own.
+    "Cargo.nix",
+    # Generated by `make crds`. Most of the content is Kubernetes' own schema
+    # documentation, which is not ours to correct, and the doc comments we do
+    # own are already checked at their source in rust/operator-binary/src/crd/.
+    "extra/crds.yaml",
+]
+
+[default]
+# typos has no native suppression directive
+# (https://github.com/crate-ci/typos/issues/316), so these regexes provide one.
+# They cover `#`, `//`, `<!-- -->`, `;`, `/* */` and Jinja `{# #}` comments,
+# which spans every file type in this repo.
+#
+# Both failure modes are safe: an unterminated `:off` suppresses nothing rather
+# than swallowing the rest of the file, and `disable-line` only matches when the
+# marker ends the line, so trailing text defeats it instead of widening it.
+extend-ignore-re = [
+    "(?Rm)^.*(#|//|<!--|;|/\\*)\\s*spellchecker:disable-line\\s*(-->|#\\}|\\*/)?\\s*$",
+    "(#|//|<!--|;|/\\*)\\s*spellchecker:ignore-next-line\\s*(-->|#\\}|\\*/)?\\s*\\n.*",
+    "(?s)(#|//|<!--|;|/\\*|\")\\s*spellchecker:off\\s*(-->|#\\}|\\*/|\")?.*?(#|//|<!--|;|/\\*|\")\\s*spellchecker:on\\s*(-->|#\\}|\\*/|\")?",
+]
+
+[default.extend-words]
+# Azure Kubernetes Service. Appears as prose in the README footer and as the
+# runner platform `aks-1.36` in tests/interu.yaml. A single lowercase entry
+# covers every casing, so no separate `AKS` entry is needed.
+aks = "aks"