diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 74002636..842399b1 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -7,6 +7,19 @@ default_language_version:
   node: system
 
 repos:
+  # The word lists live in a per-repo `typos.toml`, which is not templated.
+  # typos has no layered configuration (https://github.com/crate-ci/typos/issues/193).
+  # A templated config can currently not be extended locally.
+  - repo: https://github.com/crate-ci/typos
+    rev: 00f422f3b19c57bc6338715ebfe3316d38768461  # v1.50.3
+    hooks:
+      - id: typos
+        # Drop the upstream default `--write-changes` so the hook only
+        # reports failures instead of writing changes.
+        # Keep `--force-exclude` so the excludes in typos.toml still
+        # apply to the paths prek passes in.
+        args: ["--force-exclude"]
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # 6.0.0
     hooks:
diff --git a/docs/modules/airflow/pages/getting_started/first_steps.adoc b/docs/modules/airflow/pages/getting_started/first_steps.adoc
index 1cb87c27..c210ec11 100644
--- a/docs/modules/airflow/pages/getting_started/first_steps.adoc
+++ b/docs/modules/airflow/pages/getting_started/first_steps.adoc
@@ -64,7 +64,7 @@ Where:
 * `spec.clusterConfig.metadataDatabase`: specifies one of the supported database types (in this case, `postgresql`) along with references to the host, database and the secret containing the connection credentials.
 * the product version of the Docker image provided by Stackable must be set in `spec.image.productVersion`.
 * `spec.celeryExecutors`: deploy executors managed by Airflow's Celery engine.
-Alternatively you can use `kuberenetesExectors` that use Airflow's Kubernetes engine for executor management.
+Alternatively you can use `kubernetesExecutors` that use Airflow's Kubernetes engine for executor management.
 For more information see https://airflow.apache.org/docs/apache-airflow/stable/executor/index.html#executor-types).
 * `spec.celeryExecutors.resultBackend`: specifies one of the supported database types (in this case, `postgresql`) along with references to the host, database and the secret containing the connection credentials.
 * `spec.celeryExecutors.broker`: specifies one of the supported queue/broker types (in this case, `redis`) along with references to the host and the secret containing the connection credentials.
diff --git a/docs/modules/airflow/pages/reference/crds.adoc b/docs/modules/airflow/pages/reference/crds.adoc
index 2c6ae5e3..1dd4c932 100644
--- a/docs/modules/airflow/pages/reference/crds.adoc
+++ b/docs/modules/airflow/pages/reference/crds.adoc
@@ -1,3 +1,3 @@
 = CRD Reference
 
-Find all CRD reference for the Stackable Operator for Apache Airfow at: {crd-ref}{crd-ref-release}&operator=airflow-operator.
+Find all CRD reference for the Stackable Operator for Apache Airflow at: {crd-ref}{crd-ref-release}&operator=airflow-operator.
diff --git a/docs/modules/airflow/pages/required-external-components.adoc b/docs/modules/airflow/pages/required-external-components.adoc
index 778e30de..eb4c5d05 100644
--- a/docs/modules/airflow/pages/required-external-components.adoc
+++ b/docs/modules/airflow/pages/required-external-components.adoc
@@ -12,6 +12,6 @@ Fully supported for production usage:
 NOTE: The SDP Airflow images do not bundle the MySQL provider for Airflow.
 If you need MySQL or MariaDB as an Airflow back-end, you will need to create a custom image to include this provider.
 
-The Celery exectutor also requires:
+The Celery executor also requires:
 
 * Redis (any stable version)
diff --git a/docs/modules/airflow/pages/troubleshooting/index.adoc b/docs/modules/airflow/pages/troubleshooting/index.adoc
index f5901b6d..9d48bfaf 100644
--- a/docs/modules/airflow/pages/troubleshooting/index.adoc
+++ b/docs/modules/airflow/pages/troubleshooting/index.adoc
@@ -139,7 +139,7 @@ with DAG(
 ----
 
 Assume this DAG lies in the `dags` folder in the current directory.
-Testing this with `ruff` indicates one incompatability with Airflow 3.x and one deprecated operator:
+Testing this with `ruff` indicates one incompatibility with Airflow 3.x and one deprecated operator:
 
 [source,bash]
 ----
diff --git a/docs/modules/airflow/pages/usage-guide/mounting-dags.adoc b/docs/modules/airflow/pages/usage-guide/mounting-dags.adoc
index dfe167f7..cad1d338 100644
--- a/docs/modules/airflow/pages/usage-guide/mounting-dags.adoc
+++ b/docs/modules/airflow/pages/usage-guide/mounting-dags.adoc
@@ -27,7 +27,7 @@ include::example$example-airflow-dags-configmap.yaml[]
 [WARNING]
 --
 If a DAG mounted via ConfigMap consists of modularized files, Python uses this as a "root" directory when looking for referenced files.
-If this is the case, then either the standard DAGs location should be used, or `PYTHONPATH` should be overriden to point to the new location (it is also necessary to include the logging configuration in the path) as shown below:
+If this is the case, then either the standard DAGs location should be used, or `PYTHONPATH` should be overridden to point to the new location (it is also necessary to include the logging configuration in the path) as shown below:
 [source,yaml]
 ----
     envOverrides: &envOverrides
diff --git a/typos.toml b/typos.toml
new file mode 100644
index 00000000..367cb8a3
--- /dev/null
+++ b/typos.toml
@@ -0,0 +1,46 @@
+# Configuration for typos (https://github.com/crate-ci/typos), run via the prek
+# hook in .pre-commit-config.yaml.
+
+[files]
+# Bare `typos` skips hidden dirs by default, but prek passes explicit paths and
+# so does check them. Turn it off so both agree.
+ignore-hidden = false
+
+extend-exclude = [
+    # Ignore `.git`, which the above `ignore-hidden = false` would otherwise pull in.
+    ".git/",
+    # Generated by crate2nix (`make regenerate-nix`). Already skipped by the prek
+    # top-level `exclude`; listed here so a bare `typos` run agrees.
+    "Cargo.nix",
+    # Generated by `make regenerate-charts` from the Rust doc comments, which are
+    # checked at their source. The rest is Kubernetes' own schema documentation.
+    "extra/crds.yaml",
+]
+
+[default]
+# typos has no native suppression directive
+# (https://github.com/crate-ci/typos/issues/316), so these regexes provide one.
+# A marker must sit in a comment: after `#`, `//` or `;` (free text may follow),
+# or inside a closed `<!-- -->`, `/* */` or `{# #}` (free text may precede the
+# closer). An unterminated `typos:ignore-block-start` suppresses nothing.
+#
+# Use one of the following when the word is correct at one place but would still be a typo elsewhere:
+#
+#   # typos:ignore-line        at the end of the line it applies to
+#   # typos:ignore-next-line   on its own line, above the offending line
+#   # typos:ignore-block-start / typos:ignore-block-end   around a block
+extend-ignore-re = [
+    '(?Rm)^.*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-line\b.*|(?:<!--[ \t]*typos:ignore-line\b.*?-->|/\*[ \t]*typos:ignore-line\b.*?\*/|\{#[ \t]*typos:ignore-line\b.*?#\})[ \t]*)$',
+    '(?Rm)^[ \t]*(?:(?:#|//|;)[ \t]*typos:ignore-next-line\b.*|(?:<!--[ \t]*typos:ignore-next-line\b.*?-->|/\*[ \t]*typos:ignore-next-line\b.*?\*/|\{#[ \t]*typos:ignore-next-line\b.*?#\})[ \t]*)\r?\n.*$',
+    '(?ms)(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-block-start\b|<!--[ \t]*typos:ignore-block-start\b[^\n]*?-->|/\*[ \t]*typos:ignore-block-start\b[^\n]*?\*/|\{#[ \t]*typos:ignore-block-start\b[^\n]*?#\}).*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-block-end\b|<!--[ \t]*typos:ignore-block-end\b[^\n]*?-->|/\*[ \t]*typos:ignore-block-end\b[^\n]*?\*/|\{#[ \t]*typos:ignore-block-end\b[^\n]*?#\})',
+    # Hex suffix of a Keycloak client ID in commented-out OIDC test config.
+    'OIDC_[0-9A-F]{16}_',
+]
+
+# Before adding an entry in here, consider an in-place marker instead.
+# Every entry below gets a one-line comment saying what the word is.
+[default.extend-words]
+# Azure Kubernetes Service
+aks = "aks"
+# certifi, the Python CA bundle package that the operator appends the TLS CA to.
+certifi = "certifi"