diff --git a/.github/workflows/code-checkers.yml b/.github/workflows/code-checkers.yml
index 369fe0f35..a188d23ac 100644
--- a/.github/workflows/code-checkers.yml
+++ b/.github/workflows/code-checkers.yml
@@ -8,6 +8,24 @@ env:
   PREK_COLOR: "always"
 
 jobs:
+  whitespace:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/uv-setup
+      - run: prek -a trailing-whitespace end-of-file-fixer
+
+  executables:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/uv-setup
+      - run: prek -a check-shebang-scripts-are-executable check-executables-have-shebangs
+
   mypy:
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index cf7ee8d2a..5f7a6d67a 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -18,4 +18,4 @@ jobs:
       - uses: ./.github/actions/uv-setup
       - run: zizmor --color=always .
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} 
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d6f4b08d7..b5c62e226 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,4 +1,14 @@
 repos:
+  - repo: builtin
+    hooks:
+      # Trim trailing whitespace
+      - id: trailing-whitespace
+      # Ensure newline at EOF
+      - id: end-of-file-fixer
+      # Ensures that (non-binary) files with a shebang are executable
+      - id: check-shebang-scripts-are-executable
+      # Ensures that (non-binary) executables have a shebang
+      - id: check-executables-have-shebangs
   - repo: local
     hooks:
       - id: "ruff"
diff --git a/pyproject.toml b/pyproject.toml
index 5cf1942ce..3c635a3a3 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -82,7 +82,7 @@ ignore = [
 pydocstyle.convention = "pep257"
 
 [tool.ruff.lint.extend-per-file-ignores]
-# Pytest fixtures are often flagged as unused imports (F401) or 
+# Pytest fixtures are often flagged as unused imports (F401) or
 # redefined variables (F811) because they are injected by name.
 "tests/**/*.py" = [
   "F401",  # F401 unused-import
diff --git a/scripts/install_xcpng.py b/scripts/install_xcpng.py
index d2be716a4..908f95178 100755
--- a/scripts/install_xcpng.py
+++ b/scripts/install_xcpng.py
@@ -1,6 +1,6 @@
+#!/usr/bin/env python3
 from __future__ import annotations
 
-#!/usr/bin/env python3
 import argparse
 import atexit
 import logging
diff --git a/tests/install/README.md b/tests/install/README.md
index 46003bd63..adf6582ba 100644
--- a/tests/install/README.md
+++ b/tests/install/README.md
@@ -68,7 +68,7 @@ The above command instructs `pytest` to:
 * run the test sequences as defined by the specified `.lst` files
   (which were specially written to chain an installation, an upgrade
   to same version, and a restore, all using a single nightly image)
-* specify 
+* specify
 * to save detailed logs in a file, while during execution only
   high-level progress messages are shown to avoid flooding
 
diff --git a/tests/storage/zfs/test_zfs_sr.py b/tests/storage/zfs/test_zfs_sr.py
old mode 100755
new mode 100644
diff --git a/tests/storage/zfsvol/test_zfsvol_sr.py b/tests/storage/zfsvol/test_zfsvol_sr.py
old mode 100755
new mode 100644