diff --git a/.github/workflows/yamllint.yaml b/.github/workflows/yamllint.yaml
new file mode 100644
index 00000000..c2869de1
--- /dev/null
+++ b/.github/workflows/yamllint.yaml
@@ -0,0 +1,18 @@
+---
+name: Yamllint
+on: [pull_request]
+jobs:
+  yamllint:
+    name: Yamllint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@master
+      - name: Yamllint
+        uses: karancode/yamllint-github-action@master
+        with:
+          yamllint_strict: false
+          yamllint_config_filepath: .yamllint.yml
+          yamllint_comment: true
+        env:
+          GITHUB_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.yamlfix.toml b/.yamlfix.toml
new file mode 100644
index 00000000..bd9eb776
--- /dev/null
+++ b/.yamlfix.toml
@@ -0,0 +1,5 @@
+# base.toml
+allow_duplicate_keys = false
+line_length = 100
+preserve_quotes = true
+sequence_style = "block_style"
diff --git a/.yamllint.yml b/.yamllint.yml
new file mode 100644
index 00000000..52d25639
--- /dev/null
+++ b/.yamllint.yml
@@ -0,0 +1,11 @@
+---
+extends: default
+rules:
+  comments: enable
+  line-length: disable
+  empty-lines: disable
+ignore: |-
+  .git
+  .tox
+  secrets.yml
+  secrets-*.yml
diff --git a/Makefile b/Makefile
index 9ec35491..7d49820b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,6 @@
 venv = . venv/bin/activate
 export PATH := ${PATH}:${PWD}/venv/bin
+basedir = ${PWD}
 
 VAULTPASS_FILE ?= ${PWD}/secrets/vaultpass
 
@@ -29,6 +30,23 @@ venv/bin/activate: Makefile requirements.txt
 	@${venv} && pip3 install -r requirements.txt
 	touch venv/bin/activate
 
+#################################################
+### EXPERIMENTAL, yamlfix is still very broken
+
+.PHONY: lint-check
+lint-check: deps
+	$(MAKE) lint-fix DO_CHECK="--check"
+
+# Just for testing, currently yamllint seems to be broken
+.PHONY: lint-fix
+lint-fix: deps
+	${venv} && find . -type f \( -not -path "misc/node-images/node-image/*" -and -not -path "*/.venv/*" -and -not -path "*/venv/*" -regex ".*\.ya?ml" \) \
+		-print \
+		-exec yamlfix --verbose ${DO_CHECK} --config-file ${basedir}/.yamlfix.toml {} \;
+
+### EXPERIMENTAL
+#################################################
+
 .PHONY: deps
 sync: deps
 	@[ "${BRANCH}" ] && sed -i -e "s/version: .*/version: ${BRANCH}/" gilt.yml || exit 0
@@ -110,3 +128,4 @@ endif
 .PHONY: ansible_vault_encrypt_string
 ansible_vault_encrypt_string: deps check_vault_pass
 		@${venv} && ansible-vault encrypt_string --vault-password-file ${VAULTPASS_FILE}
+