diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 85e824d0..0837ede9 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -5,6 +5,16 @@ default_language_version:
   node: system
 
 repos:
+  - repo: https://github.com/crate-ci/typos
+    rev: 00f422f3b19c57bc6338715ebfe3316d38768461  # v1.50.3
+    hooks:
+      - id: typos
+        # Drop the upstream default `--write-changes` so the hook only
+        # reports failures instead of writing changes.
+        # Keep `--force-exclude` so the excludes in typos.toml still
+        # apply to the paths prek passes in.
+        args: ["--force-exclude"]
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # 6.0.0
     hooks:
diff --git a/README.md b/README.md
index 9972f105..af5297a6 100644
--- a/README.md
+++ b/README.md
@@ -65,6 +65,70 @@ These are the only variables currently being used on the playbooks, but can be e
 
 Additional settings can be found in `playbook/group_vars/all`, but these are not intended to be freely changed and should be treated with care.
 
+## Spell checking
+
+Every managed repository runs [typos](https://github.com/crate-ci/typos) as a prek hook.
+The hook is templated in `template/.pre-commit-config.yaml.j2`.
+The word lists are **not** templated: each repository has its own `typos.toml`, because typos has no layered configuration yet ([crate-ci/typos#193](https://github.com/crate-ci/typos/issues/193)).
+Keeping the word lists local also means adding a word is a PR per repository instead of a templating run.
+Files rendered from `template/` are checked in this repository once.
+
+### The core config
+
+As a convention, new repositories should start from this block and add only what they actually need.
+
+```toml
+# Configuration for typos (https://github.com/crate-ci/typos), run via the prek
+# hook in .pre-commit-config.yaml.
+#
+# Before adding an entry here, consider an in-place marker instead. Use one when
+# the word is correct at this one site and would still be a typo elsewhere:
+#
+#   # typos:ignore-line        at the end of the line it applies to
+#   # typos:ignore-next-line   on its own line, above the offending line
+#   # typos:off / typos:on     around a block
+#
+# Every entry below gets a one-line comment saying what the word is.
+
+[files]
+# Bare `typos` skips hidden dirs by default, but prek passes explicit paths and
+# so does check them. Turn it off so both agree.
+ignore-hidden = false
+
+extend-exclude = [
+    # `.git` itself, which ignore-hidden = false would otherwise pull in.
+    ".git/",
+    # Generated by `make regenerate-nix` (crate2nix). Contains vendored crate
+    # metadata and hashes.
+    "Cargo.nix",
+    # Generated by `make crds`. Most of the content is Kubernetes' own schema
+    # documentation, which is not ours to correct, and the doc comments we do
+    # own are already checked at their source in rust/operator-binary/src/crd/.
+    "extra/crds.yaml",
+]
+
+[default]
+# typos has no native suppression directive
+# (https://github.com/crate-ci/typos/issues/316), so these regexes provide one.
+# A marker must sit in a comment: after `#`, `//` or `;` (free text may follow),
+# or inside a closed `<!-- -->`, `/* */` or `{# #}` (free text may precede the
+# closer). An unterminated `typos:off` suppresses nothing.
+extend-ignore-re = [
+    '(?Rm)^.*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-line\b.*|(?:<!--[ \t]*typos:ignore-line\b.*?-->|/\*[ \t]*typos:ignore-line\b.*?\*/|\{#[ \t]*typos:ignore-line\b.*?#\})[ \t]*)$',
+    '(?Rm)^[ \t]*(?:(?:#|//|;)[ \t]*typos:ignore-next-line\b.*|(?:<!--[ \t]*typos:ignore-next-line\b.*?-->|/\*[ \t]*typos:ignore-next-line\b.*?\*/|\{#[ \t]*typos:ignore-next-line\b.*?#\})[ \t]*)\r?\n.*$',
+    '(?ms)(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:off\b|<!--[ \t]*typos:off\b[^\n]*?-->|/\*[ \t]*typos:off\b[^\n]*?\*/|\{#[ \t]*typos:off\b[^\n]*?#\}).*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:on\b|<!--[ \t]*typos:on\b[^\n]*?-->|/\*[ \t]*typos:on\b[^\n]*?\*/|\{#[ \t]*typos:on\b[^\n]*?#\})',
+]
+
+[default.extend-words]
+# Azure Kubernetes Service
+aks = "aks"
+```
+
+### Conventions
+
+- Every entry in a `typos.toml` gets a one-line comment saying what the word is.
+- Prefer an in-place marker over a config entry when the word is correct at one site and would still be a typo elsewhere
+
 ## Making changes to the template
 
 If you want to make a change that should be rolled out to all operators, make the change in the `template` directory.
diff --git a/template/.pre-commit-config.yaml.j2 b/template/.pre-commit-config.yaml.j2
index e3883985..9f0db8ce 100644
--- a/template/.pre-commit-config.yaml.j2
+++ b/template/.pre-commit-config.yaml.j2
@@ -7,6 +7,19 @@ default_language_version:
   node: system
 
 repos:
+  # The word lists live in a per-repo `typos.toml`, which is not templated.
+  # typos has no layered configuration (https://github.com/crate-ci/typos/issues/193).
+  # A templated config can currently not be extended locally.
+  - repo: https://github.com/crate-ci/typos
+    rev: 00f422f3b19c57bc6338715ebfe3316d38768461  # v1.50.3
+    hooks:
+      - id: typos
+        # Drop the upstream default `--write-changes` so the hook only
+        # reports failures instead of writing changes.
+        # Keep `--force-exclude` so the excludes in typos.toml still
+        # apply to the paths prek passes in.
+        args: ["--force-exclude"]
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # 6.0.0
     hooks:
diff --git a/typos.toml b/typos.toml
new file mode 100644
index 00000000..80c0516e
--- /dev/null
+++ b/typos.toml
@@ -0,0 +1,37 @@
+# Configuration for typos (https://github.com/crate-ci/typos), run via the prek
+# hook in .pre-commit-config.yaml.
+#
+# Before adding an entry here, consider an in-place marker instead. Use one when
+# the word is correct at this one site and would still be a typo elsewhere:
+#
+#   # typos:ignore-line        at the end of the line it applies to
+#   # typos:ignore-next-line   on its own line, above the offending line
+#   # typos:off / typos:on     around a block
+#
+# Every entry below gets a one-line comment saying what the word is.
+
+[files]
+# Bare `typos` skips hidden dirs by default, but prek passes explicit paths and
+# so does check them. Turn it off so both agree.
+ignore-hidden = false
+
+extend-exclude = [
+    # `.git` itself, which ignore-hidden = false would otherwise pull in.
+    ".git/",
+]
+
+[default]
+# typos has no native suppression directive
+# (https://github.com/crate-ci/typos/issues/316), so these regexes provide one.
+# A marker must sit in a comment: after `#`, `//` or `;` (free text may follow),
+# or inside a closed `<!-- -->`, `/* */` or `{# #}` (free text may precede the
+# closer). An unterminated `typos:off` suppresses nothing.
+extend-ignore-re = [
+    '(?Rm)^.*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-line\b.*|(?:<!--[ \t]*typos:ignore-line\b.*?-->|/\*[ \t]*typos:ignore-line\b.*?\*/|\{#[ \t]*typos:ignore-line\b.*?#\})[ \t]*)$',
+    '(?Rm)^[ \t]*(?:(?:#|//|;)[ \t]*typos:ignore-next-line\b.*|(?:<!--[ \t]*typos:ignore-next-line\b.*?-->|/\*[ \t]*typos:ignore-next-line\b.*?\*/|\{#[ \t]*typos:ignore-next-line\b.*?#\})[ \t]*)\r?\n.*$',
+    '(?ms)(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:off\b|<!--[ \t]*typos:off\b[^\n]*?-->|/\*[ \t]*typos:off\b[^\n]*?\*/|\{#[ \t]*typos:off\b[^\n]*?#\}).*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:on\b|<!--[ \t]*typos:on\b[^\n]*?-->|/\*[ \t]*typos:on\b[^\n]*?\*/|\{#[ \t]*typos:on\b[^\n]*?#\})',
+]
+
+[default.extend-words]
+# Azure Kubernetes Service
+aks = "aks"