diff --git a/.github/workflows/container-checks.yml b/.github/workflows/container-checks.yml
new file mode 100644
index 0000000..5ae1d7f
--- /dev/null
+++ b/.github/workflows/container-checks.yml
@@ -0,0 +1,35 @@
+name: Container Checks
+
+on:
+  pull_request:
+    paths:
+      - dockerfile
+      - .dockerignore
+      - docker-compose.yml
+      - docker-compose.build.yml
+      - docker-entrypoint.sh
+      - .github/workflows/container-checks.yml
+  workflow_dispatch:
+
+concurrency:
+  group: container-checks-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check Dockerfile
+        run: docker buildx build --check -f dockerfile .
+
+      - name: Check Compose configuration
+        run: docker compose -f docker-compose.yml -f docker-compose.build.yml config --quiet
+
+      - name: Lint Dockerfile
+        run: docker run --rm -i hadolint/hadolint:v2.15.1 hadolint --failure-threshold error - < dockerfile
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 5bb3cb0..5f8439c 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -34,4 +34,99 @@ jobs:
           python -m pip install -e .[dev]
 
       - name: Run pre-commit
-        run: pre-commit run --all-files
\ No newline at end of file
+        run: pre-commit run --all-files
+
+  python-310:
+    name: Python 3.10
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e .[dev]
+
+      - name: Run tests
+        run: python -m pytest -q
+
+  repository-lint:
+    name: Actions and shell scripts
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Lint GitHub Actions workflows
+        run: docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.12
+
+      - name: Check shell scripts
+        run: |
+          git ls-files -z '*.sh' | xargs -0 --no-run-if-empty \
+            docker run --rm -v "$PWD:/mnt" -w /mnt \
+            koalaman/shellcheck:v0.11.0 --severity=error
+
+  package-smoke:
+    name: Wheel smoke test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Build wheel
+        run: |
+          python -m pip install --upgrade pip build
+          rm -rf build dist ./*.egg-info
+          python -m build --wheel
+
+      - name: Install wheel
+        run: python -m pip install dist/*.whl
+
+      - name: Verify installed package
+        run: |
+          python - <<'PY'
+          from importlib.metadata import entry_points
+          from importlib.resources import files
+
+          package = files("repeater")
+          required = (
+              "web/openapi.yaml",
+              "web/html/index.html",
+              "presets/letsmesh.yaml",
+          )
+          missing = [path for path in required if not package.joinpath(path).is_file()]
+          if missing:
+              raise SystemExit(f"Missing packaged files: {', '.join(missing)}")
+
+          scripts = {ep.name for ep in entry_points(group="console_scripts")}
+          expected = {"openhop-repeater", "pymc-cli"}
+          if missing_scripts := expected - scripts:
+              raise SystemExit(f"Missing console scripts: {', '.join(sorted(missing_scripts))}")
+          PY
+          openhop-repeater --help
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3c45797..71fa1d3 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -46,7 +46,7 @@ repos:
     hooks:
       - id: openapi-contract-check
         name: OpenAPI contract check
-        entry: python scripts/check_openapi_contract.py
+        entry: python scripts/check_openapi_contract.py --strict-methods
         language: python
         additional_dependencies: [PyYAML]
         pass_filenames: false
diff --git a/pyproject.toml b/pyproject.toml
index 3a9043d..69d7390 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,14 +11,13 @@ authors = [
 description = "PyMC Repeater Daemon"
 readme = "README.md"
 license = {text = "MIT"}
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 classifiers = [
     "Development Status :: 4 - Beta",
     "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",
     "Operating System :: POSIX :: Linux",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
@@ -79,7 +78,7 @@ repeater = [
 
 [tool.ruff]
 line-length = 100
-target-version = "py39"
+target-version = "py310"
 
 [tool.ruff.lint]
 extend-ignore = ["E701"]