diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a500f9fa..c3cc3b74 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -19,6 +19,7 @@ jobs:
       uses: actions/setup-go@v5
       with:
         go-version: '1.25.7'
+        cache: true
 
     - name: Test source code
       run:  script/test-source
@@ -49,3 +50,40 @@ jobs:
       with:
         name: orchestrator
         path: bin/orchestrator
+
+  lint:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: '1.25.7'
+        cache: true
+
+    - name: Run golangci-lint
+      uses: golangci/golangci-lint-action@v6
+      with:
+        version: v1.64.8
+
+  security:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: '1.25.7'
+        cache: true
+
+    - name: Install govulncheck
+      run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
+
+    - name: Run govulncheck
+      run: govulncheck ./...
diff --git a/.github/workflows/system.yml b/.github/workflows/system.yml
index 931151a6..f7050a08 100644
--- a/.github/workflows/system.yml
+++ b/.github/workflows/system.yml
@@ -12,13 +12,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+    - name: check out
+      uses: actions/checkout@v4
+
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
         go-version: '1.25.7'
-
-    - name: check out
-      uses: actions/checkout@v4
+        cache: true
 
     - name: build
       run:  script/test-build
diff --git a/.github/workflows/upgrade.yml b/.github/workflows/upgrade.yml
index 3fd16cbe..fcdf675d 100644
--- a/.github/workflows/upgrade.yml
+++ b/.github/workflows/upgrade.yml
@@ -11,17 +11,18 @@ jobs:
     #     backend: [sqlite, MySQL]
 
     steps:
+    - name: check out
+      uses: actions/checkout@v4
+
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
         go-version: '1.25.7'
+        cache: true
 
     - name: Start local MySQL
       run: sudo /etc/init.d/mysql start
 
-    - name: check out
-      uses: actions/checkout@v4
-
     - name: copy config file template
       run: |
         cp conf/orchestrator-ci-upgrade.conf.json /tmp