diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 74002636..842399b1 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -7,6 +7,19 @@ default_language_version:
   node: system
 
 repos:
+  # The word lists live in a per-repo `typos.toml`, which is not templated.
+  # typos has no layered configuration (https://github.com/crate-ci/typos/issues/193).
+  # A templated config can currently not be extended locally.
+  - repo: https://github.com/crate-ci/typos
+    rev: 00f422f3b19c57bc6338715ebfe3316d38768461  # v1.50.3
+    hooks:
+      - id: typos
+        # Drop the upstream default `--write-changes` so the hook only
+        # reports failures instead of writing changes.
+        # Keep `--force-exclude` so the excludes in typos.toml still
+        # apply to the paths prek passes in.
+        args: ["--force-exclude"]
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # 6.0.0
     hooks:
diff --git a/docs/modules/listener-operator/pages/installation.adoc b/docs/modules/listener-operator/pages/installation.adoc
index 861dd77e..3489af51 100644
--- a/docs/modules/listener-operator/pages/installation.adoc
+++ b/docs/modules/listener-operator/pages/installation.adoc
@@ -33,7 +33,7 @@ Use the following decision tree to decide on the ListenerClass preset to use:
 ....
 flowchart LR
     LB{LoadBalancer supported?}
-    LB -->|yes| ephermal-nodes[Use ephermal-nodes]
+    LB -->|yes| ephemeral-nodes[Use ephemeral-nodes]
     LB -->|no| node-rotation{Nodes regularly rotated?}
 
     node-rotation -->|yes| complicated[Use stable-nodes to prefer NodePort<br> over LoadBalancers.<br> However, don't use the<br> external-stable ListenerClass at all,<br> use external-unstable instead]
diff --git a/scripts/generate-olm.py b/scripts/generate-olm.py
index 39ded042..d1203098 100755
--- a/scripts/generate-olm.py
+++ b/scripts/generate-olm.py
@@ -45,6 +45,7 @@
 }
 
 # Stackable logo icon (PNG, base64-encoded). Sourced from the 25.11.0 OLM bundle.
+# typos:ignore-block-start
 _STACKABLE_ICON_B64 = (
     "iVBORw0KGgoAAAANSUhEUgAABCQAAAQ3CAYAAAAg1L88AAAACXBIWXMAABcRAAAXEQHKJvM/AAAg"
     "AElEQVR4nOzdT2ycZ4Ln95c09YdqW5SsluWxvSDdA3m7G2iIyCEBFsFaM0DqKt820WW8OSUGAhh7"
@@ -942,6 +943,7 @@
     "EgAAAEB0ggQAAAAQnSABAAAARCdIAAAAANEJEgAAAEB0ggQAAAAQnSABAAAARCdIAAAAANEJEgAA"
     "AEB0ggQAAAAQnSABAAAARCdIAAAAANEJEgAAAEBcSZL8f1HQsc8tcXUVAAAAAElFTkSuQmCC"
 )
+# typos:ignore-block-end
 
 # Permissions required by the olm-deployer service account (the bootstrap Deployment).
 # This account applies the ConfigMap manifests (DaemonSet, Deployment, CSIDriver, etc.).
diff --git a/typos.toml b/typos.toml
new file mode 100644
index 00000000..bda45448
--- /dev/null
+++ b/typos.toml
@@ -0,0 +1,42 @@
+# Configuration for typos (https://github.com/crate-ci/typos), run via the prek
+# hook in .pre-commit-config.yaml.
+
+[files]
+# Bare `typos` skips hidden dirs by default, but prek passes explicit paths and
+# so does check them. Turn it off so both agree.
+ignore-hidden = false
+
+extend-exclude = [
+    # Ignore `.git`, which the above `ignore-hidden = false` would otherwise pull in.
+    ".git/",
+    # Generated by crate2nix (`make regenerate-nix`). Already skipped by the prek
+    # top-level `exclude`; listed here so a bare `typos` run agrees.
+    "Cargo.nix",
+    # Generated by `make regenerate-charts` from the Rust doc comments, which are
+    # checked at their source. The rest is Kubernetes' own schema documentation.
+    "extra/crds.yaml",
+]
+
+[default]
+# typos has no native suppression directive
+# (https://github.com/crate-ci/typos/issues/316), so these regexes provide one.
+# A marker must sit in a comment: after `#`, `//` or `;` (free text may follow),
+# or inside a closed `<!-- -->`, `/* */` or `{# #}` (free text may precede the
+# closer). An unterminated `typos:ignore-block-start` suppresses nothing.
+#
+# Use one of the following when the word is correct at one place but would still be a typo elsewhere:
+#
+#   # typos:ignore-line        at the end of the line it applies to
+#   # typos:ignore-next-line   on its own line, above the offending line
+#   # typos:ignore-block-start / typos:ignore-block-end   around a block
+extend-ignore-re = [
+    '(?Rm)^.*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-line\b.*|(?:<!--[ \t]*typos:ignore-line\b.*?-->|/\*[ \t]*typos:ignore-line\b.*?\*/|\{#[ \t]*typos:ignore-line\b.*?#\})[ \t]*)$',
+    '(?Rm)^[ \t]*(?:(?:#|//|;)[ \t]*typos:ignore-next-line\b.*|(?:<!--[ \t]*typos:ignore-next-line\b.*?-->|/\*[ \t]*typos:ignore-next-line\b.*?\*/|\{#[ \t]*typos:ignore-next-line\b.*?#\})[ \t]*)\r?\n.*$',
+    '(?ms)(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-block-start\b|<!--[ \t]*typos:ignore-block-start\b[^\n]*?-->|/\*[ \t]*typos:ignore-block-start\b[^\n]*?\*/|\{#[ \t]*typos:ignore-block-start\b[^\n]*?#\}).*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-block-end\b|<!--[ \t]*typos:ignore-block-end\b[^\n]*?-->|/\*[ \t]*typos:ignore-block-end\b[^\n]*?\*/|\{#[ \t]*typos:ignore-block-end\b[^\n]*?#\})',
+]
+
+# Before adding an entry in here, consider an in-place marker instead.
+# Every entry below gets a one-line comment saying what the word is.
+[default.extend-words]
+# Azure Kubernetes Service
+aks = "aks"