diff --git a/.github/_typos.toml b/.github/_typos.toml
new file mode 100644
index 00000000000..b37076cc277
--- /dev/null
+++ b/.github/_typos.toml
@@ -0,0 +1,67 @@
+# Configuration for typos spell checker
+# See: https://github.com/crate-ci/typos
+#
+# Inline typos ignore comments:
+# To ignore a specific line, add a comment on the same line:
+#   var myVar = "mispeling"  // typos:disable-line
+#
+# To ignore the next line, add a comment on the line before:
+#   // typos:ignore-next-line
+#   var myVar = "mispeling"
+#
+# To ignore a block of code:
+#   // typos:off
+#   var myVar = "mispeling"
+#   var other = "anothermispeling"
+#   // typos:on
+#
+# To check only changed files (useful for local development):
+#   git diff --name-only --diff-filter=ACMR main...HEAD | typos --file-list -
+# Or check only staged files:
+#   git diff --cached --name-only | typos --file-list -
+
+[default]
+# Custom ignore patterns for inline typos comments
+extend-ignore-re = [
+  # Line ignore with trailing comment: // typos:disable-line or # typos:disable-line
+  "(?Rm)^.*(#|//)\\s*typos:disable-line$",
+  # Block ignore with typos:off/on: // typos:off ... // typos:on
+  "(?s)(#|//)\\s*typos:off.*?\\n\\s*(#|//)\\s*typos:on",
+  # Next-line ignore: // typos:ignore-next-line (ignores the following line)
+  "(#|//)\\s*typos:ignore-next-line\\n.*",
+]
+
+[default.extend-words]
+# Add custom dictionary entries here for intentional "misspellings" used in the codebase
+# Preemptable is used consistently instead of "Preemptible" for caller types
+Preemptable = "Preemptable"
+preemptable = "preemptable"
+# "ba" is a legitimate variable name in merge tests (shorthand for "b merged with a")
+ba = "ba"
+# Hash strings may contain letter combinations that look like typos
+Ue = "Ue"
+# Test data and base64 strings that contain letter combinations that look like typos
+nd = "nd"
+abd = "abd"
+# Environment variable name that must remain for backwards compatibility
+AVAILABILTY = "AVAILABILTY"
+# Proto-generated field names that have typos in the proto definition
+# These should be fixed in the proto file first, then regenerated
+Heartbeart = "Heartbeart"
+heartbeart = "heartbeart"
+
+Invoke = "Invoke"
+invoke = "invoke"
+Invokable = "Invokable"
+
+[files]
+# Exclude generated protobuf files
+extend-exclude = [
+  "*.pb.go",
+  "*.gen.go",
+  "**/testdata/**",
+  "*.svg",
+]
+
+[type.go]
+extend-glob = ["*.go"]
diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
index 4f0fa02a796..70374f49405 100644
--- a/.github/workflows/linters.yml
+++ b/.github/workflows/linters.yml
@@ -133,6 +133,28 @@ jobs:
             exit 1
           fi
 
+  typos:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get changed files
+        id: changed-files
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          git diff --name-only --diff-filter=ACMR "origin/${BASE_REF}"...HEAD | tr '\n' ' ' > changed_files.txt
+          echo "files=$(cat changed_files.txt)" >> "$GITHUB_OUTPUT"
+
+      - name: check spelling with typos on changed files
+        if: steps.changed-files.outputs.files != ''
+        uses: crate-ci/typos@v1.28.4
+        with:
+          config: .github/_typos.toml
+          files: ${{ steps.changed-files.outputs.files }}
+
   linters-succeed:
     name: All Linters Succeed
     needs:
@@ -141,6 +163,7 @@ jobs:
       - lint-actions
       - fmt-imports
       - golangci
+      - typos
     runs-on: ubuntu-latest
     if: always()
     env:
diff --git a/Makefile b/Makefile
index 5bb698e847b..b846f4dde3a 100644
--- a/Makefile
+++ b/Makefile
@@ -206,6 +206,9 @@ ACTIONLINT := $(LOCALBIN)/actionlint-$(ACTIONLINT_VER)
 $(ACTIONLINT): | $(LOCALBIN)
 	$(call go-install-tool,$(ACTIONLINT),github.com/rhysd/actionlint/cmd/actionlint,$(ACTIONLINT_VER))
 
+TYPOS_VER := v1.28.4
+TYPOS := typos
+
 WORKFLOWCHECK_VER := master # TODO: pin this specific version once 0.3.0 follow-up is released
 WORKFLOWCHECK := $(LOCALBIN)/workflowcheck-$(WORKFLOWCHECK_VER)
 $(WORKFLOWCHECK): | $(LOCALBIN)
@@ -385,7 +388,28 @@ fmt-imports: $(GCI) # Don't get confused, there is a single linter called gci, w
 	@printf $(COLOR) "Formatting imports..."
 	@$(GCI) write --skip-generated -s standard -s default ./*
 
-lint: lint-code lint-actions lint-api lint-protos
+lint-typos:
+	@printf $(COLOR) "Checking spelling with typos..."
+	@if command -v $(TYPOS) >/dev/null 2>&1; then \
+		$(TYPOS) --config .github/_typos.toml; \
+	else \
+		printf $(RED) "WARNING: typos is not installed. Install it from https://github.com/crate-ci/typos or run: cargo install typos-cli"; \
+		echo ""; \
+		echo "Skipping spell check..."; \
+	fi
+
+# Check spelling only on files changed from main branch
+lint-typos-changed:
+	@printf $(COLOR) "Checking spelling on changed files with typos..."
+	@if command -v $(TYPOS) >/dev/null 2>&1; then \
+		git diff --name-only --diff-filter=ACMR $(MAIN_BRANCH)...HEAD | $(TYPOS) --config .github/_typos.toml --file-list -; \
+	else \
+		printf $(RED) "WARNING: typos is not installed. Install it from https://github.com/crate-ci/typos or run: cargo install typos-cli"; \
+		echo ""; \
+		echo "Skipping spell check..."; \
+	fi
+
+lint: lint-code lint-actions lint-api lint-protos lint-typos-changed
 	@printf $(COLOR) "Run linters..."
 
 lint-api: $(API_LINTER) $(API_BINPB)