diff --git a/.github/workflows/dagger-ci.yml b/.github/workflows/dagger-ci.yml
index 95e0c2b3..f988d501 100644
--- a/.github/workflows/dagger-ci.yml
+++ b/.github/workflows/dagger-ci.yml
@@ -45,41 +45,21 @@ jobs:
       - name: "Expose GitHub Runtime"
         uses: crazy-max/ghaction-github-runtime@v1
 
-      - name: Prepare dagger
-        run: |
-          make dagger
-          cp ./cmd/dagger/dagger /usr/local/bin
+      # - name: "Set up dagger from source"
+      #   run: |
+      #     make dagger
+      #     cp ./cmd/dagger/dagger /usr/local/bin
+
+      - name: "Set up dagger"
+        uses: dagger/dagger-for-github@v2
+        with:
+          install-only: true
 
       - name: Build
         env:
+          DAGGER_LOG_LEVEL: "debug"
+          DAGGER_LOG_FORMAT: "plain"
           DAGGER_CACHE_TO: "type=gha,mode=max,scope=dagger-ci-build"
           DAGGER_CACHE_FROM: "type=gha,scope=dagger-ci-build"
         run: |
           dagger do build
-
-  lint:
-    name: "Lint"
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-
-      - name: "Setup Go"
-        uses: actions/setup-go@v1
-        with:
-          go-version: 1.16
-
-      - name: "Expose GitHub Runtime"
-        uses: crazy-max/ghaction-github-runtime@v1
-
-      - name: Prepare dagger
-        run: |
-          make dagger
-          cp ./cmd/dagger/dagger /usr/local/bin
-
-      - name: Lint
-        env:
-          DAGGER_CACHE_TO: "type=gha,mode=max,scope=dagger-ci-lint"
-          DAGGER_CACHE_FROM: "type=gha,scope=dagger-ci-lint"
-        run: |
-          dagger do lint
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 409dc019..29ff4db4 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,27 +4,27 @@ on:
   push:
     branches: [main]
     paths:
-      - '**.go'
-      - '**.sh'
-      - '**.bash'
-      - '**.cue'
-      - 'docs/**'
-      - '.golangci.yml'
-      - 'Makefile'
-      - 'README.md'
-      - '.github/workflows/lint.yml'
+      - "**.go"
+      - "**.sh"
+      - "**.bash"
+      - "**.cue"
+      - "docs/**"
+      - ".golangci.yml"
+      - "Makefile"
+      - "README.md"
+      - ".github/workflows/lint.yml"
   pull_request:
     branches: [main]
     paths:
-      - '**.go'
-      - '**.sh'
-      - '**.bash'
-      - '**.cue'
-      - 'docs/**'
-      - '.golangci.yml'
-      - 'Makefile'
-      - 'README.md'
-      - '.github/workflows/lint.yml'
+      - "**.go"
+      - "**.sh"
+      - "**.bash"
+      - "**.cue"
+      - "docs/**"
+      - ".golangci.yml"
+      - "Makefile"
+      - "README.md"
+      - ".github/workflows/lint.yml"
 
 jobs:
   lint:
@@ -41,35 +41,24 @@ jobs:
         with:
           go-version: 1.16
 
-      - name: "Install deps"
-        run: |
-          # Cue
-          export CUE_VERSION="$(grep cue ./go.mod | cut -d' ' -f2 | head -1 | sed -E 's/\.[[:digit:]]\.[[:alnum:]]+-[[:alnum:]]+$//')"
-          export CUE_TARBALL="cue_${CUE_VERSION}_linux_amd64.tar.gz"
-          echo "Installing cue version $CUE_VERSION"
-          curl -L https://github.com/cue-lang/cue/releases/download/${CUE_VERSION}/${CUE_TARBALL} | sudo tar zxf - -C /usr/local/bin
+      - name: "Expose GitHub Runtime"
+        uses: crazy-max/ghaction-github-runtime@v1
 
-      - name: "Lint go"
-        uses: golangci/golangci-lint-action@v2
+      # - name: "Set up dagger from source"
+      #   run: |
+      #     make dagger
+      #     cp ./cmd/dagger/dagger /usr/local/bin
+
+      - name: "Set up dagger"
+        uses: dagger/dagger-for-github@v2
         with:
-          version: v1.45
-          skip-go-installation: true
-          args: --timeout=3m
+          install-only: true
 
-      - name: "Lint shell"
+      - name: Lint
+        env:
+          DAGGER_LOG_LEVEL: "debug"
+          DAGGER_LOG_FORMAT: "plain"
+          DAGGER_CACHE_TO: "type=gha,mode=max,scope=dagger-ci-lint"
+          DAGGER_CACHE_FROM: "type=gha,scope=dagger-ci-lint"
         run: |
-          make shellcheck
-
-      - name: "Lint CUE"
-        run: |
-          make cuelint
-
-      - name: "Lint docs"
-        run: |
-          make docslint
-
-      - name: "Lint markdown"
-        uses: avto-dev/markdown-lint@v1
-        with:
-          config: ".markdownlint.yaml"
-          args: ./docs README.md
+          dagger do lint
diff --git a/Makefile b/Makefile
index 31d3d09b..f936b8d8 100644
--- a/Makefile
+++ b/Makefile
@@ -33,23 +33,24 @@ test: # Run all tests
 	go test -race -v ./...
 
 .PHONY: golint
-golint: # Go lint
-	golangci-lint run --timeout 3m
+golint: dagger # Go lint
+	./cmd/dagger/dagger do lint go
 
 .PHONY: cuefmt
 cuefmt: # Format all cue files
 	find . -name '*.cue' -not -path '*/cue.mod/*' -print | time xargs -n 1 -P 8 cue fmt -s
 
 .PHONY: cuelint
-cuelint: cuefmt # Lint and format all cue files
-	@test -z "$$(git status -s . | grep -e "^ M"  | grep "\.cue" | cut -d ' ' -f3 | tee /dev/stderr)"
+cuelint: dagger # Lint all cue files
+	./cmd/dagger/dagger do lint cue
 
 .PHONY: shellcheck
-shellcheck: # Run shellcheck
-	shellcheck $$(find . -type f \( -iname \*.bats -o -iname \*.bash -o -iname \*.sh \) -not -path "*/node_modules/*" -not -path "*/bats-*/*")
+shellcheck: dagger # Run shellcheck
+	./cmd/dagger/dagger do lint shell
 
 .PHONY: lint
-lint: shellcheck cuelint golint docslint mdlint # Lint everything
+lint: dagger # Lint everything
+	./cmd/dagger/dagger do lint
 
 .PHONY: integration
 integration: core-integration universe-test doc-test # Run all integration tests
@@ -78,10 +79,6 @@ doc-test: dagger-debug # Test docs
 docs: dagger # Generate docs
 	DAGGER_TELEMETRY_DISABLE=1 ./cmd/dagger/dagger doc --output ./docs/reference --format md
 
-.PHONY: docslint
-docslint: docs # Generate & lint docs
-	@test -z "$$(git status -s . | grep -e "^ M"  | grep docs/reference | cut -d ' ' -f3 | tee /dev/stderr)"
-
 .PHONY: mdlint
 mdlint: # Markdown lint for web
 	@markdownlint ./docs README.md
diff --git a/ci.cue b/ci.cue
index 4474d0f5..172edbf9 100644
--- a/ci.cue
+++ b/ci.cue
@@ -5,12 +5,12 @@ import (
 
 	"universe.dagger.io/bash"
 	"universe.dagger.io/alpine"
-	"universe.dagger.io/docker"
 	"universe.dagger.io/go"
 
 	"github.com/dagger/dagger/ci/golangci"
 	"github.com/dagger/dagger/ci/shellcheck"
 	"github.com/dagger/dagger/ci/markdownlint"
+	"github.com/dagger/dagger/ci/cue"
 )
 
 dagger.#Plan & {
@@ -102,48 +102,8 @@ dagger.#Plan & {
 				files: ["./docs", "README.md"]
 			}
 
-			cue: docker.#Build & {
-				// FIXME: spin off into its own package?
-				steps: [
-					alpine.#Build & {
-						packages: bash: _
-						packages: curl: _
-						packages: git:  _
-					},
-
-					docker.#Copy & {
-						contents: _source
-						source:   "go.mod"
-						dest:     "go.mod"
-					},
-
-					// Install CUE
-					bash.#Run & {
-						script: contents: #"""
-								export CUE_VERSION="$(grep cue ./go.mod | cut -d' ' -f2 | head -1 | sed -E 's/\.[[:digit:]]\.[[:alnum:]]+-[[:alnum:]]+$//')"
-								export CUE_TARBALL="cue_${CUE_VERSION}_linux_amd64.tar.gz"
-								echo "Installing cue version $CUE_VERSION"
-								curl -L "https://github.com/cue-lang/cue/releases/download/${CUE_VERSION}/${CUE_TARBALL}" | tar zxf - -C /usr/local/bin
-								cue version
-						"""#
-					},
-
-					// CACHE: copy only *.cue files
-					docker.#Copy & {
-						contents: _source
-						include: ["*.cue"]
-						dest: "/cue"
-					},
-
-					// LINT
-					bash.#Run & {
-						workdir: "/cue"
-						script: contents: #"""
-							find . -name '*.cue' -not -path '*/cue.mod/*' -print | time xargs -t -n 1 -P 8 cue fmt -s
-							test -z "$(git status -s . | grep -e "^ M"  | grep "\.cue" | cut -d ' ' -f3 | tee /dev/stderr)"
-							"""#
-					},
-				]
+			"cue": cue.#Lint & {
+				source: _source
 			}
 		}
 	}
diff --git a/ci/cue/lint.cue b/ci/cue/lint.cue
new file mode 100644
index 00000000..cdda6987
--- /dev/null
+++ b/ci/cue/lint.cue
@@ -0,0 +1,56 @@
+package cue
+
+import (
+	"dagger.io/dagger"
+
+	"universe.dagger.io/alpine"
+	"universe.dagger.io/docker"
+	"universe.dagger.io/bash"
+)
+
+#Lint: {
+	source: dagger.#FS
+
+	docker.#Build & {
+		steps: [
+			alpine.#Build & {
+				packages: bash: _
+				packages: curl: _
+				packages: git:  _
+			},
+
+			docker.#Copy & {
+				contents: source
+				"source": "go.mod"
+				dest:     "go.mod"
+			},
+
+			// Install CUE
+			bash.#Run & {
+				script: contents: #"""
+					        export CUE_VERSION="$(grep cue ./go.mod | cut -d' ' -f2 | head -1 | sed -E 's/\.[[:digit:]]\.[[:alnum:]]+-[[:alnum:]]+$//')"
+					        export CUE_TARBALL="cue_${CUE_VERSION}_linux_amd64.tar.gz"
+					        echo "Installing cue version $CUE_VERSION"
+					        curl -L "https://github.com/cue-lang/cue/releases/download/${CUE_VERSION}/${CUE_TARBALL}" | tar zxf - -C /usr/local/bin
+					        cue version
+					"""#
+			},
+
+			// CACHE: copy only *.cue files
+			docker.#Copy & {
+				contents: source
+				include: ["*.cue"]
+				dest: "/cue"
+			},
+
+			// LINT
+			bash.#Run & {
+				workdir: "/cue"
+				script: contents: #"""
+					find . -name '*.cue' -not -path '*/cue.mod/*' -print | time xargs -t -n 1 -P 8 cue fmt -s
+					test -z "$(git status -s . | grep -e "^ M"  | grep "\.cue" | cut -d ' ' -f3 | tee /dev/stderr)"
+					"""#
+			},
+		]
+	}
+}
diff --git a/ci/golangci/lint.cue b/ci/golangci/lint.cue
index 32008ff5..88ec64c0 100644
--- a/ci/golangci/lint.cue
+++ b/ci/golangci/lint.cue
@@ -22,7 +22,7 @@ import (
 		source: "golangci/golangci-lint:v\(version)"
 	}
 
-	container: go.#Container & {
+	go.#Container & {
 		"source": source
 		input:    _image.output
 		command: {
diff --git a/ci/markdownlint/markdownlint.cue b/ci/markdownlint/markdownlint.cue
index 02043a3b..12c14387 100644
--- a/ci/markdownlint/markdownlint.cue
+++ b/ci/markdownlint/markdownlint.cue
@@ -20,7 +20,7 @@ import (
 		source: "tmknom/markdownlint:\(version)"
 	}
 
-	container: docker.#Run & {
+	docker.#Run & {
 		input: _image.output
 		mounts: "source": {
 			dest:     "/src"
diff --git a/ci/shellcheck/shellcheck.cue b/ci/shellcheck/shellcheck.cue
index b11bf62c..f031a579 100644
--- a/ci/shellcheck/shellcheck.cue
+++ b/ci/shellcheck/shellcheck.cue
@@ -17,7 +17,7 @@ import (
 		source: "koalaman/shellcheck-alpine:v\(version)"
 	}
 
-	container: docker.#Run & {
+	docker.#Run & {
 		input: _image.output
 		mounts: "source": {
 			dest:     "/src"