diff --git a/Makefile b/Makefile
index e41946b..86fe21b 100644
--- a/Makefile
+++ b/Makefile
@@ -6,19 +6,42 @@ GIT_REVISION_SHORT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "un
 VERSION_PKG := git.eeqj.de/sneak/routewatch/internal/version
 LDFLAGS := -X $(VERSION_PKG).GitRevision=$(GIT_REVISION) -X $(VERSION_PKG).GitRevisionShort=$(GIT_REVISION_SHORT)
 
-.PHONY: test fmt lint build clean run asupdate
+.PHONY: bootstrap setup check test lint fmt fmt-check docker hooks build clean run asupdate
 
 all: test
 
-test: lint
-	go test -v ./...
+# Install all development dependencies.
+bootstrap:
+	@script/bootstrap
+
+# Prepare a fresh clone: bootstrap plus pre-commit hook.
+setup:
+	@script/setup
+
+# Combined pre-commit/CI gate: tests, lint, format check.
+check:
+	@script/check
+
+test:
+	@script/test
 
 fmt:
-	go fmt ./...
+	@script/fmt
+
+# Check if code is formatted (read-only).
+fmt-check:
+	@script/fmt-check
 
 lint:
-	go vet ./...
-	golangci-lint run
+	@script/lint
+
+# Build Docker image.
+docker:
+	@script/docker
+
+# Install pre-commit hook.
+hooks:
+	@script/install-precommit
 
 build:
 	CGO_ENABLED=1 go build -ldflags "$(LDFLAGS)" -o bin/routewatch cmd/routewatch/main.go
diff --git a/README.md b/README.md
index bed4003..ccf2218 100644
--- a/README.md
+++ b/README.md
@@ -189,6 +189,35 @@ make lint
 make
 ```
 
+## Entrypoints
+
+This repository adheres to the
+[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+standard: normalized scripts in `script/` are the entrypoints for the
+development workflow, and the Makefile targets are thin shims that call
+them. We provide:
+
+- `script/bootstrap` — install all development dependencies (go,
+  golangci-lint, Go module download)
+- `script/setup` — make a fresh clone ready for development: runs
+  `script/bootstrap`, then `script/install-precommit`
+- `script/projectname` — print the project name (used for the Docker
+  image tag)
+- `script/test` — run the test suite
+  (`go test -timeout 30s -race -cover ./...`, verbose rerun on failure)
+- `script/lint` — run `go vet ./...` and `golangci-lint run`
+- `script/fmt` — format all code (writes)
+- `script/fmt-check` — check formatting (read-only)
+- `script/check` — run `script/test`, `script/lint`, and
+  `script/fmt-check`
+- `script/docker` — build the Docker image tagged via
+  `script/projectname`
+- `script/cibuild` — CI entrypoint: `docker build .`
+- `script/precommit` — pre-commit gate: `go mod tidy` + `go fmt` (must
+  not change files), then `script/check`
+- `script/install-precommit` — install the git pre-commit hook that
+  runs `script/precommit`
+
 ## License
 
 See LICENSE file.
diff --git a/TODO.md b/TODO.md
index b7c28aa..e4df8b9 100644
--- a/TODO.md
+++ b/TODO.md
@@ -23,6 +23,8 @@ runs make check on main.
 
 # Completed Steps
 
+- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
+  Makefile shims, README Entrypoints section
 - 2026-02-22: repo policy compliance: required policy files, .gitignore
   update, Makefile fmt-check/check/docker/hooks targets, gofmt pass
   (repo-policies-compliance, unmerged)
diff --git a/internal/routewatch/asnfetcher.go b/internal/routewatch/asnfetcher.go
index 8f1d5b6..7a0b246 100644
--- a/internal/routewatch/asnfetcher.go
+++ b/internal/routewatch/asnfetcher.go
@@ -36,7 +36,6 @@ const (
 	statsWindow = time.Hour
 )
 
-
 // ASNFetcher handles background WHOIS lookups for ASNs.
 type ASNFetcher struct {
 	db             database.Store
@@ -55,9 +54,9 @@ type ASNFetcher struct {
 	consecutiveFails int
 
 	// hourly stats tracking
-	statsMu        sync.Mutex
-	successTimes   []time.Time
-	errorTimes     []time.Time
+	statsMu      sync.Mutex
+	successTimes []time.Time
+	errorTimes   []time.Time
 }
 
 // NewASNFetcher creates a new ASN fetcher.
diff --git a/internal/server/handlers.go b/internal/server/handlers.go
index 9ca8195..98ff6b2 100644
--- a/internal/server/handlers.go
+++ b/internal/server/handlers.go
@@ -330,19 +330,19 @@ func (s *Server) handleStats() http.HandlerFunc {
 
 	// GCStats represents garbage collection statistics
 	type GCStats struct {
-		NumGC           uint32 `json:"num_gc"`
-		TotalPauseMs    uint64 `json:"total_pause_ms"`
-		LastPauseMs     float64 `json:"last_pause_ms"`
-		HeapAllocBytes  uint64 `json:"heap_alloc_bytes"`
-		HeapSysBytes    uint64 `json:"heap_sys_bytes"`
+		NumGC          uint32  `json:"num_gc"`
+		TotalPauseMs   uint64  `json:"total_pause_ms"`
+		LastPauseMs    float64 `json:"last_pause_ms"`
+		HeapAllocBytes uint64  `json:"heap_alloc_bytes"`
+		HeapSysBytes   uint64  `json:"heap_sys_bytes"`
 	}
 
 	// StreamStats represents stream statistics including announcements/withdrawals
 	type StreamStats struct {
-		Announcements     uint64  `json:"announcements"`
-		Withdrawals       uint64  `json:"withdrawals"`
-		RouteChurnPerSec  float64 `json:"route_churn_per_sec"`
-		BGPPeerCount      int     `json:"bgp_peer_count"`
+		Announcements    uint64  `json:"announcements"`
+		Withdrawals      uint64  `json:"withdrawals"`
+		RouteChurnPerSec float64 `json:"route_churn_per_sec"`
+		BGPPeerCount     int     `json:"bgp_peer_count"`
 	}
 
 	// StatsResponse represents the API statistics response
@@ -499,19 +499,19 @@ func (s *Server) handleStats() http.HandlerFunc {
 		}
 
 		stats := StatsResponse{
-			Uptime:                 uptime,
-			TotalMessages:          metrics.TotalMessages,
-			TotalBytes:             metrics.TotalBytes,
-			TotalWireBytes:         metrics.TotalWireBytes,
-			MessagesPerSec:         metrics.MessagesPerSec,
-			MbitsPerSec:            metrics.BitsPerSec / bitsPerMegabit,
-			WireMbitsPerSec:        metrics.WireBitsPerSec / bitsPerMegabit,
-			Connected:              metrics.Connected,
-			ConnectionDuration:     connectionDuration,
-			ReconnectCount:         metrics.ReconnectCount,
-			GoVersion:              runtime.Version(),
-			Goroutines:             runtime.NumGoroutine(),
-			MemoryUsage:            humanize.Bytes(memStats.Alloc),
+			Uptime:             uptime,
+			TotalMessages:      metrics.TotalMessages,
+			TotalBytes:         metrics.TotalBytes,
+			TotalWireBytes:     metrics.TotalWireBytes,
+			MessagesPerSec:     metrics.MessagesPerSec,
+			MbitsPerSec:        metrics.BitsPerSec / bitsPerMegabit,
+			WireMbitsPerSec:    metrics.WireBitsPerSec / bitsPerMegabit,
+			Connected:          metrics.Connected,
+			ConnectionDuration: connectionDuration,
+			ReconnectCount:     metrics.ReconnectCount,
+			GoVersion:          runtime.Version(),
+			Goroutines:         runtime.NumGoroutine(),
+			MemoryUsage:        humanize.Bytes(memStats.Alloc),
 			GC: GCStats{
 				NumGC:          memStats.NumGC,
 				TotalPauseMs:   memStats.PauseTotalNs / uint64(nanosecondsPerMillisecond),
diff --git a/internal/streamer/streamer.go b/internal/streamer/streamer.go
index 4814707..d345a9a 100644
--- a/internal/streamer/streamer.go
+++ b/internal/streamer/streamer.go
@@ -112,8 +112,8 @@ type Streamer struct {
 	cancel       context.CancelFunc
 	running      bool
 	metrics      *metrics.Tracker
-	totalDropped uint64     // Total dropped messages across all handlers
-	random       *rand.Rand // Random number generator for backpressure drops
+	totalDropped uint64          // Total dropped messages across all handlers
+	random       *rand.Rand      // Random number generator for backpressure drops
 	bgpPeers     map[string]bool // Track active BGP peers by peer IP
 	bgpPeersMu   sync.RWMutex    // Protects bgpPeers map
 }
diff --git a/internal/templates/templates.go b/internal/templates/templates.go
index 2273102..b388343 100644
--- a/internal/templates/templates.go
+++ b/internal/templates/templates.go
@@ -49,9 +49,9 @@ var (
 )
 
 const (
-	hoursPerDay        = 24
-	daysPerMonth       = 30
-	cidrPartCount      = 2 // A CIDR has two parts: prefix and length
+	hoursPerDay   = 24
+	daysPerMonth  = 30
+	cidrPartCount = 2 // A CIDR has two parts: prefix and length
 )
 
 // timeSince returns a human-readable duration since the given time
@@ -109,16 +109,16 @@ func initTemplates() {
 
 	// Create common template functions
 	funcs := template.FuncMap{
-		"timeSince":        timeSince,
-		"urlEncode":        url.QueryEscape,
-		"prefixURL":        prefixURL,
-		"appName":          func() string { return version.Name },
-		"appAuthor":        func() string { return version.Author },
-		"appAuthorURL":     func() string { return version.AuthorURL },
-		"appLicense":       func() string { return version.License },
-		"appRepoURL":       func() string { return version.RepoURL },
-		"appGitRevision":   func() string { return version.GitRevisionShort },
-		"appGitCommitURL":  func() string { return version.CommitURL() },
+		"timeSince":       timeSince,
+		"urlEncode":       url.QueryEscape,
+		"prefixURL":       prefixURL,
+		"appName":         func() string { return version.Name },
+		"appAuthor":       func() string { return version.Author },
+		"appAuthorURL":    func() string { return version.AuthorURL },
+		"appLicense":      func() string { return version.License },
+		"appRepoURL":      func() string { return version.RepoURL },
+		"appGitRevision":  func() string { return version.GitRevisionShort },
+		"appGitCommitURL": func() string { return version.CommitURL() },
 	}
 
 	// Parse index template
diff --git a/script/bootstrap b/script/bootstrap
new file mode 100755
index 0000000..3a156e5
--- /dev/null
+++ b/script/bootstrap
@@ -0,0 +1,73 @@
+#!/bin/sh
+# script/bootstrap: install all dependencies needed to build and develop
+# this repo. Idempotent: every install is guarded by a check so already
+# installed tools are skipped. Base tooling comes from nix, apt, brew,
+# or apk (detected in that order); assumes NOTHING is present (not git,
+# make, or go).
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+PKGMGR=""
+SUDO=""
+
+detect_pkgmgr() {
+    [ -n "$PKGMGR" ] && return 0
+    if command -v nix-env >/dev/null 2>&1; then
+        PKGMGR="nix"
+    elif command -v apt-get >/dev/null 2>&1; then
+        PKGMGR="apt"
+    elif command -v brew >/dev/null 2>&1; then
+        PKGMGR="brew"
+    elif command -v apk >/dev/null 2>&1; then
+        PKGMGR="apk"
+    else
+        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
+        exit 1
+    fi
+    if [ "$PKGMGR" = "apt" ]; then
+        export DEBIAN_FRONTEND=noninteractive
+        if [ "$(id -u)" != "0" ]; then
+            SUDO="sudo"
+        fi
+    fi
+}
+
+# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
+pkg_install() {
+    detect_pkgmgr
+    case "$PKGMGR" in
+        nix) nix-env -iA "nixpkgs.$1" ;;
+        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
+        brew) brew install "$3" ;;
+        apk) apk add --no-cache "$4" ;;
+    esac
+}
+
+missing() {
+    ! command -v "$1" >/dev/null 2>&1
+}
+
+main() {
+    cd "$ROOT"
+
+    # Base tooling (every repo)
+    if missing git; then pkg_install git git git git; fi
+    if missing make; then pkg_install gnumake make make make; fi
+
+    # Go toolchain
+    if missing go; then pkg_install go golang go go; fi
+
+    # golangci-lint: packaged in nix, brew, and apk. There is no apt
+    # package; on apt systems install it manually from a hash-verified
+    # GitHub release archive (never curl | sh).
+    if missing golangci-lint; then
+        pkg_install golangci-lint golangci-lint golangci-lint golangci-lint
+    fi
+
+    go mod download
+
+    echo "bootstrap complete"
+}
+
+main "$@"
diff --git a/script/check b/script/check
new file mode 100755
index 0000000..cc046f7
--- /dev/null
+++ b/script/check
@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/check: run all checks (test, lint, fmt-check). Our own
+# extension to scripts-to-rule-them-all. Must not modify any files.
+# Generic: usually needs no adaptation.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/test"
+    "$SCRIPT_DIR/lint"
+    "$SCRIPT_DIR/fmt-check"
+}
+
+main "$@"
diff --git a/script/cibuild b/script/cibuild
new file mode 100755
index 0000000..3da5857
--- /dev/null
+++ b/script/cibuild
@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/cibuild: run the CI build. The Dockerfile runs script/check
+# (via make check), so a successful build implies all checks pass.
+# Generic: needs no adaptation. The Gitea workflow runs this on push.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build .
+}
+
+main "$@"
diff --git a/script/docker b/script/docker
new file mode 100755
index 0000000..2884e41
--- /dev/null
+++ b/script/docker
@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/docker: build the Docker image tagged with the project name.
+# Identical in all repos; the tag comes from script/projectname.
+# Generic: needs no adaptation.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build -t "$("$SCRIPT_DIR/projectname")" .
+}
+
+main "$@"
diff --git a/script/fmt b/script/fmt
new file mode 100755
index 0000000..e95d111
--- /dev/null
+++ b/script/fmt
@@ -0,0 +1,12 @@
+#!/bin/sh
+# script/fmt: format all files (writes).
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go fmt ./...
+}
+
+main "$@"
diff --git a/script/fmt-check b/script/fmt-check
new file mode 100755
index 0000000..57e8e5c
--- /dev/null
+++ b/script/fmt-check
@@ -0,0 +1,18 @@
+#!/bin/sh
+# script/fmt-check: check formatting (read-only). Same scope as
+# script/fmt, but fails instead of writing.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    unformatted="$(gofmt -l .)"
+    if [ -n "$unformatted" ]; then
+        echo "Files not formatted:" >&2
+        echo "$unformatted" >&2
+        exit 1
+    fi
+}
+
+main "$@"
diff --git a/script/install-precommit b/script/install-precommit
new file mode 100755
index 0000000..3519de6
--- /dev/null
+++ b/script/install-precommit
@@ -0,0 +1,17 @@
+#!/bin/sh
+# script/install-precommit: install the git pre-commit hook that runs
+# script/precommit. Our own extension to scripts-to-rule-them-all.
+# Generic: needs no adaptation.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    hook=".git/hooks/pre-commit"
+    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
+    chmod +x .git/hooks/pre-commit
+    echo "pre-commit hook installed: runs script/precommit"
+}
+
+main "$@"
diff --git a/script/lint b/script/lint
new file mode 100755
index 0000000..a675833
--- /dev/null
+++ b/script/lint
@@ -0,0 +1,13 @@
+#!/bin/sh
+# script/lint: run the linters.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go vet ./...
+    golangci-lint run
+}
+
+main "$@"
diff --git a/script/precommit b/script/precommit
new file mode 100755
index 0000000..50f02ae
--- /dev/null
+++ b/script/precommit
@@ -0,0 +1,21 @@
+#!/bin/sh
+# script/precommit: run by the git pre-commit hook; fails the commit if
+# checks fail. Our own extension to scripts-to-rule-them-all. Go repo
+# extras: go mod tidy and go fmt must leave the tree unchanged.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go mod tidy
+    go fmt ./...
+    git diff --exit-code -- go.mod go.sum || {
+        echo "go mod tidy changed files; please stage and retry"
+        exit 1
+    }
+    "$SCRIPT_DIR/check"
+}
+
+main "$@"
diff --git a/script/projectname b/script/projectname
new file mode 100755
index 0000000..d1840e6
--- /dev/null
+++ b/script/projectname
@@ -0,0 +1,12 @@
+#!/bin/sh
+# script/projectname: output the name of this project. Our own
+# extension to scripts-to-rule-them-all. Other scripts that need the
+# name (e.g. script/docker) call this, so they can stay identical
+# across all repos.
+set -eu
+
+main() {
+    echo "routewatch"
+}
+
+main "$@"
diff --git a/script/setup b/script/setup
new file mode 100755
index 0000000..53327ba
--- /dev/null
+++ b/script/setup
@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/setup: set up the repo for development after a fresh clone:
+# installs dependencies (script/bootstrap) and the git pre-commit hook.
+# Add any repo-specific initialization (db init, .env template) here.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/install-precommit"
+}
+
+main "$@"
diff --git a/script/test b/script/test
new file mode 100755
index 0000000..87c1a57
--- /dev/null
+++ b/script/test
@@ -0,0 +1,17 @@
+#!/bin/sh
+# script/test: run the test suite. On failure, rerun verbosely so the
+# failing tests are visible in the output.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go test -timeout 30s -race -cover ./... || {
+        echo "--- Rerunning with -v for details ---"
+        go test -timeout 30s -race -v ./...
+        exit 1
+    }
+}
+
+main "$@"