diff --git a/Makefile b/Makefile
index e70ab9e..626882e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: all bootstrap setup check test lint fmt fmt-check build clean deps test-coverage test-integration local install release release-snapshot docker hooks
+.PHONY: all bootstrap setup check test lint lint-fix fmt fmt-check build clean deps test-coverage test-integration local install release release-snapshot docker hooks
 
 # Version number
 VERSION := 1.0.0-rc.1
@@ -43,6 +43,10 @@ fmt:
 lint:
 	@script/lint
 
+# Apply the linter's autofixes (rewrites files).
+lint-fix:
+	@script/lint-fix
+
 # Build binary.
 vaultik: internal/*/*.go cmd/vaultik/*.go
 	go build -ldflags "$(LDFLAGS)" -o $@ ./cmd/vaultik
diff --git a/README.md b/README.md
index 93312a1..c6a426f 100644
--- a/README.md
+++ b/README.md
@@ -572,6 +572,7 @@ them. We provide:
   image tag)
 * `script/test` — run the test suite (verbose rerun on failure)
 * `script/lint` — run `golangci-lint run ./...`
+* `script/lint-fix` — apply the linter's autofixes (rewrites files)
 * `script/fmt` — format all code (writes)
 * `script/fmt-check` — check formatting (read-only)
 * `script/check` — run `script/test`, `script/lint`, and
diff --git a/script/lint-fix b/script/lint-fix
new file mode 100755
index 0000000..12709a0
--- /dev/null
+++ b/script/lint-fix
@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/lint-fix: run the linter's autofixer. Rewrites files in place
+# for every finding the enabled linters know how to fix; findings
+# without an autofix are reported but left alone (exit status is
+# nonzero while any remain).
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    golangci-lint run --fix ./...
+}
+
+main "$@"