diff --git a/.github/workflows/pr-workflow.yaml b/.github/workflows/pr-workflow.yaml
index 199c874c60..d7d4d661ab 100644
--- a/.github/workflows/pr-workflow.yaml
+++ b/.github/workflows/pr-workflow.yaml
@@ -33,7 +33,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
-  run-tests:
+  unit-tests:
     runs-on: ubuntu-latest
     # A bound well clear of the observed runtime. Without one the platform
     # default applies, and a wedged step burns a free-tier slot for six hours.
@@ -51,10 +51,6 @@ jobs:
       uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version-file: 'go.mod'
-    # Unconditional: a released migration becoming permanent is exactly what
-    # this guards, and that happens on the push to main, not on the PR.
-    - name: Verify immutable PostgreSQL migrations
-      run: hack/verify/postgresql-migrations.sh
     # we only test on amd64, make sure everything still builds for arm64
     - name: build for arm64
       run: GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build ./...
@@ -76,13 +72,6 @@ jobs:
       run: ../../../hack/run-tool.sh gotestsum --junitfile "${ARTIFACTS}/gcp-secret-manager.xml"
         --jsonfile "${ARTIFACTS}/gcp-secret-manager.json" --format standard-verbose
         -- -race -v ./...
-    # The root verifiers stop at the module's go.mod, so it gets its own run:
-    # gofmt, go vet and the tidy check, then golangci-lint with the root config.
-    - name: gcp-secret-manager credential provider verify
-      working-directory: internal/plugins/gcp-secret-manager
-      run: |
-        make verify
-        ../../../hack/run-tool.sh golangci-lint run --config ../../../.golangci.yaml ./...
     - name: Cache cargo
       uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
@@ -119,8 +108,48 @@ jobs:
         name: test-results-unit
         path: ${{ env.ARTIFACTS }}
         if-no-files-found: error
-    - name: verify
-      run: hack/verify-all.sh
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+    - name: Checkout
+      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      with:
+        fetch-depth: 0
+    - name: Setup Go
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+      with:
+        go-version-file: 'go.mod'
+    - name: Verify
+      run: make verify-checks
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+    - name: Checkout
+      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+    - name: Setup Go
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+      with:
+        go-version-file: 'go.mod'
+    - name: Lint
+      run: make lint
+  # Preserve the required-check name while unit tests, verification and linting
+  # run in parallel as separate jobs.
+  run-tests:
+    needs: [unit-tests, verify, lint]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+    - name: Require unit tests and verification
+      env:
+        UNIT_TESTS_RESULT: ${{ needs.unit-tests.result }}
+        VERIFY_RESULT: ${{ needs.verify.result }}
+        LINT_RESULT: ${{ needs.lint.result }}
+      run: |
+        test "${UNIT_TESTS_RESULT}" = success
+        test "${VERIFY_RESULT}" = success
+        test "${LINT_RESULT}" = success
   # One kind cluster exercises BOTH runtimes. Free x86-64 ubuntu-latest runners
   # expose /dev/kvm (with a udev rule), so create-kind-cluster.sh mounts it and the
   # micro-VM (kata + cloud-hypervisor) sandbox class works alongside gVisor.
diff --git a/Makefile b/Makefile
index f01760e765..576ea70e47 100644
--- a/Makefile
+++ b/Makefile
@@ -172,13 +172,23 @@ verify-fmt:
 
 .PHONY: lint
 
-# Runs golangci-lint and fails on any reported issues.
+# Runs all linters and fails on any reported issues.
 lint:
+	@./hack/verify/gofmt.sh
 	@./hack/verify/golangci-lint.sh
+	@./hack/verify/kube-api-linter.sh
+	@./hack/verify/proto-fmt.sh
+	@./hack/verify/shellcheck.sh
+	@$(MAKE) -C internal/plugins/gcp-secret-manager lint
+
+.PHONY: verify verify-checks
+
+# Runs non-lint repository checks.
+verify-checks:
+	bash hack/verify-all.sh --skip-lint
+	@$(MAKE) -C internal/plugins/gcp-secret-manager verify
 
-.PHONY: verify
-verify: test
-	bash hack/verify-all.sh
+verify: test lint verify-checks
 
 .PHONY: clean
 clean:
diff --git a/hack/verify-all.sh b/hack/verify-all.sh
index 247000462b..27823985ac 100755
--- a/hack/verify-all.sh
+++ b/hack/verify-all.sh
@@ -21,8 +21,25 @@ cd "${ROOT}"
 
 export LC_ALL=C # for sorting to be consistent across locales
 
+SKIP_LINT=false
+if [[ "${1:-}" == "--skip-lint" ]]; then
+  SKIP_LINT=true
+  shift
+fi
+
 # shellcheck disable=2044 # for-loop over find output is intentional
 for F in $(find ./hack/verify -name '*.sh' | sort); do
+  if [[ "${SKIP_LINT}" == true ]]; then
+    case "${F}" in
+      ./hack/verify/gofmt.sh | \
+        ./hack/verify/golangci-lint.sh | \
+        ./hack/verify/kube-api-linter.sh | \
+        ./hack/verify/proto-fmt.sh | \
+        ./hack/verify/shellcheck.sh)
+        continue
+        ;;
+    esac
+  fi
   echo "Running ${F}"
   "${F}" "$@"
 done
diff --git a/internal/plugins/gcp-secret-manager/Makefile b/internal/plugins/gcp-secret-manager/Makefile
index b769489cc9..75cf06ff74 100644
--- a/internal/plugins/gcp-secret-manager/Makefile
+++ b/internal/plugins/gcp-secret-manager/Makefile
@@ -35,10 +35,14 @@ test:
 fmt:
 	$(GOFMT) -w .
 
-.PHONY: verify
-verify:
+.PHONY: lint
+lint:
 	@out="$$($(GOFMT) -l .)"; if [ -n "$$out" ]; then echo "gofmt needed on:"; echo "$$out"; exit 1; fi
 	go vet ./...
+	../../../hack/run-tool.sh golangci-lint run --config ../../../.golangci.yaml ./...
+
+.PHONY: verify
+verify:
 	go mod tidy -diff
 
 # Builds the image and applies the manifests to the current kubectl context.