diff --git a/.golangci.yml b/.golangci.yml
index 75c78a7..314a8e4 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -14,21 +14,19 @@
 
 run:
   modules-download-mode: readonly
-  deadline: 20m
-  skip-files:
-    - zz_generated.*.go
+  timeout: 20m
 
 linters:
   enable:
     - asciicheck
     - bidichk
     - bodyclose
+    - copyloopvar
     - depguard
     - durationcheck
     - errcheck
     - errname
     - errorlint
-    - exportloopref
     - goconst
     - gocritic
     - gocyclo
@@ -51,10 +49,14 @@ linters:
     - wastedassign
     - whitespace
   disable-all: true
+
 issues:
   # defaults to 3, which often needlessly hides issues and forces
   # to re-run the linter across the entire repo many times
-  max-same-issues: 50
+  max-same-issues: 0
+
+  exclude-files:
+    - zz_generated.*.go
 
   # NOTE: Do not use commas in the exclude patterns, or else the regex will be
   # split and you will be sad: https://github.com/golangci/golangci-lint/issues/665
diff --git a/.prow.yaml b/.prow.yaml
new file mode 100644
index 0000000..8c753b0
--- /dev/null
+++ b/.prow.yaml
@@ -0,0 +1,89 @@
+# Copyright 2025 The KCP Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+presubmits:
+  - name: pull-api-syncagent-verify
+    always_run: true
+    decorate: true
+    clone_uri: "https://github.com/kcp-dev/api-syncagent"
+    labels:
+      preset-goproxy: "true"
+    spec:
+      containers:
+        - image: ghcr.io/kcp-dev/infra/build:1.23.4-3
+          command:
+            - hack/ci/verify.sh
+          resources:
+            requests:
+              memory: 1Gi
+              cpu: 1
+
+  - name: pull-api-syncagent-lint
+    always_run: true
+    decorate: true
+    clone_uri: "https://github.com/kcp-dev/api-syncagent"
+    labels:
+      preset-goproxy: "true"
+    spec:
+      containers:
+        - image: ghcr.io/kcp-dev/infra/build:1.23.4-3
+          command:
+            - make
+            - lint
+          resources:
+            requests:
+              memory: 4Gi
+              cpu: 2
+
+  - name: pull-api-syncagent-build-image
+    always_run: true
+    decorate: true
+    clone_uri: "https://github.com/kcp-dev/api-syncagent"
+    labels:
+      preset-goproxy: "true"
+    spec:
+      containers:
+        - image: quay.io/containers/buildah:v1.30.0
+          command:
+            - hack/ci/build-image.sh
+          env:
+            - name: DRY_RUN
+              value: '1'
+          # docker-in-docker needs privileged mode
+          securityContext:
+            privileged: true
+          resources:
+            requests:
+              memory: 1Gi
+              cpu: 1
+
+  - name: pull-api-syncagent-test
+    always_run: true
+    decorate: true
+    clone_uri: "https://github.com/kcp-dev/api-syncagent"
+    labels:
+      preset-goproxy: "true"
+    spec:
+      containers:
+        - image: ghcr.io/kcp-dev/infra/build:1.23.4-3
+          command:
+            - make
+            - test
+          env:
+            - name: USE_GOTESTSUM
+              value: '1'
+          resources:
+            requests:
+              memory: 4Gi
+              cpu: 2
diff --git a/hack/ci/verify.sh b/hack/ci/verify.sh
index 58fa149..4731d59 100755
--- a/hack/ci/verify.sh
+++ b/hack/ci/verify.sh
@@ -20,13 +20,14 @@ cd $(dirname $0)/../..
 source hack/lib.sh
 
 EXIT_CODE=0
+SUMMARY=
 
 try() {
   local title="$1"
   shift
 
   heading "$title"
-  echo -e "$@\n"
+  echo
 
   start_time=$(date +%s)
 
@@ -38,13 +39,18 @@ try() {
   elapsed_time=$(($(date +%s) - $start_time))
   TEST_NAME="$title" write_junit $exitCode "$elapsed_time"
 
+  local status
   if [[ $exitCode -eq 0 ]]; then
     echo -e "\n[${elapsed_time}s] SUCCESS :)"
+    status=OK
   else
     echo -e "\n[${elapsed_time}s] FAILED."
+    status=FAIL
     EXIT_CODE=1
   fi
 
+  SUMMARY="$SUMMARY\n$(printf "%-35s %s" "$title" "$status")"
+
   git reset --hard --quiet
   git clean --force
 
@@ -87,4 +93,12 @@ try "Verify Go imports" verify_imports
 try "Verify license compatibility" ./hack/verify-licenses.sh
 try "Verify boilerplate" ./hack/verify-boilerplate.sh
 
+echo
+echo "SUMMARY"
+echo "======="
+echo
+echo "Check                               Result"
+echo -n "------------------------------------------"
+echo -e "$SUMMARY"
+
 exit $EXIT_CODE
diff --git a/hack/download-tool.sh b/hack/download-tool.sh
index 9f8e030..3f85620 100755
--- a/hack/download-tool.sh
+++ b/hack/download-tool.sh
@@ -44,8 +44,8 @@ fi
   mkdir -p tmp
   cd tmp
 
-  echo "Downloading $BINARY…" >&2
-  curl --fail -LO "$URL"
+  echo "Downloading $BINARY version $VERSION…" >&2
+  curl --fail --silent -LO "$URL"
   archive="$(ls)"
 
   UNCOMPRESSED=${UNCOMPRESSED:-false}
@@ -71,4 +71,4 @@ fi
 rm -rf tmp
 echo "$VERSION" > "$versionFile"
 
-echo "Installed $BINARY version $VERSION." >&2
+echo "Installed at _tools/$BINARY." >&2