diff --git a/.github/renovate-tracked-deps.json b/.github/renovate-tracked-deps.json
index 513b437c6..292f6b0d8 100644
--- a/.github/renovate-tracked-deps.json
+++ b/.github/renovate-tracked-deps.json
@@ -163,6 +163,7 @@
         "aqua:jonwiggins/xmloxide",
         "aqua:owenlamont/ryl",
         "biome",
+        "checkstyle",
         "editorconfig-checker",
         "google-java-format",
         "hugo",
diff --git a/.github/workflows/acceptance-tests.yml b/.github/workflows/acceptance-tests.yml
index 410da0c3f..24cc97559 100644
--- a/.github/workflows/acceptance-tests.yml
+++ b/.github/workflows/acceptance-tests.yml
@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Run acceptance tests
         run: mise run acceptance-test
diff --git a/.github/workflows/api-diff.yml b/.github/workflows/api-diff.yml
index c7ad1f065..1f1bba199 100644
--- a/.github/workflows/api-diff.yml
+++ b/.github/workflows/api-diff.yml
@@ -34,8 +34,8 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 765b685f2..d0edfb564 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,8 +14,8 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/.github/workflows/bump-api-diff-baseline.yml b/.github/workflows/bump-api-diff-baseline.yml
index edbf002f8..361a8bc69 100644
--- a/.github/workflows/bump-api-diff-baseline.yml
+++ b/.github/workflows/bump-api-diff-baseline.yml
@@ -35,8 +35,8 @@ jobs:
           persist-credentials: true
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/.github/workflows/generate-protobuf.yml b/.github/workflows/generate-protobuf.yml
index 6c6e54495..4df60151f 100644
--- a/.github/workflows/generate-protobuf.yml
+++ b/.github/workflows/generate-protobuf.yml
@@ -20,8 +20,8 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/.github/workflows/github-pages.yaml b/.github/workflows/github-pages.yaml
index a168df077..50f94da6c 100644
--- a/.github/workflows/github-pages.yaml
+++ b/.github/workflows/github-pages.yaml
@@ -39,8 +39,8 @@ jobs:
           fetch-depth: 0
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
           cache: "false"
       - name: Setup Pages
         id: pages
diff --git a/.github/workflows/java-version-matrix-tests.yml b/.github/workflows/java-version-matrix-tests.yml
index fbe49c90f..2be421450 100644
--- a/.github/workflows/java-version-matrix-tests.yml
+++ b/.github/workflows/java-version-matrix-tests.yml
@@ -33,8 +33,8 @@ jobs:
       - name: Set up mise
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
 
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/jmx-exporter-compatibility.yml b/.github/workflows/jmx-exporter-compatibility.yml
index 154c6f0a2..e04f39083 100644
--- a/.github/workflows/jmx-exporter-compatibility.yml
+++ b/.github/workflows/jmx-exporter-compatibility.yml
@@ -24,8 +24,8 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
           working_directory: .mise/envs/jmx-exporter
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index a78b590f9..d7622514a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -23,8 +23,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
 
       - name: Lint
         env:
diff --git a/.github/workflows/micrometer-compatibility.yml b/.github/workflows/micrometer-compatibility.yml
index a27f75048..14c616ddc 100644
--- a/.github/workflows/micrometer-compatibility.yml
+++ b/.github/workflows/micrometer-compatibility.yml
@@ -32,8 +32,8 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
           working_directory: .mise/envs/micrometer
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/native-tests.yml b/.github/workflows/native-tests.yml
index 473a2935f..17976affc 100644
--- a/.github/workflows/native-tests.yml
+++ b/.github/workflows/native-tests.yml
@@ -15,8 +15,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
           working_directory: .mise/envs/native
       - name: Run native tests
         working-directory: .mise/envs/native
diff --git a/.github/workflows/nightly-benchmarks.yml b/.github/workflows/nightly-benchmarks.yml
index 2aa5bf1aa..921dcf818 100644
--- a/.github/workflows/nightly-benchmarks.yml
+++ b/.github/workflows/nightly-benchmarks.yml
@@ -36,8 +36,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
 
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/pr-benchmarks.yml b/.github/workflows/pr-benchmarks.yml
index 39f02cae9..5d59cbc7f 100644
--- a/.github/workflows/pr-benchmarks.yml
+++ b/.github/workflows/pr-benchmarks.yml
@@ -47,8 +47,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
 
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/regenerate-api-diff-otel.yml b/.github/workflows/regenerate-api-diff-otel.yml
index da1db33b2..3533e8e7f 100644
--- a/.github/workflows/regenerate-api-diff-otel.yml
+++ b/.github/workflows/regenerate-api-diff-otel.yml
@@ -20,8 +20,8 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a30db041e..1a5a91158 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -71,8 +71,8 @@ jobs:
 
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
           cache: false
 
       - name: Build release version
diff --git a/.github/workflows/test-release-build.yml b/.github/workflows/test-release-build.yml
index 64bc75b30..cd28dfbd5 100644
--- a/.github/workflows/test-release-build.yml
+++ b/.github/workflows/test-release-build.yml
@@ -20,8 +20,8 @@ jobs:
           fetch-depth: 0
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          version: v2026.7.15
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/AGENTS.md b/AGENTS.md
index 24481b8e5..e776815c1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -15,7 +15,7 @@ mise run ci
 # Quick compile without tests or checks (fastest)
 mise run compile
 
-# Run unit tests only (skips formatting/coverage/checkstyle)
+# Run unit tests only (skips formatting and coverage)
 mise run test
 
 # Run all tests including integration tests
@@ -23,15 +23,15 @@ mise run test-all
 
 # Run a single test class
 ./mvnw test -Dtest=CounterTest \
-  -Dcoverage.skip=true -Dcheckstyle.skip=true
+  -Dcoverage.skip=true
 
 # Run a single test method
 ./mvnw test -Dtest=CounterTest#testIncrement \
-  -Dcoverage.skip=true -Dcheckstyle.skip=true
+  -Dcoverage.skip=true
 
 # Run tests in a specific module
 ./mvnw test -pl prometheus-metrics-core \
-  -Dcoverage.skip=true -Dcheckstyle.skip=true
+  -Dcoverage.skip=true
 
 # Regenerate protobuf classes (after protobuf dep update)
 mise run generate
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 519b98fea..a3ea0ef3a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -89,14 +89,12 @@ mise --cd .mise/envs/native run native-test
 ### Avoid failures while running tests
 
 - Use `-Dcoverage.skip=true` to skip the coverage check during development.
-- Use `-Dcheckstyle.skip=true` to skip the checkstyle check during development.
 - Use `-Dwarnings=-nowarn` to skip the warnings during development.
 
 Combine all with
 
 ```shell
-./mvnw install -DskipTests -Dcoverage.skip=true \
-  -Dcheckstyle.skip=true -Dwarnings=-nowarn
+./mvnw install -DskipTests -Dcoverage.skip=true -Dwarnings=-nowarn
 ```
 
 or simply
diff --git a/checkstyle-suppressions.xml b/checkstyle-suppressions.xml
index 82e964658..b1b9d6cfe 100644
--- a/checkstyle-suppressions.xml
+++ b/checkstyle-suppressions.xml
@@ -21,4 +21,12 @@
 
   <!-- Suppress all Javadoc checks for integration tests -->
   <suppress checks="Javadoc" files=".*[/\\]integration-tests[/\\].*"/>
+
+  <!-- Preserve the repository's main-source-only Checkstyle policy when Flint invokes the
+       standalone CLI with explicit Java files. -->
+  <suppress checks=".*" files=".*[/\\]src[/\\]test[/\\]java[/\\].*"/>
+  <suppress checks=".*" files=".*[/\\]src[/\\]archive[/\\]java[/\\].*"/>
+
+  <!-- Example setup intentionally groups declarations before the simulated work that uses them. -->
+  <suppress checks="VariableDeclarationUsageDistance" files=".*[/\\]examples[/\\].*"/>
 </suppressions>
diff --git a/mise.lock b/mise.lock
index 179dfef1d..c5042a98d 100644
--- a/mise.lock
+++ b/mise.lock
@@ -47,43 +47,49 @@ url_api = "https://api.github.com/repos/rhysd/actionlint/releases/assets/3849249
 provenance = "github-attestations"
 
 [[tools."aqua:grafana/flint"]]
-version = "0.22.9"
+version = "0.22.10"
 backend = "aqua:grafana/flint"
 
 [tools."aqua:grafana/flint"."platforms.linux-arm64"]
-checksum = "sha256:aae323ea911f9a5012879b79fd3b913837d301098173684d5f9672b6d15c1193"
-url = "https://github.com/grafana/flint/releases/download/v0.22.9/flint-aarch64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/grafana/flint/releases/assets/476876537"
+checksum = "sha256:6dec82cb6486b7e645e0b1674493497191d92a8e28c5c79194e5553882d213de"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491750275"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.linux-arm64-musl"]
+checksum = "sha256:373060c08a4cdd905d6e8e83f62ef43da8778d9133cb66b7801f392587812e8f"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491750193"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.linux-x64"]
-checksum = "sha256:e7b0597d82568e441dab13091f674f15c36914b0f412c8fcc19d3ed880da320a"
-url = "https://github.com/grafana/flint/releases/download/v0.22.9/flint-x86_64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/grafana/flint/releases/assets/476875905"
+checksum = "sha256:a9f7f3768ec02cdd082c12cea0e815fc142d3ee721f4d8485f4ba9fc2c7d0521"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491749844"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.linux-x64-musl"]
+checksum = "sha256:3b174b31f10b1ded2cf0a54e8b62e5526713a49816c1fd74b00073519044f7bb"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491750257"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.macos-arm64"]
-checksum = "sha256:0370a9f0f16b262cb2c683cc2da539d39e131a3167ac44d3471b57135508b3b2"
-url = "https://github.com/grafana/flint/releases/download/v0.22.9/flint-aarch64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/grafana/flint/releases/assets/476875995"
+checksum = "sha256:f9aa1a95aa5953f7f5a64c0d72f86e634c4930e9cb73422a95e342c6cb9be5d5"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491750245"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.macos-x64"]
-checksum = "sha256:b14167a1e47ac34439518680ff5df16554056c5099bafd650f01a37cf29b4a3a"
-url = "https://github.com/grafana/flint/releases/download/v0.22.9/flint-x86_64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/grafana/flint/releases/assets/476878878"
+checksum = "sha256:b55731f1b74196afea675bdbd6ebbbd94171b4e9d31f79ecee36372bdf8818cf"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-x86_64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491752660"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.windows-x64"]
-checksum = "sha256:b5b9fb31413e11600ec0f8d4c0cf56c7698b1e38f156018364b3f1a2dcfbcbd0"
-url = "https://github.com/grafana/flint/releases/download/v0.22.9/flint-x86_64-pc-windows-msvc.zip"
-url_api = "https://api.github.com/repos/grafana/flint/releases/assets/476892021"
+checksum = "sha256:494f16ad4d2d8eae137438832e544675d196a2887086ab8070a5a346d70650be"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491751016"
 provenance = "github-attestations"
 
 [[tools."aqua:grafana/gcx"]]
@@ -296,6 +302,45 @@ url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5
 url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058831"
 provenance = "github-attestations"
 
+[[tools.checkstyle]]
+version = "13.8.0"
+backend = "aqua:checkstyle/checkstyle"
+
+[tools.checkstyle."platforms.linux-arm64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.linux-arm64-musl"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.linux-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.linux-x64-musl"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.macos-arm64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.macos-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.windows-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
 [[tools.editorconfig-checker]]
 version = "3.8.0"
 backend = "aqua:editorconfig-checker/editorconfig-checker"
@@ -515,6 +560,9 @@ url = "https://nodejs.org/dist/v24.18.0/node-v24.18.0-win-x64.zip"
 version = "43.257.4"
 backend = "npm:renovate"
 
+[tools."npm:renovate".options]
+trust_policy_excludes = '["@yarnpkg/libzip@3.2.2"]'
+
 [[tools.protoc]]
 version = "35.1"
 backend = "aqua:protocolbuffers/protobuf/protoc"
diff --git a/mise.toml b/mise.toml
index 94c3beb17..83ae49227 100644
--- a/mise.toml
+++ b/mise.toml
@@ -8,14 +8,16 @@ protoc = "35.1"
 
 # Linters
 actionlint = "1.7.12"
-"aqua:grafana/flint" = "0.22.9"
+"aqua:grafana/flint" = "0.22.10"
 "aqua:jonwiggins/xmloxide" = "v0.4.3"
 "aqua:owenlamont/ryl" = "0.21.0"
 biome = "2.5.3"
+checkstyle = "13.8.0"
 editorconfig-checker = "3.8.0"
 google-java-format = "1.35.0"
 lychee = "0.24.2"
-"npm:renovate" = "43.257.4"
+# @yarnpkg/libzip 3.2.2 matches its upstream release but was published without provenance.
+"npm:renovate" = { version = "43.257.4", trust_policy_excludes = ["@yarnpkg/libzip@3.2.2"] }
 ruff = "0.15.21"
 rumdl = "v0.2.31"
 shellcheck = "v0.11.0"
@@ -46,16 +48,16 @@ run = "./mvnw clean"
 
 [tasks.compile]
 description = "bare compile, ignoring formatting and linters"
-run = "./mvnw install -DskipTests -Dcoverage.skip=true -Dcheckstyle.skip=true -Dwarnings=-nowarn"
+run = "./mvnw install -DskipTests -Dcoverage.skip=true -Dwarnings=-nowarn"
 
 [tasks.generate]
 description = "regenerate protobuf sources"
-run = "./mvnw clean install -DskipTests -Dcoverage.skip=true -Dcheckstyle.skip=true -Dwarnings=-nowarn"
+run = "./mvnw clean install -DskipTests -Dcoverage.skip=true -Dwarnings=-nowarn"
 env.PROTO_GENERATION = "true"
 
 [tasks.test]
 description = "run unit tests, ignoring formatting and linters"
-run = "./mvnw test -Dcoverage.skip=true -Dcheckstyle.skip=true -Dwarnings=-nowarn"
+run = "./mvnw test -Dcoverage.skip=true -Dwarnings=-nowarn"
 
 [tasks.test-all]
 description = "run all tests"
@@ -76,7 +78,6 @@ BASELINE_OVERRIDE="${API_DIFF_BASELINE_VERSION:+-Dapi.diff.baseline.version=${AP
   ${BASELINE_OVERRIDE} \
   -DskipTests \
   -Dcoverage.skip=true \
-  -Dcheckstyle.skip=true \
   -Dwarnings=-nowarn
 ./.github/scripts/sync-api-diffs.sh
 """
diff --git a/pom.xml b/pom.xml
index d03c6cd6c..e0cfda23d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -32,7 +32,6 @@
     <!-- Bumped by .github/workflows/bump-api-diff-baseline.yml after each release. -->
     <api.diff.baseline.version>1.8.0</api.diff.baseline.version>
     <jacoco.line-coverage>0.70</jacoco.line-coverage>
-    <checkstyle.skip>false</checkstyle.skip>
     <coverage.skip>false</coverage.skip>
     <javadoc.skip>false</javadoc.skip>
     <warnings>-Werror</warnings>
@@ -182,28 +181,6 @@
       </plugins>
     </pluginManagement>
     <plugins>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-checkstyle-plugin</artifactId>
-        <version>3.6.0</version>
-        <configuration>
-          <consoleOutput>true</consoleOutput>
-          <configLocation>google_checks.xml</configLocation>
-          <configLocation>checkstyle.xml</configLocation>
-          <violationSeverity>warning</violationSeverity>
-          <failOnViolation>true</failOnViolation>
-          <skip>${checkstyle.skip}</skip>
-          <suppressionsLocation>checkstyle-suppressions.xml</suppressionsLocation>
-          <excludes>**/generated/**,**/jmh_generated/*</excludes>
-        </configuration>
-        <executions>
-          <execution>
-            <goals>
-              <goal>check</goal>
-            </goals>
-          </execution>
-        </executions>
-      </plugin>
       <plugin>
         <groupId>org.jacoco</groupId>
         <artifactId>jacoco-maven-plugin</artifactId>
diff --git a/prometheus-metrics-otel-support/pom.xml b/prometheus-metrics-otel-support/pom.xml
index a4d179114..0365c4695 100644
--- a/prometheus-metrics-otel-support/pom.xml
+++ b/prometheus-metrics-otel-support/pom.xml
@@ -19,7 +19,6 @@
   </description>
 
   <properties>
-    <checkstyle.skip>true</checkstyle.skip>
     <coverage.skip>true</coverage.skip>
     <javadoc.skip>true</javadoc.skip>
   </properties>
diff --git a/prometheus-metrics-parent/pom.xml b/prometheus-metrics-parent/pom.xml
index d84511964..94467188d 100644
--- a/prometheus-metrics-parent/pom.xml
+++ b/prometheus-metrics-parent/pom.xml
@@ -14,7 +14,6 @@
   </description>
 
   <properties>
-    <checkstyle.skip>true</checkstyle.skip>
     <coverage.skip>true</coverage.skip>
     <javadoc.skip>true</javadoc.skip>
   </properties>