diff --git a/.buildbot/tox-bionic/test.sh b/.buildbot/tox-bionic/test.sh
index b280953a42..f57f61e5f5 100755
--- a/.buildbot/tox-bionic/test.sh
+++ b/.buildbot/tox-bionic/test.sh
@@ -1,4 +1,3 @@
 #!/bin/sh
 
-tox -e lint-basic || exit 1
 tox
diff --git a/.buildbot/tox-jammy/test.sh b/.buildbot/tox-jammy/test.sh
index ab6134c458..578e78a6de 100755
--- a/.buildbot/tox-jammy/test.sh
+++ b/.buildbot/tox-jammy/test.sh
@@ -1,4 +1,3 @@
 #!/bin/sh
 
-tox -e lint || exit 1
 tox -e py310
diff --git a/.github/workflows/tox-lint.yml b/.github/workflows/tox-lint.yml
new file mode 100644
index 0000000000..91799e2a14
--- /dev/null
+++ b/.github/workflows/tox-lint.yml
@@ -0,0 +1,61 @@
+name: Tox Linter Tests
+
+on:
+  push:
+    branches: [master, main, v0.6]
+  pull_request:
+    branches: [master, main, v0.6]
+
+jobs:
+  lint:
+    name: "${{ matrix.tox-env }} / python ${{ matrix.python-version }}"
+    runs-on: ubuntu-latest
+    container: ${{ matrix.container }}
+    strategy:
+      fail-fast: false
+      matrix:
+        tox-env: [bandit, flake8, pycodestyle, pylint]
+        python-version: ["2.7", "3.10"]
+        include:
+          - python-version: "2.7"
+            container: "python:2.7-buster"
+            tox-suffix: "-py27"
+          - python-version: "3.10"
+            tox-suffix: ""
+
+    steps:
+      # ── System packages ────────────────────────────────────────
+      # Container (Python 2): runs as root, needs git for checkout
+      - name: Install system dependencies (container)
+        if: matrix.python-version == '2.7'
+        run: |
+          sed -i 's|deb.debian.org|archive.debian.org|g' /etc/apt/sources.list
+          sed -i 's|security.debian.org|archive.debian.org|g' /etc/apt/sources.list
+          sed -i '/buster-updates/d' /etc/apt/sources.list
+          apt-get update -q
+          apt-get install -qy git libcap-dev
+
+      # Host VM (Python 3): git is pre-installed, just need libcap-dev
+      - name: Install system dependencies
+        if: matrix.python-version != '2.7'
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -qy libcap-dev
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # ── Python 3 ───────────────────────────────────────────────
+      - name: Set up Python ${{ matrix.python-version }}
+        if: matrix.python-version != '2.7'
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      # ── Common ─────────────────────────────────────────────────
+      - name: Install tox
+        run: |
+          pip install "tox<4" "virtualenv<20.22.0"
+
+      - name: Run tox -e ${{ matrix.tox-env }}${{ matrix.tox-suffix }}
+        run: tox -e ${{ matrix.tox-env }}${{ matrix.tox-suffix }}
diff --git a/tox.ini b/tox.ini
index de80ed9962..9cd8c412ba 100644
--- a/tox.ini
+++ b/tox.ini
@@ -34,6 +34,74 @@ deps =
      pylint
 commands = pylint --rcfile=tox.ini --exit-zero pybitmessage
 
+[testenv:bandit]
+skip_install = true
+basepython = python3
+deps =
+    bandit
+commands =
+    bandit -r -s B101,B411,B413,B608 \
+    -x checkdeps.*,bitmessagecurses,bitmessageqt,tests pybitmessage
+
+[testenv:flake8]
+skip_install = true
+basepython = python3
+deps =
+    flake8
+commands =
+    flake8 --config=tox.ini pybitmessage --count --select=E9,F63,F7,F82 \
+    --show-source --statistics
+
+[testenv:pylint]
+skip_install = true
+basepython = python3
+deps =
+     -rrequirements.txt
+     pylint
+commands = pylint --rcfile=tox.ini --exit-zero pybitmessage
+
+[testenv:pycodestyle]
+skip_install = true
+basepython = python3
+deps =
+    pycodestyle
+commands =
+    - pycodestyle --config=tox.ini pybitmessage
+
+[testenv:bandit-py27]
+skip_install = true
+basepython = python2.7
+deps =
+    bandit<1.7.0
+commands =
+    bandit -r -s B101,B411,B413,B603,B608 \
+    -x checkdeps.*,bitmessagecurses,bitmessageqt,tests pybitmessage
+
+[testenv:flake8-py27]
+skip_install = true
+basepython = python2.7
+deps =
+    flake8<4.0.0
+commands =
+    flake8 --config=tox.ini pybitmessage --count --select=E9,F63,F7,F82 \
+    --show-source --statistics
+
+[testenv:pycodestyle-py27]
+skip_install = true
+basepython = python2.7
+deps =
+    pycodestyle<2.6.0
+commands =
+    pycodestyle --config=tox.ini pybitmessage
+
+[testenv:pylint-py27]
+skip_install = true
+basepython = python2.7
+deps =
+     -rrequirements.txt
+     pylint<2.0.0
+commands = pylint --rcfile=tox.ini --exit-zero pybitmessage
+
 [testenv:py27]
 sitepackages = true
 
@@ -79,6 +147,18 @@ omit =
 [coverage:report]
 ignore_errors = true
 
+[pycodestyle]
+max-line-length = 119
+ignore = E402,E722,W503
+
+[flake8]
+max-line-length = 119
+exclude = bitmessagecli.py,bitmessagecurses,bitmessageqt,plugins,tests,umsgpack
+ignore = E722,F841,W503
+# E722: pylint is preferred for bare-except
+# F841: pylint is preferred for unused-variable
+# W503: deprecated: https://bugs.python.org/issue26763 - https://www.python.org/dev/peps/pep-0008/#should-a-line-break-before-or-after-a-binary-operator
+
 [pylint.main]
 disable =
     invalid-name,consider-using-f-string,fixme,raise-missing-from,