diff --git a/.golangci.yml b/.golangci.yml
index 99a05780..89d00e25 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,12 +1,8 @@
 run:
   timeout: 30m
-  skip-files:
-    - ".*\\.pb\\.go$"
 
   modules-download-mode: vendor
 
-  build-tags:
-
 linters:
   enable:
     - gofmt
@@ -57,6 +53,8 @@ linters-settings:
       G306: "0644"
 
 issues:
+  exclude-files:
+    - ".*\\.pb\\.go$"
   exclude-rules:
     - linters:
         - revive
@@ -77,6 +75,6 @@ issues:
         - revive
       text: "if-return"
 
-# show all
-max-issues-per-linter: 0
-max-same-issues: 0
+  # show all
+  max-issues-per-linter: 0
+  max-same-issues: 0
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 2de1060f..b13663d1 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -31,7 +31,7 @@ group "default" {
 }
 
 group "validate" {
-  targets = ["lint", "lint-gopls", "validate-vendor", "validate-docs"]
+  targets = ["lint", "lint-gopls", "validate-golangci", "validate-vendor", "validate-docs"]
 }
 
 target "lint" {
@@ -51,6 +51,14 @@ target "lint" {
   ] : []
 }
 
+target "validate-golangci" {
+  description = "Validate .golangci.yml schema (does not run Go linter)"
+  inherits = ["_common"]
+  dockerfile = "./hack/dockerfiles/lint.Dockerfile"
+  target = "validate-golangci"
+  output = ["type=cacheonly"]
+}
+
 target "lint-gopls" {
   inherits = ["lint"]
   target = "gopls-analyze"
diff --git a/hack/dockerfiles/lint.Dockerfile b/hack/dockerfiles/lint.Dockerfile
index fea86d3c..ff42b129 100644
--- a/hack/dockerfiles/lint.Dockerfile
+++ b/hack/dockerfiles/lint.Dockerfile
@@ -13,18 +13,24 @@ FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS golang-base
 RUN apk add --no-cache git gcc musl-dev
 
-FROM golang-base AS lint
+FROM golang-base AS lint-base
 ENV GOFLAGS="-buildvcs=false"
 ARG GOLANGCI_LINT_VERSION
 RUN wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v${GOLANGCI_LINT_VERSION}
 COPY --link --from=xx / /
 WORKDIR /go/src/github.com/docker/buildx
 ARG TARGETPLATFORM
+
+FROM lint-base AS lint
 RUN --mount=target=/go/src/github.com/docker/buildx \
     --mount=target=/root/.cache,type=cache,id=lint-cache-$TARGETPLATFORM \
     xx-go --wrap && \
     golangci-lint run
 
+FROM lint-base AS validate-golangci
+RUN --mount=target=/go/src/github.com/docker/buildx \
+  golangci-lint config verify
+
 FROM golang-base AS gopls
 RUN apk add --no-cache git
 ARG GOPLS_VERSION