diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 893070a3d82fa..935462b022f3b 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -29,6 +29,22 @@ jobs:
       - name: Check style
         run: ./ci/style.sh
 
+  clippy:
+    name: Clippy on ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-24.04, macos-14, windows-2022]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - run: rustup update stable --no-self-update
+      - uses: Swatinem/rust-cache@v2
+      # Here we use the latest stable Rust toolchain already installed by GitHub
+      # Ideally we should run it for every target, but we cannot rely on unstable toolchains
+      # due to Clippy not being consistent between them.
+      - run: cargo clippy --workspace --exclude libc-test --exclude ctest-test --all-targets -- -D warnings
+
   # This runs `cargo build --target ...` for all T1 and T2 targets`
   verify_build:
     name: Verify build
@@ -287,7 +303,8 @@ jobs:
       - verify_build
       - ctest_msrv
       - docs
-    # Github branch protection is exceedingly silly and treats "jobs skipped because a dependency
+      - clippy
+    # GitHub branch protection is exceedingly silly and treats "jobs skipped because a dependency
     # failed" as success. So we have to do some contortions to ensure the job fails if any of its
     # dependencies fails.
     if: always() # make sure this is never "skipped"
diff --git a/Cargo.toml b/Cargo.toml
index 9e8048cffce70..1101a26ce8159 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -142,3 +142,24 @@ members = [
     "ctest-test",
     "libc-test",
 ]
+
+# FIXME(msrv): These should be renamed as `[workspace.lints.*]` once MSRV is above 1.64
+#       This way all crates can use it with `[lints] workspace=true` section
+
+[lints.rust]
+# FIXME(cleanup): make ident usage consistent in each file
+unused_qualifications = "allow"
+
+[lints.clippy]
+missing_safety_doc = "allow"
+
+# FIXME(clippy): all these are default lints and should probably be fixed
+identity_op = "allow"
+if_same_then_else = "allow"
+non_minimal_cfg = "allow"
+precedence = "allow"
+redundant_field_names = "allow"
+redundant_static_lifetimes = "allow"
+unnecessary_cast = "allow"
+unused_unit = "allow"
+zero_ptr = "allow"
diff --git a/ctest-test/Cargo.toml b/ctest-test/Cargo.toml
index 72f926e832998..f0429bbeef0f8 100644
--- a/ctest-test/Cargo.toml
+++ b/ctest-test/Cargo.toml
@@ -28,3 +28,15 @@ test = false
 [[bin]]
 name = "t2_cxx"
 test = false
+
+# FIXME(msrv): These should be moved to the root Cargo.toml as `[workspace.lints.*]`
+#              once MSRV is above 1.64 and replaced with `[lints] workspace=true`
+
+[lints.rust]
+# FIXME(cleanup): make ident usage consistent in each file
+unused_qualifications = "allow"
+
+[lints.clippy]
+# FIXME(clippy): fix these
+match_like_matches_macro = "allow"
+eq_op = "allow"
diff --git a/ctest/Cargo.toml b/ctest/Cargo.toml
index 1494954a105b7..1da098f7bb4ff 100644
--- a/ctest/Cargo.toml
+++ b/ctest/Cargo.toml
@@ -13,3 +13,23 @@ garando_syntax = "0.1"
 cc = "1.0.1"
 rustc_version = "0.4"
 indoc = "2.0.6"
+
+# FIXME(msrv): These should be moved to the root Cargo.toml as `[workspace.lints.*]`
+#              once MSRV is above 1.64 and replaced with `[lints] workspace=true`
+
+[lints.rust]
+# FIXME(cleanup): make ident usage consistent in each file
+unused_qualifications = "allow"
+
+[lints.clippy]
+# FIXME(clippy): fix these
+doc_lazy_continuation = "allow"
+if_same_then_else = "allow"
+needless_borrow = "allow"
+needless_borrowed_reference = "allow"
+needless_borrows_for_generic_args = "allow"
+needless_lifetimes = "allow"
+only_used_in_recursion = "allow"
+option_as_ref_deref = "allow"
+type_complexity = "allow"
+useless_format = "allow"
diff --git a/libc-test/Cargo.toml b/libc-test/Cargo.toml
index 6dc3d2d1c14de..4faccfdf8d209 100644
--- a/libc-test/Cargo.toml
+++ b/libc-test/Cargo.toml
@@ -102,3 +102,24 @@ harness = true
 name = "style_tests"
 path = "test/style_tests.rs"
 harness = true
+
+# FIXME(msrv): These should be moved to the root Cargo.toml as `[workspace.lints.*]`
+#              once MSRV is above 1.64 and replaced with `[lints] workspace=true`
+
+[lints.rust]
+# FIXME(cleanup): make ident usage consistent in each file
+unused_qualifications = "allow"
+
+[lints.clippy]
+# FIXME(clippy): fix these
+needless_return = "allow"
+comparison_to_empty = "allow"
+unused_io_amount = "allow"
+write_with_newline = "allow"
+needless_borrows_for_generic_args = "allow"
+only_used_in_recursion = "allow"
+match_like_matches_macro = "allow"
+useless_format = "allow"
+wildcard_in_or_patterns = "allow"
+nonminimal_bool = "allow"
+match_single_binding = "allow"