diff --git a/.github/index.pkl b/.github/index.pkl
index 9f4275b..6402529 100644
--- a/.github/index.pkl
+++ b/.github/index.pkl
@@ -19,6 +19,7 @@ amends "@pkl.impl.ghactions/PklCI.pkl"
 import "@com.github.actions/catalog.pkl"
 import "@com.github.actions/context.pkl"
 import "@com.github.actions/Workflow.pkl"
+import "@pkl.impl.ghactions/jobs/HawkeyeCheck.pkl"
 
 build = buildAndTest
 
@@ -49,7 +50,8 @@ local baseJob: Workflow.Job = new {
     }
     new {
       name = "Check Code Generation"
-      run = """
+      run =
+        """
         npm run generate
         git diff --name-only --exit-code
         """
@@ -61,35 +63,9 @@ local baseJob: Workflow.Job = new {
   }
 }
 
-local testLicenses: Workflow.Job = new {
-  name = "Test license headers"
-  `runs-on` = "ubuntu-latest"
-  steps {
-    (catalog.`actions/checkout@v6`) {
-      with {
-        `fetch-depth` = 0
-      }
-    }
-    new {
-      name = "Install hawkeye"
-      // language=bash
-      run =
-        """
-        curl -L -o hawkeye.tar.xz https://github.com/korandoru/hawkeye/releases/download/v6.3.0/hawkeye-x86_64-unknown-linux-gnu.tar.xz
-        tar xf hawkeye.tar.xz
-        cp hawkeye-x86_64-unknown-linux-gnu/hawkeye .
-        """
-    }
-    new {
-      name = "Check licenses"
-      run = "./hawkeye check --fail-if-unknown"
-    }
-  }
-}
-
 local buildAndTest: Workflow = new {
   jobs {
-    ["test-licenses"] = testLicenses
+    ["test-licenses"] = new HawkeyeCheck {}.job
     ["build-and-test"] = (baseJob) {
       name = "Build and test"
     }
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 867ada5..995d1ab 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,20 +15,18 @@ permissions:
   contents: read
 jobs:
   test-licenses:
-    name: Test license headers
+    name: hawkeye-check
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
+        ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
         persist-credentials: false
         fetch-depth: 0
-    - name: Install hawkeye
-      run: |-
-        curl -L -o hawkeye.tar.xz https://github.com/korandoru/hawkeye/releases/download/v6.3.0/hawkeye-x86_64-unknown-linux-gnu.tar.xz
-        tar xf hawkeye.tar.xz
-        cp hawkeye-x86_64-unknown-linux-gnu/hawkeye .
-    - name: Check licenses
-      run: ./hawkeye check --fail-if-unknown
+    - run: git config --global --add safe.directory $(pwd)
+    - run: hawkeye check --config licenserc.toml --fail-if-unknown
+    container:
+      image: ghcr.io/korandoru/hawkeye@sha256:e0abf8dbfaeeeba1249679d662d9fb404b1dcdb041c6093ea1f7a6edb7d89319
   build-and-test:
     name: Build and test
     runs-on: ubuntu-latest
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d9ad5ee..ddb5a28 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -13,20 +13,18 @@ permissions:
   contents: read
 jobs:
   test-licenses:
-    name: Test license headers
+    name: hawkeye-check
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
+        ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
         persist-credentials: false
         fetch-depth: 0
-    - name: Install hawkeye
-      run: |-
-        curl -L -o hawkeye.tar.xz https://github.com/korandoru/hawkeye/releases/download/v6.3.0/hawkeye-x86_64-unknown-linux-gnu.tar.xz
-        tar xf hawkeye.tar.xz
-        cp hawkeye-x86_64-unknown-linux-gnu/hawkeye .
-    - name: Check licenses
-      run: ./hawkeye check --fail-if-unknown
+    - run: git config --global --add safe.directory $(pwd)
+    - run: hawkeye check --config licenserc.toml --fail-if-unknown
+    container:
+      image: ghcr.io/korandoru/hawkeye@sha256:e0abf8dbfaeeeba1249679d662d9fb404b1dcdb041c6093ea1f7a6edb7d89319
   build-and-test:
     name: Build and test
     runs-on: ubuntu-latest
diff --git a/.github/workflows/prb.yml b/.github/workflows/prb.yml
index 39fe7be..596bbed 100644
--- a/.github/workflows/prb.yml
+++ b/.github/workflows/prb.yml
@@ -9,20 +9,18 @@ permissions:
   contents: read
 jobs:
   test-licenses:
-    name: Test license headers
+    name: hawkeye-check
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
+        ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
         persist-credentials: false
         fetch-depth: 0
-    - name: Install hawkeye
-      run: |-
-        curl -L -o hawkeye.tar.xz https://github.com/korandoru/hawkeye/releases/download/v6.3.0/hawkeye-x86_64-unknown-linux-gnu.tar.xz
-        tar xf hawkeye.tar.xz
-        cp hawkeye-x86_64-unknown-linux-gnu/hawkeye .
-    - name: Check licenses
-      run: ./hawkeye check --fail-if-unknown
+    - run: git config --global --add safe.directory $(pwd)
+    - run: hawkeye check --config licenserc.toml --fail-if-unknown
+    container:
+      image: ghcr.io/korandoru/hawkeye@sha256:e0abf8dbfaeeeba1249679d662d9fb404b1dcdb041c6093ea1f7a6edb7d89319
   build-and-test:
     name: Build and test
     runs-on: ubuntu-latest