diff --git a/Makefile b/Makefile
index 7c9dfb10d..3df1636eb 100644
--- a/Makefile
+++ b/Makefile
@@ -42,9 +42,12 @@ fmt: install-gofumpt install-shfmt
 vet: ## Run go vet against code.
 	go vet ./...
 
-lint: fmt vet
+lint: fmt vet gosec
 	golangci-lint run -v
 
+gosec: install-gosec
+	$(GOSEC) --exclude=G101,G304,G401,G404,G505 --exclude-dir=tests ./...
+
 test: lint
 	@for comp in $(COMPONENTS); do make -C $$comp test; done
 	make test-tools
@@ -72,5 +75,9 @@ VENDIR = $(shell go env GOPATH)/bin/vendir
 install-vendir:
 	go install github.com/vmware-tanzu/carvel-vendir/cmd/vendir@latest
 
+GOSEC = $(shell go env GOPATH)/bin/gosec
+install-gosec:
+	go install github.com/securego/gosec/v2/cmd/gosec@latest
+
 vendir-update-dependencies: install-vendir
 	$(VENDIR) sync --chdir tests