diff --git a/.github/workflows/ci_cd.yml b/.github/workflows/ci_cd.yml
index fe6887d5acf..0c350d082dc 100644
--- a/.github/workflows/ci_cd.yml
+++ b/.github/workflows/ci_cd.yml
@@ -125,6 +125,19 @@ jobs:
           just precommit
           just lint
 
+  validate-codeowners:
+    name: Validate CODEOWNERS
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - uses: mszostok/codeowners-validator@v0.7.4
+        with:
+          checks: "files,duppatterns,syntax"
+          experimental_checks: "notowned,avoid-shadowing"
+
   add-stack-label:
     name: Add stack label
     if: |
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 5ae67060639..4b7afaf1435 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -157,14 +157,3 @@ repos:
       - id: renovate-config-validator
         args:
           - --strict
-
-  - repo: local
-    hooks:
-      - id: codeowners-validator
-        name: CODEOWNERS validator
-        language: docker_image
-        pass_filenames: false
-        entry: >
-          -e REPOSITORY_PATH="."
-          -e CHECKS="files,duppatterns,syntax"
-          ghcr.io/mszostok/codeowners-validator:v0.7.4
diff --git a/documentation/meta/ci_cd/jobs/preparation.md b/documentation/meta/ci_cd/jobs/preparation.md
index 7d26575d423..1c2728360d9 100644
--- a/documentation/meta/ci_cd/jobs/preparation.md
+++ b/documentation/meta/ci_cd/jobs/preparation.md
@@ -45,6 +45,31 @@ Runs the linting steps defined in the repository's
 [pre-commit configuration](https://github.com/WordPress/openverse/blob/main/.pre-commit-config.yaml).
 This is executed via `just lint`.
 
+## `validate-codeowners`
+
+This job should be considered a complement to `lint` and would ideally be part
+of it, as a pre-commit hook. However, the docker image we relied on for the
+pre-commit hook causes issues with arm64 computers (which includes recent Apply
+devices). Therefore, we run the hook as a CI step instead.
+
+It is still possible to run this hook locally, assuming the docker image works
+on your computer's architecture, by invoking the `lint-codeowners` just recipe:
+
+```bash
+just lint-codeowners
+```
+
+````{tip}
+In CI we run the set of "experimental" checks as well, which are disabled
+in the just recipe because they fail if there are uncommitted changes.
+To run precisely the check that CI uses, enable experimental checks:
+
+```bash
+just lint-codeowners all
+```
+
+````
+
 ## `add-stack-label`
 
 ```{note}
diff --git a/justfile b/justfile
index b904f90e7f5..d5f584b7940 100644
--- a/justfile
+++ b/justfile
@@ -92,6 +92,17 @@ precommit:
 lint hook="" *files="": precommit
     python3 pre-commit.pyz run {{ hook }} {{ if files == "" { "--all-files" } else { "--files" } }}  {{ files }}
 
+# Run codeowners validator locally. Only enable experimental hooks if there are no uncommitted changes.
+lint-codeowners checks="stable":
+    docker run --rm \
+        -u 1000:1000 \
+        -v $PWD:/src:rw,Z \
+        --workdir=/src \
+        -e REPOSITORY_PATH="." \
+        -e CHECKS="files,duppaterns,syntax" \
+        {{ if checks != "stable" { "-e EXPERIMENTAL_CHECKS='notowned,avoid-shadowing'" } else { "" } }} \
+        ghcr.io/mszostok/codeowners-validator:v0.7.4
+
 ########
 # Init #
 ########