diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c4ddb63fd8721..2dbe0b1613b52 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -585,7 +585,8 @@ jobs:
         run: |
           echo '```console' > "$GITHUB_STEP_SUMMARY"
           # Enable color output for pre-commit and remove it for the summary
-          SKIP=cargo-fmt,clippy,dev-generate-all pre-commit run --all-files --show-diff-on-failure --color=always | \
+          # Use --hook-stage=manual to enable slower pre-commit hooks that are skipped by default
+          SKIP=cargo-fmt,clippy,dev-generate-all pre-commit run --all-files --show-diff-on-failure --color=always --hook-stage=manual | \
             tee >(sed -E 's/\x1B\[([0-9]{1,2}(;[0-9]{1,2})*)?[mGK]//g' >> "$GITHUB_STEP_SUMMARY") >&1
           exit_code="${PIPESTATUS[0]}"
           echo '```' >> "$GITHUB_STEP_SUMMARY"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c990e32513c4c..972cd3c3c4371 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -2,6 +2,7 @@ fail_fast: false
 
 exclude: |
   (?x)^(
+    .github/workflows/release.yml|
     crates/red_knot_vendored/vendor/.*|
     crates/red_knot_workspace/resources/.*|
     crates/ruff_linter/resources/.*|
@@ -93,9 +94,6 @@ repos:
     rev: v0.9.2
     hooks:
       - id: zizmor
-        # `release.yml` is autogenerated by `dist`; security issues need to be fixed there
-        # (https://opensource.axo.dev/cargo-dist/)
-        exclude: .github/workflows/release.yml
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
     rev: 0.30.0
@@ -108,9 +106,11 @@ repos:
     rev: v1.7.4
     hooks:
       - id: actionlint
-        # `release.yml` is autogenerated by `dist`; issues need to be fixed there
-        # (https://opensource.axo.dev/cargo-dist/)
-        exclude: .github/workflows/release.yml
+        stages:
+          # This hook is disabled by default, since it's quite slow.
+          # To run all hooks *including* this hook, use `uvx pre-commit run -a --hook-stage=manual`.
+          # To run *just* this hook, use `uvx pre-commit run -a actionlint --hook-stage=manual`.
+          - manual
         args:
           - "-ignore=SC2129" # ignorable stylistic lint from shellcheck
           - "-ignore=SC2016" # another shellcheck lint: seems to have false positives?