diff --git a/.githooks/pre-commit b/.githooks/pre-commit
new file mode 100755
index 0000000..e97f9cb
--- /dev/null
+++ b/.githooks/pre-commit
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT="$(git rev-parse --show-toplevel)/scripts/util/sanitize_node.sh"
+
+FILES=$(git diff --cached --name-only --diff-filter=ACM -- 'nodes/*.json' || true)
+
+[[ -z "$FILES" ]] && exit 0
+
+DIRTY=0
+
+while IFS= read -r file; do
+  staged_tmp=$(mktemp)
+  sanitized_tmp=$(mktemp)
+
+  # 1. get staged version
+  git show ":$file" > "$staged_tmp"
+
+  # 2. sanitize IN PLACE (on temp copy)
+  cp "$staged_tmp" "$sanitized_tmp"
+  "$SCRIPT" "$sanitized_tmp"
+
+  # 3. if sanitizer changed file, update working tree
+  if ! diff -q "$staged_tmp" "$sanitized_tmp" >/dev/null; then
+    cp "$sanitized_tmp" "$file"
+    echo "Sanitized: $file"
+    DIRTY=1
+  fi
+
+  rm -f "$staged_tmp" "$sanitized_tmp"
+
+done <<< "$FILES"
+
+if [[ "$DIRTY" -ne 0 ]]; then
+  echo ""
+  echo "Commit paused, sanitized files must be re-staged."
+  exit 1
+fi
+
+exit 0
diff --git a/README.md b/README.md
index c15ca12..ef6c609 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,10 @@ Clone this repository, `cd` into it, and run:
 
     bundle install
 
+### Enable Git hooks
+
+    git config core.hooksPath .githooks
+
 ## Common tasks
 
 ### Bootstrap a new host server