diff --git a/AGENTS.md b/AGENTS.md
index f19b88fa..806fa1ee 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -39,7 +39,6 @@ This is also included in the full CI pipeline via `make local test`.
 ### Prerequisites
 
 - **Go ≥ 1.25** (see `go.mod`)
-- **Node.js** (for `npx cspell` spelling checks in the full `make test` pipeline)
 - **Bash** (acceptance tests)
 - **Docker/Podman** is optional; use `make local <target>` to run natively when containers are unavailable
 
@@ -51,7 +50,7 @@ After `scripts/devtools.sh`, add Go tool binaries to PATH:
 export PATH="$HOME/go/bin:$PATH"
 ```
 
-`golangci-lint` installs to `$HOME/go/bin`; `gosec` installs to `./bin/gosec` in the repo root.
+`golangci-lint` and `typos` install to `$HOME/go/bin`; `gosec` installs to `./bin/gosec` in the repo root.
 
 ### Common commands (local, no Docker)
 
@@ -70,7 +69,7 @@ export PATH="$HOME/go/bin:$PATH"
 ### Caveats
 
 - **`make` without `local`** tries Docker/Podman (`Dockerfile.dev`). In Cloud Agent VMs without Docker, always prefix with `make local`.
-- **Spelling step** uses `npx cspell` and may download cspell on first run (network required).
+- **Spelling step** uses `typos` (installed by `scripts/devtools.sh`).
 - **`make local test` / `scripts/check.sh`** require `golangci-lint` on PATH (`devtools.sh`).
 
 ---
diff --git a/Dockerfile.dev b/Dockerfile.dev
index 072120df..c80175d0 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -1,9 +1,5 @@
 FROM golang:1.26.4@sha256:68cb6d68bed024785b69195b89af7ac7a444f27791435f98647edff595aa0479
 
-RUN apt-get update && \
-    apt-get install -y npm && \
-    npm install -g npx cspell@10.0.1
-
 COPY scripts/devtools.sh /opt/devtools.sh
 
 RUN set -e -x && \
diff --git a/Makefile b/Makefile
index 41083d4a..3253c0fe 100644
--- a/Makefile
+++ b/Makefile
@@ -42,7 +42,7 @@ quiet: # this is silly but shuts up 'Nothing to be done for `local`'
 	@:
 
 prepare: tmp/dev_image_id
-tmp/dev_image_id: Dockerfile.dev scripts/devtools.sh
+tmp/dev_image_id: Dockerfile.dev scripts/devtools.sh _typos.toml
 	@mkdir -p tmp
 	@${ENGINE} rmi -f ${DEV_IMAGE} > /dev/null 2>&1 || true
 	@${ENGINE} build -t ${DEV_IMAGE} -f Dockerfile.dev .
diff --git a/_typos.toml b/_typos.toml
new file mode 100644
index 00000000..4d4671ce
--- /dev/null
+++ b/_typos.toml
@@ -0,0 +1,20 @@
+[files]
+extend-exclude = ["vendor", "bin"]
+
+[default]
+locale = "en"
+extend-ignore-identifiers-re = [
+  "NdJson",
+]
+
+[default.extend-identifiers]
+AttributeIDSupressMenu = "AttributeIDSupressMenu"
+
+[default.extend-words]
+Teh = "Teh"
+teh = "teh"
+Supress = "Supress"
+HashiCorp = "HashiCorp"
+Hashi = "Hashi"
+fot = "fot"
+nd = "nd"
diff --git a/cspell.config.yaml b/cspell.config.yaml
deleted file mode 100644
index 38a78c2a..00000000
--- a/cspell.config.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
----
-$schema: https://raw.githubusercontent.com/streetsidesoftware/cspell/0f43abf29e5da0ecbcb08214055cdc1e3267c3ea/cspell.schema.json
-version: '0.2'
-language: en-GB
-dictionaryDefinitions:
-  - name: project-words
-    path: './project-words.txt'
-    addWords: true
-dictionaries:
-  - project-words
-ignorePaths:
-  - 'vendor'
-  - 'bin'
-  - '/project-words.txt'
diff --git a/pkg/yqlib/encoder_toml.go b/pkg/yqlib/encoder_toml.go
index 768144c0..e5d87ae9 100644
--- a/pkg/yqlib/encoder_toml.go
+++ b/pkg/yqlib/encoder_toml.go
@@ -677,7 +677,7 @@ func (te *tomlEncoder) colorizeToml(input []byte) []byte {
 
 		// Table sections - [section] or [[array]]
 		// Only treat '[' as a table section if it appears at the start of the line
-		// (possibly after whitespace). This avoids mis-colouring inline arrays like
+        // (possibly after whitespace). This avoids incorrectly colouring inline arrays like
 		// "ports = [8000, 8001]" as table sections.
 		if ch == '[' {
 			isSectionHeader := true
diff --git a/pkg/yqlib/file_utils.go b/pkg/yqlib/file_utils.go
index 72d435cf..3aca0ae1 100644
--- a/pkg/yqlib/file_utils.go
+++ b/pkg/yqlib/file_utils.go
@@ -40,7 +40,7 @@ func tryRemoveTempFile(filename string) {
 // thanks https://stackoverflow.com/questions/21060945/simple-way-to-copy-a-file-in-golang
 func copyFileContents(src, dst string) (err error) {
 	// ignore CWE-22 gosec issue - that's more targeted for http based apps that run in a public directory,
-	// and ensuring that it's not possible to give a path to a file outside thar directory.
+	// and ensuring that it's not possible to give a path to a file outside that directory.
 
 	in, err := os.Open(src) // #nosec
 	if err != nil {
diff --git a/project-words.txt b/project-words.txt
deleted file mode 100644
index 94fd72c1..00000000
--- a/project-words.txt
+++ /dev/null
@@ -1,307 +0,0 @@
-abxbbxdbxebxczzx
-abxbbxdbxebxczzy
-accum
-Accum
-adithyasunil
-AEDT
-água
-ÁGUA
-alecthomas
-appleapple
-Astuff
-autocreating
-autoparse
-AWST
-axbxcxdxe
-axbxcxdxexxx
-bananabanana
-barp
-nbaz
-bitnami
-blarp
-blddir
-Bobo
-BODMAS
-bonapite
-Brien
-Bstuff
-BUILDKIT
-buildpackage
-catmeow
-CATYPE
-CBVVE
-chardata
-chillum
-choco
-chomper
-cleanup
-cmlu
-colorise
-colors
-Colors
-colourize
-compinit
-coolioo
-coverprofile
-createmap
-csvd
-CSVUTF
-currentlabel
-cygpath
-czvf
-datestring
-datetime
-Datetime
-datetimes
-DEBEMAIL
-debhelper
-Debugf
-debuild
-delish
-delpaths
-DELPATHS
-devorbitus
-devscripts
-dimchansky
-Dont
-dput
-elliotchance
-endhint
-endofname
-Entriesfrom
-envsubst
-errorlevel
-Escandón
-Evalall
-fakefilename
-fakeroot
-Farah
-fatih
-Fifi
-filebytes
-Fileish
-foobar
-foobaz
-foof
-frood
-fullpath
-gitbook
-githubactions
-gnupg
-goccy
-gofmt
-gogo
-golangci
-goreleaser
-GORELEASER
-GOMODCACHE
-GOPATH
-gosec
-gota
-goversion
-GOVERSION
-haha
-hellno
-herbygillot
-hexdump
-Hoang
-hostpath
-hotdog
-howdy
-incase
-Infof
-inlinetables
-inplace
-ints
-ireduce
-iwatch
-jinzhu
-jq's
-jsond
-keygrip
-Keygrip
-KEYGRIP
-KEYID
-keyvalue
-kwak
-lalilu
-ldflags
-LDFLAGS
-lexer
-Lexer
-libdistro
-lindex
-linecomment
-LVAs
-magiconair
-mapvalues
-Mier
-mikefarah
-minideb
-minishift
-mipsle
-mitchellh
-mktemp
-Mult
-multidoc
-multimaint
-myenv
-myenvnonexisting
-myfile
-myformat
-ndjson
-NDJSON
-NFKD
-nixpkgs
-nojson
-nonascii
-nonempty
-noninteractive
-Nonquoting
-nosec
-notoml
-noxml
-nolua
-nullinput
-onea
-Oneshot
-opencollect
-opstack
-orderedmap
-osarch
-overridign
-pacman
-Padder
-pandoc
-parsechangelog
-pcsv
-pelletier
-pflag
-prechecking
-Prerelease
-proc
-propsd
-qylib
-readline
-realnames
-realpath
-repr
-rhash
-rindex
-risentveber
-rmescandon
-Rosey
-roundtrip
-roundtrips
-Roundtrip
-roundtripping
-Interp
-interp
-runningvms
-sadface
-selfupdate
-setpath
-sharedfolder
-Sharedfolder
-shellvariables
-shellvars
-shortfunc
-shortpipe
-shunit
-snapcraft
-somevalue
-splt
-srcdir
-stackoverflow
-stiched
-Strc
-strenv
-strload
-stylig
-subarray
-subchild
-subdescription
-submatch
-submatches
-SUBSTR
-tempfile
-tfstate
-Tfstate
-thar
-timezone
-Timezone
-timezones
-Timezones
-tojson
-Tokenvalue
-tsvd
-Tuan
-tzdata
-Uhoh
-updateassign
-urid
-utfbom
-Warningf
-Wazowski
-webi
-Webi
-wherever
-winget
-withdots
-wizz
-woop
-workdir
-Writable
-xmld
-xyzzy
-yamld
-yqlib
-yuin
-zabbix
-tonumber
-noyaml
-nolint
-shortfile
-Unmarshalling
-noini
-nocsv
-nobase64
-nouri
-noprops
-nosh
-noshell
-tinygo
-nonexistent
-hclsyntax
-hclwrite
-nohcl
-zclconf
-cty
-go-cty
-Colorisation
-goimports
-errorlint
-RDBMS
-expeñded
-bananabananabananabanana
-edwinjhlee
-flox
-unlabelled
-kyaml
-KYAML
-nokyaml
-buildvcs
-behaviour
-GOFLAGS
-gocache
-subsubarray
-Ffile
-Fquery
-coverpkg
-gsub
-ralia
-Austr
-ustrali
-héllo
-alia
-goinstall
\ No newline at end of file
diff --git a/scripts/devtools.sh b/scripts/devtools.sh
index 31567023..16bb3aee 100755
--- a/scripts/devtools.sh
+++ b/scripts/devtools.sh
@@ -2,4 +2,49 @@
 set -ex
 go mod download golang.org/x/tools@v0.44.0
 curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/6008b81b81c690c046ffc3fd5bce896da715d5fd/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.3
-curl -sSfL https://raw.githubusercontent.com/securego/gosec/424fc4cd9c82ea0fd6bee9cd49c2db2c3cc0c93f/install.sh | sh -s v2.22.11
\ No newline at end of file
+curl -sSfL https://raw.githubusercontent.com/securego/gosec/424fc4cd9c82ea0fd6bee9cd49c2db2c3cc0c93f/install.sh | sh -s v2.22.11
+
+TYPOS_VERSION=v1.47.2
+TYPOS_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+TYPOS_ARCH=$(uname -m)
+case "${TYPOS_ARCH}" in
+  x86_64) TYPOS_ARCH=x86_64 ;;
+  aarch64|arm64) TYPOS_ARCH=aarch64 ;;
+  *)
+    echo "unsupported architecture for typos: ${TYPOS_ARCH}"
+    exit 1
+    ;;
+esac
+case "${TYPOS_OS}" in
+  linux) TYPOS_TARGET="${TYPOS_ARCH}-unknown-linux-musl" ;;
+  darwin) TYPOS_TARGET="${TYPOS_ARCH}-apple-darwin" ;;
+  *)
+    echo "unsupported OS for typos: ${TYPOS_OS}"
+    exit 1
+    ;;
+esac
+TYPOS_ARCHIVE="typos-${TYPOS_VERSION}-${TYPOS_TARGET}.tar.gz"
+TYPOS_URL="https://github.com/crate-ci/typos/releases/download/${TYPOS_VERSION}/${TYPOS_ARCHIVE}"
+case "${TYPOS_TARGET}" in
+  aarch64-apple-darwin) TYPOS_SHA256=23ca24a9186b5cb395b5f6c8eea8cdb02911c8980833e016454b56e90c3bd474 ;;
+  aarch64-unknown-linux-musl) TYPOS_SHA256=596d5c6b9ecf34307f68bea649178c5b45a4398fe3a1fcef9598e85aa2ccb742 ;;
+  x86_64-apple-darwin) TYPOS_SHA256=469a2d9fc894b0cdcec6e4fa3719b4c4638e195feee6517d4845450f8e8985c6 ;;
+  x86_64-unknown-linux-musl) TYPOS_SHA256=7aef58932fc123b4cf4b40d86468e89a3297d80169051d7cfd13a235e05fc426 ;;
+  *)
+    echo "unsupported typos target: ${TYPOS_TARGET}"
+    exit 1
+    ;;
+esac
+TYPOS_TMPDIR=$(mktemp -d)
+curl -sSfL "${TYPOS_URL}" -o "${TYPOS_TMPDIR}/${TYPOS_ARCHIVE}"
+TYPOS_ACTUAL_SHA256=$(sha256sum "${TYPOS_TMPDIR}/${TYPOS_ARCHIVE}" 2>/dev/null | cut -d' ' -f1)
+if [ -z "${TYPOS_ACTUAL_SHA256}" ]; then
+  TYPOS_ACTUAL_SHA256=$(shasum -a 256 "${TYPOS_TMPDIR}/${TYPOS_ARCHIVE}" | cut -d' ' -f1)
+fi
+if [ "${TYPOS_ACTUAL_SHA256}" != "${TYPOS_SHA256}" ]; then
+  echo "typos archive checksum mismatch: expected ${TYPOS_SHA256}, got ${TYPOS_ACTUAL_SHA256}"
+  exit 1
+fi
+tar xzf "${TYPOS_TMPDIR}/${TYPOS_ARCHIVE}" -C "${TYPOS_TMPDIR}"
+install -m 755 "${TYPOS_TMPDIR}/typos" "$(go env GOPATH)/bin/typos"
+rm -rf "${TYPOS_TMPDIR}"
diff --git a/scripts/spelling.sh b/scripts/spelling.sh
index 8de4e08a..cd069a97 100755
--- a/scripts/spelling.sh
+++ b/scripts/spelling.sh
@@ -1,3 +1,18 @@
 #!/bin/bash
 
-npx cspell --no-progress "**/*.{sh,go,md}"
\ No newline at end of file
+set -euo pipefail
+
+GOPATH_TYPOS="$(go env GOPATH)/bin/typos"
+TYPOS_CMD=""
+
+if [ -f "${GOPATH_TYPOS}" ]; then
+  TYPOS_CMD="${GOPATH_TYPOS}"
+elif command -v typos >/dev/null 2>&1; then
+  TYPOS_CMD="typos"
+else
+  echo "Error: typos not found in $(go env GOPATH)/bin or PATH."
+  echo "Please run scripts/devtools.sh or ensure typos is installed correctly."
+  exit 1
+fi
+
+git ls-files '*.go' '*.sh' '*.md' | "${TYPOS_CMD}" --file-list -