diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ada5dd74f089..22a0ebc84c9d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -117,6 +117,9 @@ jobs:
         run: |
           ./mvnw test -am -pl "$(.github/scripts/find-modules-with-unit-tests.sh)"
 
+      - name: Sanity Check
+        run: ./mvnw rewrite:dryRun
+
   base-integration-tests:
     name: Base IT
     needs: build
diff --git a/boms/pom.xml b/boms/pom.xml
index a9f5de04ddb8..9f615be03ced 100644
--- a/boms/pom.xml
+++ b/boms/pom.xml
@@ -82,6 +82,30 @@
                     <groupId>com.diffplug.spotless</groupId>
                     <artifactId>spotless-maven-plugin</artifactId>
                     <version>${spotless-plugin.version}</version>
+                    <configuration>
+                        <java>
+                            <removeUnusedImports />
+                        </java>
+                    </configuration>
+                </plugin>
+                <plugin>
+                    <groupId>org.openrewrite.maven</groupId>
+                    <artifactId>rewrite-maven-plugin</artifactId>
+                    <version>6.23.0</version>
+                    <configuration>
+                        <activeRecipes>
+                            <recipe>org.keycloak.openrewrite.SanityCheck</recipe>
+                        </activeRecipes>
+                        <exportDatatables>true</exportDatatables>
+                        <failOnDryRunResults>true</failOnDryRunResults>
+                    </configuration>
+                    <dependencies>
+                        <dependency>
+                            <groupId>org.openrewrite.recipe</groupId>
+                            <artifactId>rewrite-rewrite</artifactId>
+                            <version>0.15.0</version>
+                        </dependency>
+                    </dependencies>
                 </plugin>
             </plugins>
         </pluginManagement>
diff --git a/pom.xml b/pom.xml
index d3cabd03cb9f..efd145e344fc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1557,6 +1557,25 @@
                         </java>
                     </configuration>
                 </plugin>
+                <plugin>
+                    <groupId>org.openrewrite.maven</groupId>
+                    <artifactId>rewrite-maven-plugin</artifactId>
+                    <version>6.23.0</version>
+                    <configuration>
+                        <activeRecipes>
+                            <recipe>org.keycloak.openrewrite.SanityCheck</recipe>
+                        </activeRecipes>
+                        <exportDatatables>true</exportDatatables>
+                        <failOnDryRunResults>true</failOnDryRunResults>
+                    </configuration>
+                    <dependencies>
+                        <dependency>
+                            <groupId>org.openrewrite.recipe</groupId>
+                            <artifactId>rewrite-rewrite</artifactId>
+                            <version>0.15.0</version>
+                        </dependency>
+                    </dependencies>
+                </plugin>
             </plugins>
         </pluginManagement>
 
diff --git a/rewrite.yml b/rewrite.yml
new file mode 100644
index 000000000000..2374e51540b2
--- /dev/null
+++ b/rewrite.yml
@@ -0,0 +1,8 @@
+---
+type: specs.openrewrite.org/v1beta/recipe
+name: org.keycloak.openrewrite.SanityCheck
+displayName: Apply Java & Maven best practices
+description: Comprehensive code quality recipe combining modernization, security, and best practices.
+recipeList:
+  - org.openrewrite.java.security.JavaSecurityBestPractices
+---