diff --git a/Dockerfile b/Dockerfile
index 28afbad..c3d2974 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,6 +14,7 @@ ARG MINGW_VERSION=10.0.0
 ARG MPC_VERSION=1.2.1
 ARG MPFR_VERSION=4.1.0
 ARG NASM_VERSION=2.15.05
+ARG CPPCHECK_VERSION=2.8
 ARG VIM_VERSION=9.0
 
 RUN apt-get update && apt-get install --yes --no-install-recommends \
@@ -21,7 +22,7 @@ RUN apt-get update && apt-get install --yes --no-install-recommends \
 
 # Download, verify, and unpack
 
-RUN curl --insecure --location --remote-name-all \
+RUN curl --insecure --location --remote-name-all --remote-header-name \
     https://ftp.gnu.org/gnu/binutils/binutils-$BINUTILS_VERSION.tar.xz \
     https://ftp.gnu.org/gnu/gcc/gcc-$GCC_VERSION/gcc-$GCC_VERSION.tar.xz \
     https://ftp.gnu.org/gnu/gdb/gdb-$GDB_VERSION.tar.xz \
@@ -34,7 +35,8 @@ RUN curl --insecure --location --remote-name-all \
     http://ftp.vim.org/pub/vim/unix/vim-$VIM_VERSION.tar.bz2 \
     https://www.nasm.us/pub/nasm/releasebuilds/$NASM_VERSION/nasm-$NASM_VERSION.tar.xz \
     http://deb.debian.org/debian/pool/main/u/universal-ctags/universal-ctags_0+git$CTAGS_VERSION.orig.tar.gz \
-    https://downloads.sourceforge.net/project/mingw-w64/mingw-w64/mingw-w64-release/mingw-w64-v$MINGW_VERSION.tar.bz2
+    https://downloads.sourceforge.net/project/mingw-w64/mingw-w64/mingw-w64-release/mingw-w64-v$MINGW_VERSION.tar.bz2 \
+    https://github.com/danmar/cppcheck/archive/$CPPCHECK_VERSION.tar.gz
 COPY src/SHA256SUMS $PREFIX/src/
 RUN sha256sum -c $PREFIX/src/SHA256SUMS \
  && tar xJf binutils-$BINUTILS_VERSION.tar.xz \
@@ -49,7 +51,8 @@ RUN sha256sum -c $PREFIX/src/SHA256SUMS \
  && tar xzf make-$MAKE_VERSION.tar.gz \
  && tar xjf mingw-w64-v$MINGW_VERSION.tar.bz2 \
  && tar xJf nasm-$NASM_VERSION.tar.xz \
- && tar xjf vim-$VIM_VERSION.tar.bz2
+ && tar xjf vim-$VIM_VERSION.tar.bz2 \
+ && tar xzf cppcheck-$CPPCHECK_VERSION.tar.gz
 COPY src/w64devkit.c src/w64devkit.ico src/alias.c src/debugbreak.c \
      $PREFIX/src/
 
@@ -413,6 +416,20 @@ RUN sed -i /RT_MANIFEST/d win32/ctags.rc \
         OPT= CFLAGS=-Os LDFLAGS=-s \
  && cp ctags.exe $PREFIX/bin/
 
+WORKDIR /cppcheck-$CPPCHECK_VERSION
+RUN $ARCH-g++ -Os -s -o cppcheck.exe \
+    -Ilib -Iexternals/simplecpp -Iexternals/tinyxml2 -Iexternals/picojson \
+    cli/*.cpp lib/*.cpp \
+    externals/tinyxml2/tinyxml2.cpp externals/simplecpp/simplecpp.cpp \
+    -lshlwapi \
+ && mkdir $PREFIX/share/cppcheck/ \
+ && cp -r cppcheck.exe cfg/ $PREFIX/share/cppcheck \
+ && $ARCH-gcc -DEXE=../share/cppcheck/cppcheck.exe -DCMD=cppcheck \
+        -Os -ffreestanding -fno-ident -fno-asynchronous-unwind-tables \
+        -s -nostdlib \
+        -o $PREFIX/bin/cppcheck.exe \
+        $PREFIX/src/alias.c -lkernel32
+
 # Pack up a release
 
 WORKDIR /
diff --git a/README.md b/README.md
index 20b8b83..ae118c4 100644
--- a/README.md
+++ b/README.md
@@ -13,6 +13,7 @@ Included tools:
 * [Vim][vim] : powerful text editor
 * [Universal Ctags][ctags] : source navigation
 * [NASM][nasm] : x86 assembler
+* [Cppcheck][cppcheck] : static code analysis
 
 The toolchain includes pthreads, C++11 threads, and OpenMP. All included
 runtime components are static. **Docker/Podman is not required to use the
@@ -75,6 +76,24 @@ including any headers.
 
     $ cc -Os -D__USE_MINGW_ANSI_STDIO=0 ...
 
+## Cppcheck tips
+
+Use `--library=windows` for programs calling the Win32 API directly, which
+adds additional checks. In general, the following configuration is a good
+default for programs developed using w64devkit:
+
+    $ cppcheck --quiet -j$(nproc) --library=windows \
+               --suppress=uninitvar --enable=portability,performance .
+
+A "strict" check that is more thorough, but more false positives:
+
+    $ cppcheck --quiet -j$(nproc) --library=windows \
+          --enable=portability,performance,style \
+          --suppress=uninitvar --suppress=unusedStructMember \
+          --suppress=constVariable --suppress=shadowVariable \
+          --suppress=variableScope --suppress=constParameter \
+          --suppress=shadowArgument --suppress=knownConditionTrueFalse .
+
 ## Fortran support
 
 Only C and C++ are included by default, but w64devkit also has full
@@ -159,6 +178,7 @@ binaries.
 [bb]: https://frippery.org/busybox/
 [break]: https://nullprogram.com/blog/2022/06/26/
 [bs]: https://www.rdegges.com/2016/i-dont-give-a-shit-about-licensing/
+[cppcheck]: https://cppcheck.sourceforge.io/
 [ctags]: https://github.com/universal-ctags/ctags
 [doc-bb]: https://busybox.net/downloads/BusyBox.txt
 [doc-cpp]: https://en.cppreference.com/w/Cppreference:Archives
diff --git a/src/SHA256SUMS b/src/SHA256SUMS
index bfa24da..fef100b 100644
--- a/src/SHA256SUMS
+++ b/src/SHA256SUMS
@@ -1,5 +1,6 @@
 e316477a914f567eccc34d5d29785b8b0f5a10208d36bbacedcc39048ecfe024  binutils-2.38.tar.xz
 4fb69baa813f7ecb305497a2b996220ed5d04c021a4f9d2b3656df10c235c84e  busybox-w32-FRP-4716-g31467ddfc.tgz
+57298f3b805f0eb816a04115fbc70e701f75083cfb0305a44246e365cf27606a  cppcheck-2.8.tar.gz
 f79b8f904b749e3e0d20afeadecf8249c55b2e32d4ebb089ae378df479dcaf25  expat-2.4.8.tar.xz
 62fd634889f31c02b64af2c468f064b47ad1ca78411c45abe6ac4b5f8dd19c7b  gcc-12.1.0.tar.xz
 aaa1223d534c9b700a8bec952d9748ee1977513f178727e1bee520ee000b4f29  gdb-10.2.tar.xz