diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml
index cca2eb7cb..36388d688 100644
--- a/.github/workflows/clang-format.yml
+++ b/.github/workflows/clang-format.yml
@@ -5,14 +5,12 @@ on: [push]
 jobs:
   clang-format:
 
-    runs-on: ubuntu-20.04 # latest
+    runs-on: ubuntu-24.04 # latest
 
     steps:
     - name: Checkout Sources
-      uses: actions/checkout@v1
+      uses: actions/checkout@v4
 
     - name: clang-format lint
-      uses: DoozyX/clang-format-lint-action@v0.3.1
-      with:
-        # List of extensions to check
-        extensions: c,h
+      run: |
+        ./format-check.py
diff --git a/format-check.py b/format-check.py
new file mode 100755
index 000000000..b9e3520cc
--- /dev/null
+++ b/format-check.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+import argparse
+import os
+from pathlib import Path
+import re
+from subprocess import list2cmdline, run
+from tempfile import NamedTemporaryFile
+
+CLANG_FORMAT_VERSION = '18.1.6'
+
+INCLUDE_REGEX = re.compile(
+    r'^(include|source|tests|verification)/.*\.(c|h|inl)$')
+EXCLUDE_REGEX = re.compile(r'^$')
+
+arg_parser = argparse.ArgumentParser(description="Check with clang-format")
+arg_parser.add_argument('-i', '--inplace-edit', action='store_true',
+                        help="Edit files inplace")
+args = arg_parser.parse_args()
+
+os.chdir(Path(__file__).parent)
+
+# create file containing list of all files to format
+filepaths_file = NamedTemporaryFile(delete=False)
+for dirpath, dirnames, filenames in os.walk('.'):
+    for filename in filenames:
+        # our regexes expect filepath to use forward slash
+        filepath = Path(dirpath, filename).as_posix()
+        if not INCLUDE_REGEX.match(filepath):
+            continue
+        if EXCLUDE_REGEX.match(filepath):
+            continue
+
+        filepaths_file.write(f"{filepath}\n".encode())
+filepaths_file.close()
+
+# use pipx to run clang-format from PyPI
+# this is a simple way to run the same clang-format version regardless of OS
+cmd = ['pipx', 'run', f'clang-format=={CLANG_FORMAT_VERSION}',
+       f'--files={filepaths_file.name}']
+if args.inplace_edit:
+    cmd += ['-i']
+else:
+    cmd += ['--Werror', '--dry-run']
+
+print(f"{Path.cwd()}$ {list2cmdline(cmd)}")
+if run(cmd).returncode:
+    exit(1)
diff --git a/format-check.sh b/format-check.sh
deleted file mode 100755
index f330cf70e..000000000
--- a/format-check.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/bash
-
-if [[ -z $CLANG_FORMAT ]] ; then
-    CLANG_FORMAT=clang-format
-fi
-
-if NOT type $CLANG_FORMAT 2> /dev/null ; then
-    echo "No appropriate clang-format found."
-    exit 1
-fi
-
-FAIL=0
-SOURCE_FILES=`find source include tests -type f \( -name '*.h' -o -name '*.c' \)`
-for i in $SOURCE_FILES
-do
-    $CLANG_FORMAT -output-replacements-xml $i | grep -c "<replacement " > /dev/null
-    if [ $? -ne 1 ]
-    then
-        echo "$i failed clang-format check."
-        FAIL=1
-    fi
-done
-
-exit $FAIL
diff --git a/include/aws/io/channel_bootstrap.h b/include/aws/io/channel_bootstrap.h
index e65794756..81ce0696f 100644
--- a/include/aws/io/channel_bootstrap.h
+++ b/include/aws/io/channel_bootstrap.h
@@ -42,10 +42,9 @@ typedef void(aws_client_bootstrap_on_channel_event_fn)(
  * If ALPN is being used this function will be invoked by the channel once an ALPN message is received. The returned
  * channel_handler will be added to, and managed by, the channel.
  */
-typedef struct aws_channel_handler *(aws_channel_on_protocol_negotiated_fn)(
-    struct aws_channel_slot *new_slot,
-    struct aws_byte_buf *protocol,
-    void *user_data);
+typedef struct aws_channel_handler *(aws_channel_on_protocol_negotiated_fn)(struct aws_channel_slot *new_slot,
+                                                                            struct aws_byte_buf *protocol,
+                                                                            void *user_data);
 
 struct aws_tls_connection_options;
 
diff --git a/include/aws/io/event_loop.h b/include/aws/io/event_loop.h
index a3b552d6e..58041a4c7 100644
--- a/include/aws/io/event_loop.h
+++ b/include/aws/io/event_loop.h
@@ -129,10 +129,9 @@ struct aws_event_loop_options {
     struct aws_thread_options *thread_options;
 };
 
-typedef struct aws_event_loop *(aws_new_event_loop_fn)(
-    struct aws_allocator *alloc,
-    const struct aws_event_loop_options *options,
-    void *new_loop_user_data);
+typedef struct aws_event_loop *(aws_new_event_loop_fn)(struct aws_allocator *alloc,
+                                                       const struct aws_event_loop_options *options,
+                                                       void *new_loop_user_data);
 
 struct aws_event_loop_group {
     struct aws_allocator *allocator;
diff --git a/include/aws/io/tls_channel_handler.h b/include/aws/io/tls_channel_handler.h
index 04d331f7e..f44335b12 100644
--- a/include/aws/io/tls_channel_handler.h
+++ b/include/aws/io/tls_channel_handler.h
@@ -278,11 +278,10 @@ enum aws_tls_negotiation_status {
  * aws_tls_handler_new_fn contains multiple callbacks. Namely: aws_tls_on_negotiation_result_fn. You are responsible for
  * invoking this function when TLs session negotiation has completed.
  */
-typedef struct aws_channel_handler *(aws_tls_handler_new_fn)(
-    struct aws_allocator *allocator,
-    struct aws_tls_connection_options *options,
-    struct aws_channel_slot *slot,
-    void *user_data);
+typedef struct aws_channel_handler *(aws_tls_handler_new_fn)(struct aws_allocator *allocator,
+                                                             struct aws_tls_connection_options *options,
+                                                             struct aws_channel_slot *slot,
+                                                             void *user_data);
 
 /**
  * Invoked when it's time to start TLS negotiation. Note: the aws_tls_options passed to your aws_tls_handler_new_fn
diff --git a/source/darwin/secure_transport_tls_channel_handler.c b/source/darwin/secure_transport_tls_channel_handler.c
index 924399201..85fe5ea57 100644
--- a/source/darwin/secure_transport_tls_channel_handler.c
+++ b/source/darwin/secure_transport_tls_channel_handler.c
@@ -85,8 +85,7 @@ void aws_tls_init_static_state(struct aws_allocator *alloc) {
     }
 }
 
-void aws_tls_clean_up_static_state(void) { /* no op */
-}
+void aws_tls_clean_up_static_state(void) { /* no op */ }
 
 struct secure_transport_handler {
     struct aws_channel_handler handler;
diff --git a/source/io.c b/source/io.c
index c47ce97a9..380ece11b 100644
--- a/source/io.c
+++ b/source/io.c
@@ -9,7 +9,7 @@
 #include <aws/cal/cal.h>
 #include <aws/io/private/tracing.h>
 
-#define AWS_DEFINE_ERROR_INFO_IO(CODE, STR) [(CODE)-0x0400] = AWS_DEFINE_ERROR_INFO(CODE, STR, "aws-c-io")
+#define AWS_DEFINE_ERROR_INFO_IO(CODE, STR) [(CODE) - 0x0400] = AWS_DEFINE_ERROR_INFO(CODE, STR, "aws-c-io")
 
 #define AWS_DEFINE_ERROR_PKCS11_CKR(CKR)                                                                               \
     AWS_DEFINE_ERROR_INFO_IO(                                                                                          \
diff --git a/source/windows/iocp/iocp_event_loop.c b/source/windows/iocp/iocp_event_loop.c
index b6716a543..313344ab9 100644
--- a/source/windows/iocp/iocp_event_loop.c
+++ b/source/windows/iocp/iocp_event_loop.c
@@ -520,7 +520,7 @@ static int s_connect_to_io_completion_port(struct aws_event_loop *event_loop, st
     /* iocp_handle should be the event loop's handle if this succeeded */
     bool iocp_associated = iocp_handle == impl->iocp_handle;
 
-/* clang-format off */
+    /* clang-format off */
 #if defined(AWS_SUPPORT_WIN7)
     /*
      * When associating named pipes, it is possible to open the same pipe in the same