diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml
index 88839922..36388d68 100644
--- a/.github/workflows/clang-format.yml
+++ b/.github/workflows/clang-format.yml
@@ -5,14 +5,12 @@ on: [push]
 jobs:
   clang-format:
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04 # latest
 
     steps:
     - name: Checkout Sources
-      uses: actions/checkout@v1
+      uses: actions/checkout@v4
 
     - name: clang-format lint
-      uses: DoozyX/clang-format-lint-action@v0.3.1
-      with:
-        # List of extensions to check
-        extensions: c,h
+      run: |
+        ./format-check.py
diff --git a/format-check.py b/format-check.py
new file mode 100755
index 00000000..b9e3520c
--- /dev/null
+++ b/format-check.py
@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+import argparse
+import os
+from pathlib import Path
+import re
+from subprocess import list2cmdline, run
+from tempfile import NamedTemporaryFile
+
+CLANG_FORMAT_VERSION = '18.1.6'
+
+INCLUDE_REGEX = re.compile(
+    r'^(include|source|tests|verification)/.*\.(c|h|inl)$')
+EXCLUDE_REGEX = re.compile(r'^$')
+
+arg_parser = argparse.ArgumentParser(description="Check with clang-format")
+arg_parser.add_argument('-i', '--inplace-edit', action='store_true',
+                        help="Edit files inplace")
+args = arg_parser.parse_args()
+
+os.chdir(Path(__file__).parent)
+
+# create file containing list of all files to format
+filepaths_file = NamedTemporaryFile(delete=False)
+for dirpath, dirnames, filenames in os.walk('.'):
+    for filename in filenames:
+        # our regexes expect filepath to use forward slash
+        filepath = Path(dirpath, filename).as_posix()
+        if not INCLUDE_REGEX.match(filepath):
+            continue
+        if EXCLUDE_REGEX.match(filepath):
+            continue
+
+        filepaths_file.write(f"{filepath}\n".encode())
+filepaths_file.close()
+
+# use pipx to run clang-format from PyPI
+# this is a simple way to run the same clang-format version regardless of OS
+cmd = ['pipx', 'run', f'clang-format=={CLANG_FORMAT_VERSION}',
+       f'--files={filepaths_file.name}']
+if args.inplace_edit:
+    cmd += ['-i']
+else:
+    cmd += ['--Werror', '--dry-run']
+
+print(f"{Path.cwd()}$ {list2cmdline(cmd)}")
+if run(cmd).returncode:
+    exit(1)
diff --git a/format-check.sh b/format-check.sh
deleted file mode 100755
index e1449c5b..00000000
--- a/format-check.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-
-if [[ -z $CLANG_FORMAT ]] ; then
-    CLANG_FORMAT=clang-format
-fi
-
-if NOT type $CLANG_FORMAT 2> /dev/null ; then
-    echo "No appropriate clang-format found."
-    exit 1
-fi
-
-FAIL=0
-SOURCE_FILES=`find source include tests -type f \( -name '*.h' -o -name '*.c' \)`
-for i in $SOURCE_FILES
-do
-    $CLANG_FORMAT -output-replacements-xml $i | grep -c "<replacement " > /dev/null
-    if [ $? -ne 1 ]
-    then
-        echo "$i failed clang-format check."
-        FAIL=1
-    fi
-done
-
-exit $FAIL
diff --git a/tests/secure_tunnel_tests.c b/tests/secure_tunnel_tests.c
index 2638912a..a784a8f8 100644
--- a/tests/secure_tunnel_tests.c
+++ b/tests/secure_tunnel_tests.c
@@ -621,8 +621,8 @@ int aws_websocket_client_connect_mock_fn(const struct aws_websocket_client_conne
     test_fixture->websocket_function_table->on_incoming_frame_complete_fn = options->on_incoming_frame_complete;
 
     void *pointer = test_fixture;
-    struct aws_websocket_on_connection_setup_data websocket_setup = {.error_code = AWS_ERROR_SUCCESS,
-                                                                     .websocket = pointer};
+    struct aws_websocket_on_connection_setup_data websocket_setup = {
+        .error_code = AWS_ERROR_SUCCESS, .websocket = pointer};
 
     (test_fixture->websocket_function_table->on_connection_setup_fn)(&websocket_setup, secure_tunnel);
     secure_tunnel->websocket = pointer;
@@ -1006,8 +1006,10 @@ int aws_websocket_client_connect_fail_once_fn(const struct aws_websocket_client_
         test_fixture->websocket_function_table->on_incoming_frame_complete_fn = options->on_incoming_frame_complete;
 
         void *pointer = test_fixture;
-        struct aws_websocket_on_connection_setup_data websocket_setup = {.error_code = AWS_ERROR_SUCCESS,
-                                                                         .websocket = pointer};
+        struct aws_websocket_on_connection_setup_data websocket_setup = {
+            .error_code = AWS_ERROR_SUCCESS,
+            .websocket = pointer,
+        };
 
         (test_fixture->websocket_function_table->on_connection_setup_fn)(&websocket_setup, secure_tunnel);