diff --git a/.cirrus.yml b/.cirrus.yml
index df42a1399a..ad4670623d 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -19,6 +19,7 @@ asan_sanitizer_config: &ASAN_SANITIZER_CONFIG --build-type=debug --disable-broke
 ubsan_sanitizer_config: &UBSAN_SANITIZER_CONFIG --build-type=debug --disable-broker-tests --sanitizers=undefined --enable-fuzzers --ccache --enable-werror
 tsan_sanitizer_config: &TSAN_SANITIZER_CONFIG --build-type=debug --disable-broker-tests --sanitizers=thread --enable-fuzzers --ccache --enable-werror
 macos_config: &MACOS_CONFIG --build-type=release --disable-broker-tests --prefix=$CIRRUS_WORKING_DIR/install --ccache --enable-werror --with-krb5=/opt/homebrew/opt/krb5
+clang_tidy_config: &CLANG_TIDY_CONFIG --build-type=debug --disable-broker-tests --prefix=$CIRRUS_WORKING_DIR/install --ccache --enable-werror --enable-clang-tidy
 
 resources_template: &RESOURCES_TEMPLATE
   cpu: *CPUS
@@ -300,10 +301,28 @@ ubuntu24_clang_libcpp_task:
   << : *CI_TEMPLATE
   << : *SKIP_TASK_ON_PR
   env:
-    CC: clang-18
-    CXX: clang++-18
+    CC: clang-19
+    CXX: clang++-19
     CXXFLAGS: -stdlib=libc++
 
+ubuntu24_clang_tidy_task:
+  container:
+    # Ubuntu 24.04 EOL: Jun 2029
+    dockerfile: ci/ubuntu-24.04/Dockerfile
+    << : *RESOURCES_TEMPLATE
+  << : *CI_TEMPLATE
+  # Run on merges to master and release/.* and benchmark-nightly cron.
+  only_if: >
+    ( $CIRRUS_REPO_NAME == 'zeek' || $CIRRUS_REPO_NAME == 'zeek-security' ) &&
+      $CIRRUS_BRANCH == 'master' ||
+      $CIRRUS_BRANCH =~ 'release/.*' ||
+      $CIRRUS_CRON == 'benchmark-nightly'
+  env:
+    CC: clang-19
+    CXX: clang++-19
+    ZEEK_CI_CONFIGURE_FLAGS: *CLANG_TIDY_CONFIG
+
+
 ubuntu22_task:
   container:
     # Ubuntu 22.04 EOL: June 2027
@@ -445,8 +464,8 @@ ubsan_sanitizer_task:
   << : *SKIP_TASK_ON_PR
   test_fuzzers_script: ./ci/test-fuzzers.sh
   env:
-    CC: clang-18
-    CXX: clang++-18
+    CC: clang-19
+    CXX: clang++-19
     CXXFLAGS: -DZEEK_DICT_DEBUG
     ZEEK_CI_CONFIGURE_FLAGS: *UBSAN_SANITIZER_CONFIG
     ZEEK_TAILORED_UB_CHECKS: 1
@@ -459,8 +478,8 @@ ubsan_sanitizer_zam_task:
 
   << : *CI_TEMPLATE
   env:
-    CC: clang-18
-    CXX: clang++-18
+    CC: clang-19
+    CXX: clang++-19
     ZEEK_CI_CONFIGURE_FLAGS: *UBSAN_SANITIZER_CONFIG
     ZEEK_TAILORED_UB_CHECKS: 1
     UBSAN_OPTIONS: print_stacktrace=1
@@ -480,8 +499,8 @@ tsan_sanitizer_task:
   << : *CI_TEMPLATE
   << : *SKIP_TASK_ON_PR
   env:
-    CC: clang-18
-    CXX: clang++-18
+    CC: clang-19
+    CXX: clang++-19
     ZEEK_CI_CONFIGURE_FLAGS: *TSAN_SANITIZER_CONFIG
     ZEEK_CI_DISABLE_SCRIPT_PROFILING: 1
     # If this is defined directly in the environment, configure fails to find
diff --git a/CHANGES b/CHANGES
index fddc964797..5d77f17254 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+8.0.0-dev.291 | 2025-05-30 08:39:28 -0700
+
+  * CI: Add new task to run clang-tidy as part of nightly builds (Tim Wojtulewicz, Corelight)
+
+  * CI: Update to clang 19 on ubuntu 24.04, add clang-tidy package (Tim Wojtulewicz, Corelight)
+
 8.0.0-dev.288 | 2025-05-30 17:24:05 +0200
 
   * GH-4494: logging/ascii/json: Make TS_MILLIS signed, add TS_MILLIS_UNSIGNED (Arne Welzel, Corelight)
diff --git a/VERSION b/VERSION
index 998a6f669c..83a4127c4f 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.0.0-dev.288
+8.0.0-dev.291
diff --git a/ci/ubuntu-24.04/Dockerfile b/ci/ubuntu-24.04/Dockerfile
index 1a7fec855e..47539ddf65 100644
--- a/ci/ubuntu-24.04/Dockerfile
+++ b/ci/ubuntu-24.04/Dockerfile
@@ -4,15 +4,16 @@ ENV DEBIAN_FRONTEND="noninteractive" TZ="America/Los_Angeles"
 
 # A version field to invalidate Cirrus's build cache when needed, as suggested in
 # https://github.com/cirruslabs/cirrus-ci-docs/issues/544#issuecomment-566066822
-ENV DOCKERFILE_VERSION 20241024
+ENV DOCKERFILE_VERSION 20250522
 
 RUN apt-get update && apt-get -y install \
     bc \
     bison \
     bsdmainutils \
     ccache \
-    clang-18 \
-    clang++-18 \
+    clang-19 \
+    clang++-19 \
+    clang-tidy-19 \
     cmake \
     cppzmq-dev \
     curl \
@@ -47,6 +48,10 @@ RUN apt-get update && apt-get -y install \
 RUN pip3 install --break-system-packages websockets junit2html
 RUN gem install coveralls-lcov
 
+# Ubuntu installs clang versions with the binaries having the version number
+# appended. Create a symlink for clang-tidy so cmake finds it correctly.
+RUN update-alternatives --install /usr/bin/clang-tidy clang-tidy /usr/bin/clang-tidy-19 1000
+
 # Download a newer pre-built ccache version that recognizes -fprofile-update=atomic
 # which is used when building with --coverage.
 #