diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 0e8d48ace7..d2ac9493f4 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -4,6 +4,15 @@ Changelog
 in development
 --------------
 
+Added
+~~~~~
+
+* Continue introducing `pants <https://www.pantsbuild.org/docs>`_ to improve DX (Developer Experience)
+  working on StackStorm, improve our security posture, and improve CI reliability thanks in part
+  to pants' use of PEX lockfiles. This is not a user-facing addition.
+  #5778
+  Contributed by @cognifloyd
+
 
 3.8.0 - November 18, 2022
 -------------------------
diff --git a/lint-configs/regex-lint.yaml b/lint-configs/regex-lint.yaml
new file mode 100644
index 0000000000..624d2abbd0
--- /dev/null
+++ b/lint-configs/regex-lint.yaml
@@ -0,0 +1,101 @@
+# Note that for values that are regexes, how YAML interprets backslashes and other
+# special characters matters. For example, an unquoted string is interpreted as a raw
+# string with no escape characters (so it's particularly useful for expressing regexes).
+# Adding quotes around these may change their meaning, so don't do so without thought.
+
+required_matches:
+  # If we decide to enable this, remove the st2flake8
+  #python_source:
+  #  - python_header
+  #build_files:
+  #  - python_header
+
+  # TODO: In the future pants should get `visibility` and possibly other
+  #       features to restrict imports for dependees or dependencies.
+  #       - https://github.com/pantsbuild/pants/issues/13393
+  #       - https://github.com/pantsbuild/pants/pull/15803
+  #       - https://github.com/pantsbuild/pants/pull/15836
+  #       When that happens, we can add that target metadata,
+  #       and remove these regex based dependency checks.
+
+  # st2client-dependencies-check
+  st2client:
+    - must_not_import_st2common
+
+  # st2common-circular-dependencies-check
+  st2common:
+    - must_not_import_st2reactor
+    - must_not_import_st2api
+    - must_not_import_st2auth
+    #- must_not_import_st2actions
+    #- must_not_import_st2stream
+  st2common_except_services_inquiry:
+    # The makefile excluded: runnersregistrar.py, compat.py, inquiry.py
+    # runnersregistrar does not have an st2actions ref since 2016.
+    # compat.py st2actions function was added and removed in 2017.
+    # services/inquiry.py still imports st2actions.
+    - must_not_import_st2actions
+  st2common_except_router:
+    # The makefile excluded router.py from st2stream check.
+    # In router.py, "st2stream" is a string, not an import.
+    - must_not_import_st2stream
+
+path_patterns:
+  #- name: python_source
+  #  pattern: (?<!__init__)\.py$
+  #- name: build_files
+  #  pattern: /BUILD$
+
+  - name: st2client
+    pattern: st2client/st2client/.*\.py$
+  - name: st2common
+    pattern: st2common/st2common/.*\.py$
+
+  - name: st2common_except_services_inquiry
+    pattern: st2common/st2common/(?!services/inquiry\.py).*\.py$
+
+  - name: st2common_except_router
+    pattern: st2common/st2common/(?!router\.py).*\.py$
+
+content_patterns:
+  #- name: python_header
+  #  pattern: |+
+  #    ^(?:#\!\/usr\/bin\/env python3
+  #    )?# Copyright 20\d\d The StackStorm Authors.
+  #    (?:# Copyright 20\d\d .*
+  #    )*#
+  #    # Licensed under the Apache License, Version 2.0 (the "License");
+  #    # you may not use this file except in compliance with the License.
+  #    # You may obtain a copy of the License at
+  #    #
+  #    #     http://www.apache.org/licenses/LICENSE-2.0
+  #    #
+  #    # Unless required by applicable law or agreed to in writing, software
+  #    # distributed under the License is distributed on an "AS IS" BASIS,
+  #    # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  #    # See the License for the specific language governing permissions and
+  #    # limitations under the License.
+
+  - name: must_not_import_st2common
+    pattern: st2common
+    inverted: true
+
+  - name: must_not_import_st2reactor
+    pattern: st2reactor
+    inverted: true
+
+  - name: must_not_import_st2actions
+    pattern: st2actions
+    inverted: true
+
+  - name: must_not_import_st2api
+    pattern: st2api
+    inverted: true
+
+  - name: must_not_import_st2auth
+    pattern: st2auth
+    inverted: true
+
+  - name: must_not_import_st2stream
+    pattern: st2stream
+    inverted: true
diff --git a/pants.toml b/pants.toml
index a3ef441e02..1e128d6442 100644
--- a/pants.toml
+++ b/pants.toml
@@ -112,3 +112,6 @@ extra_requirements = [
   "st2flake8==0.1.0",  # TODO: remove in favor of regex-lint
 ]
 config = "lint-configs/python/.flake8"
+
+[regex-lint]
+config = "@lint-configs/regex-lint.yaml"