diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 16ba927..76d0bd1 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -4,7 +4,6 @@ on:
   workflow_dispatch:
   pull_request:
 
-
 jobs:
   build:
     name: build binary
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index e638deb..ea6ec8a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -83,11 +83,11 @@ jobs:
           actionlint
 
   vendorhash:
-      runs-on: ubuntu-latest
-      permissions:
-        id-token: write
-        contents: read
-      steps:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
diff --git a/flake.lock b/flake.lock
index ad0a993..b2d1f75 100644
--- a/flake.lock
+++ b/flake.lock
@@ -37,7 +37,8 @@
     "root": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "treefmt-nix": "treefmt-nix"
       }
     },
     "systems": {
@@ -54,6 +55,26 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733761991,
+        "narHash": "sha256-s4DalCDepD22jtKL5Nw6f4LP5UwoMcPzPZgHWjAfqbQ=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "0ce9d149d99bc383d1f2d85f31f6ebd146e46085",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index b4418ad..a9a7108 100644
--- a/flake.nix
+++ b/flake.nix
@@ -8,54 +8,74 @@
     flake-utils = {
       url = "github:numtide/flake-utils";
     };
+    treefmt-nix = {
+      url = "github:numtide/treefmt-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = { self, nixpkgs, flake-utils }:
-    flake-utils.lib.eachDefaultSystem
-      (system:
-        let
-          pkgs = nixpkgs.legacyPackages.${system};
-          uplosi = pkgs.buildGoModule {
-            pname = "uplosi";
-            version = "devel";
-            src = ./.;
-            # this needs to be updated together with go.mod / go.sum
-            vendorHash = "sha256-2lJmPNLpI1ksFb0EtcjPjyTy7eX1DKeX0F80k9FtGno=";
-
-            CGO_ENABLED = 0;
-
-            ldflags = [ "-s" ];
-
-            nativeBuildInputs = [ pkgs.installShellFiles ];
-
-            postInstall = ''
-              installShellCompletion --cmd uplosi \
-                --bash <($out/bin/uplosi completion bash) \
-                --fish <($out/bin/uplosi completion fish) \
-                --zsh <($out/bin/uplosi completion zsh)
-            '';
-
-            meta = with pkgs.lib; {
-              description = "Upload OS images to cloud provider";
-              homepage = "https://github.com/edgelesssys/uplosi";
-              maintainers = with maintainers; [ katexochen malt3 ];
-              license = licenses.asl20;
-            };
-          };
-        in
-        {
-          devShells.default = import ./shell.nix { inherit pkgs; };
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      treefmt-nix,
+    }:
+    flake-utils.lib.eachDefaultSystem (
+      system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
 
-          packages = {
-            default = uplosi;
-            uplosi = uplosi;
-          };
+        uplosi = pkgs.buildGoModule {
+          pname = "uplosi";
+          version = "devel";
+          src = ./.;
+          # this needs to be updated together with go.mod / go.sum
+          vendorHash = "sha256-2lJmPNLpI1ksFb0EtcjPjyTy7eX1DKeX0F80k9FtGno=";
+
+          CGO_ENABLED = 0;
+
+          ldflags = [ "-s" ];
+
+          nativeBuildInputs = [ pkgs.installShellFiles ];
 
-          legacyPackages = {
-            nixpkgs = nixpkgs.legacyPackages.${system};
+          postInstall = ''
+            installShellCompletion --cmd uplosi \
+              --bash <($out/bin/uplosi completion bash) \
+              --fish <($out/bin/uplosi completion fish) \
+              --zsh <($out/bin/uplosi completion zsh)
+          '';
+
+          meta = with pkgs.lib; {
+            description = "Upload OS images to cloud provider";
+            homepage = "https://github.com/edgelesssys/uplosi";
+            maintainers = with maintainers; [
+              katexochen
+              malt3
+            ];
+            license = licenses.asl20;
           };
+        };
+
+        treefmtEval = treefmt-nix.lib.evalModule pkgs ./treefmt.nix;
+      in
+      {
+        devShells.default = import ./shell.nix { inherit pkgs; };
+
+        packages = {
+          default = uplosi;
+          inherit uplosi;
+        };
+
+        legacyPackages = {
+          nixpkgs = nixpkgs.legacyPackages.${system};
+        };
+
+        formatter = treefmtEval.config.build.wrapper;
 
-          formatter = nixpkgs.legacyPackages.${system}.nixpkgs-fmt;
-        }
-      );
+        checks = {
+          formatting = treefmtEval.config.build.check self;
+        };
+      }
+    );
 }
diff --git a/hack/build_image.sh b/hack/build_image.sh
index c6b82d3..2f510b8 100755
--- a/hack/build_image.sh
+++ b/hack/build_image.sh
@@ -5,5 +5,5 @@ set -euo pipefail
 target=$(mktemp)
 truncate -s 21MiB "${target}"
 parted -s -a optimal "${target}" -- \
-    mklabel msdos mkpart primary ext4 1MiB 100%
+  mklabel msdos mkpart primary ext4 1MiB 100%
 echo "${target}"
diff --git a/renovate.json5 b/renovate.json5
index 06ced0e..dacd76f 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -1,80 +1,66 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended",
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: [
     ":preserveSemverRanges",
-    "helpers:pinGitHubActionDigests",
-    ":separateMajorReleases",
     ":semanticCommitsDisabled",
+    ":separateMajorReleases",
+    "config:recommended",
+    "helpers:pinGitHubActionDigests",
   ],
-  "commitMessagePrefix": "deps:",
-  "commitMessageAction": "update",
-  "addLabels": [
-    "dependencies"
-  ],
-  "postUpdateOptions": [
+  commitMessagePrefix: "deps:",
+  commitMessageAction: "update",
+  addLabels: [ "dependencies" ],
+  postUpdateOptions: [
     "gomodTidy",
-    "gomodUpdateImportPaths"
+    "gomodUpdateImportPaths",
   ],
-  "prConcurrentLimit": 1,
-  "nix": {
-    "enabled": true,
+  prConcurrentLimit: 1,
+  nix: { enabled: true },
+  lockFileMaintenance: {
+    enabled: true,
+    commitMessageAction: "flake.lock: Update",
+    commitMessagePrefix: null,
+    schedule: [ "before 4am" ],
   },
-  "lockFileMaintenance": {
-      "enabled": true,
-      "commitMessageAction": "flake.lock: Update",
-      "commitMessagePrefix": null,
-      "schedule": ["before 4am"],
-  },
-  "packageRules": [
+  packageRules: [
     {
-      "matchManagers": ["gomod"],
-      "matchDepTypes": ["indirect"],
-      "enabled": true,
+      matchManagers: [ "gomod" ],
+      matchDepTypes: [ "indirect" ],
+      enabled: true,
     },
     {
-      "groupName": "Go indirect dependencies",
-      "matchManagers": [
-        "gomod"
-      ],
-      "matchDepTypes": [
-        "indirect"
-      ],
-      "prPriority": -30,
+      groupName: "Go indirect dependencies",
+      matchManagers: [ "gomod" ],
+      matchDepTypes: [ "indirect" ],
+      prPriority: -30,
     },
     {
-      "groupName": "Go dependencies",
-      "matchManagers": [
-        "gomod"
-      ],
-      "matchDepTypes": [
-        "require"
-      ],
-      "matchUpdateTypes": [
+      groupName: "Go dependencies",
+      matchManagers: [ "gomod" ],
+      matchDepTypes: [ "require" ],
+      matchUpdateTypes: [
+        "bump",
+        "digest",
+        "lockFileMaintenance",
         "minor",
         "patch",
         "pin",
         "pinDigest",
-        "digest",
-        "lockFileMaintenance",
         "rollback",
-        "bump",
       ],
     },
     {
-      "matchManagers": [
-        "github-actions"
-      ],
-      "groupName": "GitHub action dependencies",
-      "matchUpdateTypes": [
+      matchManagers: [ "github-actions" ],
+      groupName: "GitHub action dependencies",
+      matchUpdateTypes: [
+        "bump",
+        "digest",
+        "lockFileMaintenance",
         "minor",
         "patch",
         "pin",
         "pinDigest",
-        "digest",
-        "lockFileMaintenance",
         "rollback",
-        "bump",
       ],
     },
   ],
diff --git a/shell.nix b/shell.nix
index ff9b91c..bf081f9 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,4 +1,5 @@
 { pkgs, ... }:
+
 pkgs.mkShell {
   nativeBuildInputs = with pkgs; [
     go
diff --git a/treefmt.nix b/treefmt.nix
new file mode 100644
index 0000000..47ece74
--- /dev/null
+++ b/treefmt.nix
@@ -0,0 +1,32 @@
+{ lib, pkgs, ... }:
+
+{
+  projectRootFile = "flake.nix";
+  programs = {
+    # keep-sorted start block=true
+    actionlint.enable = true;
+    deadnix.enable = true;
+    formatjson5 = {
+      enable = true;
+      indent = 2;
+      oneElementLines = true;
+      sortArrays = true;
+    };
+    keep-sorted.enable = true;
+    nixfmt.enable = true;
+    shellcheck.enable = true;
+    shfmt.enable = true;
+    statix.enable = true;
+    # keep-sorted end
+  };
+  settings.formatter = {
+    yamlfmt = {
+      command = "${lib.getExe pkgs.yamlfmt}";
+      options = [ "-formatter=retain_line_breaks_single=true" ];
+      includes = [
+        "*.yaml"
+        "*.yml"
+      ];
+    };
+  };
+}