diff --git a/default.nix b/default.nix
index 9b09bbb..04cc0b0 100644
--- a/default.nix
+++ b/default.nix
@@ -1,14 +1,13 @@
 with import <nixpkgs> {};
-
-buildGoModule {
-  name = "systemd-vaultd";
-  src = ./.;
-  vendorSha256 = null;
-  meta = with lib; {
-    description = "A proxy for secrets between systemd services and vault";
-    homepage = "https://github.com/numtide/systemd-vaultd";
-    license = licenses.mit;
-    maintainers = with maintainers; [ mic92 ];
-    platforms = platforms.unix;
-  };
-}
+  buildGoModule {
+    name = "systemd-vaultd";
+    src = ./.;
+    vendorSha256 = null;
+    meta = with lib; {
+      description = "A proxy for secrets between systemd services and vault";
+      homepage = "https://github.com/numtide/systemd-vaultd";
+      license = licenses.mit;
+      maintainers = with maintainers; [mic92];
+      platforms = platforms.unix;
+    };
+  }
diff --git a/main.go b/main.go
index 7c005c9..763c077 100644
--- a/main.go
+++ b/main.go
@@ -22,10 +22,10 @@ type server struct {
 
 func inheritSocket() *net.UnixListener {
 	socks := systemdSockets(true)
-	stat := &syscall.Stat_t {}
+	stat := &syscall.Stat_t{}
 	for _, s := range socks {
 		fd := s.Fd()
-		err := syscall.Fstat(int(fd), stat);
+		err := syscall.Fstat(int(fd), stat)
 		if err != nil {
 			log.Printf("Received invalid file descriptor from systemd for fd%d: %v", fd, err)
 			continue
@@ -35,7 +35,7 @@ func inheritSocket() *net.UnixListener {
 			log.Printf("Received file descriptor %d from systemd that is not a valid socket: %v", fd, err)
 			continue
 		}
-		unixListener, ok := listener.(*net.UnixListener);
+		unixListener, ok := listener.(*net.UnixListener)
 		if !ok {
 			log.Printf("Ignore file descriptor %d from systemd, which is not a unix socket", fd)
 			continue
diff --git a/shell.nix b/shell.nix
index b979210..889794b 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,14 +1,19 @@
-{ pkgs ? import <nixpkgs> {} }:
-
+{pkgs ? import <nixpkgs> {}}:
 with pkgs;
+  mkShell {
+    buildInputs = [
+      python3.pkgs.pytest
+      python3.pkgs.flake8
+      python3.pkgs.black
+      python3.pkgs.mypy
 
-mkShell {
-  buildInputs = [
-    python3.pkgs.pytest
-    golangci-lint
-    vault
-    systemd
-    hivemind
-    go
-  ];
-}
+      gofumpt
+      golangci-lint
+      alejandra
+      vault
+      systemd
+      hivemind
+      go
+      treefmt
+    ];
+  }
diff --git a/tests/test_service.py b/tests/test_service.py
index ea21edb..a6bdb66 100644
--- a/tests/test_service.py
+++ b/tests/test_service.py
@@ -35,7 +35,18 @@ def test_socket_activation(
     secrets_dir.mkdir()
     sock = tempdir / "sock"
 
-    command.run(["systemd-socket-activate", "--listen", str(sock), str(systemd_vault), "-secrets", str(secrets_dir), "-sock", str(sock)])
+    command.run(
+        [
+            "systemd-socket-activate",
+            "--listen",
+            str(sock),
+            str(systemd_vault),
+            "-secrets",
+            str(secrets_dir),
+            "-sock",
+            str(sock),
+        ]
+    )
 
     while not sock.exists():
         time.sleep(0.1)
diff --git a/treefmt.toml b/treefmt.toml
new file mode 100644
index 0000000..3aaedae
--- /dev/null
+++ b/treefmt.toml
@@ -0,0 +1,21 @@
+[formatter.nix]
+command = "alejandra"
+includes = ["*.nix"]
+
+[formatter.python]
+command = "sh"
+options = [
+    "-eucx",
+    """
+flake8 "$@"
+black "$@"
+    """
+]
+includes = ["*.py"]
+excludes = []
+
+[formatter.go]
+command = "gofumpt"
+options = ["-w"]
+includes = ["*.go"]
+excludes = []
diff --git a/watcher.go b/watcher.go
index 15f9401..35248b9 100644
--- a/watcher.go
+++ b/watcher.go
@@ -174,7 +174,7 @@ func (s *server) setupWatcher(dir string) error {
 		return fmt.Errorf("Failed to initialize inotify: %v", err)
 	}
 	flags := uint32(syscall.IN_CREATE | syscall.IN_MOVED_TO | syscall.IN_ONLYDIR)
-	res := os.MkdirAll(dir, 0700)
+	res := os.MkdirAll(dir, 0o700)
 	if err != nil && !os.IsNotExist(res) {
 		return fmt.Errorf("Failed to create secret directory: %v", err)
 	}