diff --git a/idresolver/resolver.go b/idresolver/resolver.go
index 75c7015b..57d8f600 100644
--- a/idresolver/resolver.go
+++ b/idresolver/resolver.go
@@ -33,7 +33,7 @@ func BaseDirectory(plcUrl string) *identity.BaseDirectory {
 			Transport: &http.Transport{
 				// did documents are fetched for caller-supplied dids, so the transport refuses
 				// non-public addresses; IDRESOLVER_DEV=1 lifts the guard for local plc instances
-				DialContext:     netutil.SSRFDialer(os.Getenv("IDRESOLVER_DEV") != "1").DialContext,
+				DialContext: netutil.SSRFDialer(os.Getenv("IDRESOLVER_DEV") != "1").DialContext,
 				// would want this around 100ms for services doing lots of handle resolution. Impacts PLC connections as well, but not too bad.
 				IdleConnTimeout: time.Millisecond * 1000,
 				MaxIdleConns:    100,
diff --git a/knot2/crates/knot-xrpc/src/firehose.rs b/knot2/crates/knot-xrpc/src/firehose.rs
index a70bde48..8c35158c 100644
--- a/knot2/crates/knot-xrpc/src/firehose.rs
+++ b/knot2/crates/knot-xrpc/src/firehose.rs
@@ -1565,7 +1565,10 @@ mod tests {
         };
         assert_eq!(sig.len(), 64, "secp256k1 signatures are 64 compact bytes");
         assert!(
-            matches!(payload.remove("seq"), Some(ipld_core::ipld::Ipld::Integer(_))),
+            matches!(
+                payload.remove("seq"),
+                Some(ipld_core::ipld::Ipld::Integer(_))
+            ),
             "a push event still carries seq on the wire, just outside the signature"
         );
         assert!(
@@ -1630,4 +1633,3 @@ mod tests {
         );
     }
 }
-
diff --git a/migrator/migrator.go b/migrator/migrator.go
index 4d228e5e..6716b40d 100644
--- a/migrator/migrator.go
+++ b/migrator/migrator.go
@@ -14,8 +14,8 @@ import (
 	"tangled.org/core/migrator/git"
 	"tangled.org/core/migrator/gitserver"
 	migratoroauth "tangled.org/core/migrator/oauth"
-	"tangled.org/core/netutil"
 	"tangled.org/core/migrator/worker"
+	"tangled.org/core/netutil"
 	"tangled.org/core/xrpc/serviceauth"
 )
 
diff --git a/nix/modules/migrator.nix b/nix/modules/migrator.nix
index 2597fbaa..ecdb580d 100644
--- a/nix/modules/migrator.nix
+++ b/nix/modules/migrator.nix
@@ -113,20 +113,21 @@ in
           StateDirectory = "migrator";
           Path = [pkgs.git pkgs.git-lfs];
           EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
-          Environment = [
-            "MIGRATOR_LISTEN_ADDR=${cfg.listenAddr}"
-            "MIGRATOR_HOSTNAME=${cfg.hostname}"
-            "MIGRATOR_DB_PATH=${cfg.dbPath}"
-            "MIGRATOR_WORK_DIR=${cfg.workDir}"
-            "MIGRATOR_CONCURRENCY=${toString cfg.concurrency}"
-            "MIGRATOR_JOB_TIMEOUT=${cfg.jobTimeout}"
-            "MIGRATOR_MAX_DISK_BYTES=${toString cfg.maxDiskBytes}"
-            "MIGRATOR_MAX_PACK_BYTES=${toString cfg.maxPackBytes}"
-            "MIGRATOR_PLC_URL=${cfg.plcUrl}"
-          ]
-          ++ lib.optionals (cfg.appUrl != null) [
-            "MIGRATOR_APP_URL=${cfg.appUrl}"
-          ];
+          Environment =
+            [
+              "MIGRATOR_LISTEN_ADDR=${cfg.listenAddr}"
+              "MIGRATOR_HOSTNAME=${cfg.hostname}"
+              "MIGRATOR_DB_PATH=${cfg.dbPath}"
+              "MIGRATOR_WORK_DIR=${cfg.workDir}"
+              "MIGRATOR_CONCURRENCY=${toString cfg.concurrency}"
+              "MIGRATOR_JOB_TIMEOUT=${cfg.jobTimeout}"
+              "MIGRATOR_MAX_DISK_BYTES=${toString cfg.maxDiskBytes}"
+              "MIGRATOR_MAX_PACK_BYTES=${toString cfg.maxPackBytes}"
+              "MIGRATOR_PLC_URL=${cfg.plcUrl}"
+            ]
+            ++ lib.optionals (cfg.appUrl != null) [
+              "MIGRATOR_APP_URL=${cfg.appUrl}"
+            ];
           LoadCredential = [
             "master-key:${cfg.masterKeyFile}"
             "private-key:${cfg.privateKeyFile}"
diff --git a/spindle/engine/mask_test.go b/spindle/engine/mask_test.go
index d6b34d7c..666c3dbd 100644
--- a/spindle/engine/mask_test.go
+++ b/spindle/engine/mask_test.go
@@ -325,7 +325,7 @@ func TestWorkflowProceedsWhenTheIssuerWithholdsTheToken(t *testing.T) {
 	eng := newEchoEngine()
 	// what an identity the issuer refuses to sign looks like by the time a
 	// workflow runs: a minter that yields no token and no error
-	runEchoPipelineRecords(t, eng, &models.Pipeline{		RepoDid:       "did:plc:boltless",
+	runEchoPipelineRecords(t, eng, &models.Pipeline{RepoDid: "did:plc:boltless",
 		TrustedSource: true,
 		MintIDToken:   func(time.Duration, string) (string, error) { return "", nil },
 	}, audienceRecord("build", "vault"))
diff --git a/spindle/models/pipeline.go b/spindle/models/pipeline.go
index c0bc224f..70ec6f88 100644
--- a/spindle/models/pipeline.go
+++ b/spindle/models/pipeline.go
@@ -16,7 +16,8 @@ type Pipeline struct {
 	// used to resolve cache hash files against the checkout the workflow builds
 	TriggerMetadata *tangled.Pipeline_TriggerMetadata
 	// mint after slot acquisition, unrecordable runs return ("", nil), errors abort the workflow
-	MintIDToken func(workflowTimeBudget time.Duration, audience string) (string, error)}
+	MintIDToken func(workflowTimeBudget time.Duration, audience string) (string, error)
+}
 
 func TrustedPipelineSource(metadata *tangled.Pipeline_TriggerMetadata, target string) bool {
 	targetDid, err := syntax.ParseDID(target)
@@ -63,5 +64,5 @@ type Workflow struct {
 	CacheBindings  []CacheBinding
 	CacheNamespace string
 	Engine         string
-	Audience string
+	Audience       string
 }
diff --git a/spindle/oidc/issuer_test.go b/spindle/oidc/issuer_test.go
index d7a69cde..83c3a8e8 100644
--- a/spindle/oidc/issuer_test.go
+++ b/spindle/oidc/issuer_test.go
@@ -21,7 +21,7 @@ import (
 )
 
 const (
-	testIssuer  = "https://tokens.spindle.tangled.sh"
+	testIssuer   = "https://tokens.spindle.tangled.sh"
 	testAudience = "//iam.googleapis.com/projects/1/locations/global/workloadIdentityPools/tangled/providers/spindle"
 )