diff --git a/.sops.yaml b/.sops.yaml
index d60c9c2..365eb84 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -13,21 +13,21 @@ keys:
 creation_rules:
   - path_regex: targets/.*/(terraform.tfstate|secrets.auto.tfvars.sops.json)$
     key_groups:
-    - age:
-      - *joerg
-      - *lassulus
-      - *dave
+      - age:
+          - *joerg
+          - *lassulus
+          - *dave
   - path_regex: targets/web01/secrets.yaml$
     key_groups:
-    - age:
-      - *joerg
-      - *lassulus
-      - *dave
-      - *web01
+      - age:
+          - *joerg
+          - *lassulus
+          - *dave
+          - *web01
   - path_regex: targets/web01-new/secrets.yaml$
     key_groups:
-    - age:
-      - *joerg
-      - *lassulus
-      - *dave
-      - *web01
+      - age:
+          - *joerg
+          - *lassulus
+          - *dave
+          - *web01
diff --git a/flake.nix b/flake.nix
index 39c2976..438f34f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -68,6 +68,11 @@
               programs.shellcheck.enable = true;
 
               programs.deno.enable = true;
+
+              programs.ruff.check = true;
+              programs.ruff.format = true;
+              programs.yamlfmt.enable = true;
+
               settings.global.excludes = [
                 # generated files
                 "sops/*"