diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 6ce0c91d..1b96f1ff 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -32,10 +32,11 @@ repos:
   # Local hooks for project-specific tooling
   - repo: local
     hooks:
-      # nixpkgs-fmt for Nix files
-      - id: nixpkgs-fmt
-        name: nixpkgs-fmt
-        entry: nixpkgs-fmt
+      # nixfmt for Nix files; the same formatter the flake's treefmt check
+      # runs, so the hook and the check cannot disagree.
+      - id: nixfmt
+        name: nixfmt
+        entry: nixfmt
         language: system
         files: \.nix$
 
diff --git a/flake.lock b/flake.lock
index 9b461ff6..080e4b5c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -9,11 +9,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1783015821,
-        "narHash": "sha256-vmzYTZxIAy3OYXwkRL5GQYk8fNnh8TLWcxQRIO3ywOU=",
+        "lastModified": 1788072657,
+        "narHash": "sha256-KJ62kJIcGVq3bxaXrKLdHpxyzsb2HYnx99/jqlxMYIw=",
         "owner": "kradalby",
         "repo": "flake-checks",
-        "rev": "3c821706eb0bd07f515f9a7726b650ccae927433",
+        "rev": "13e811640f0cdec4974062d0d43208cec5bdad6c",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 59c82783..ffa8db53 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,11 +11,12 @@
   };
 
   outputs =
-    { self
-    , nixpkgs
-    , flake-utils
-    , flake-checks
-    , ...
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      flake-checks,
+      ...
     }:
     let
       headscaleVersion = self.shortRev or self.dirtyShortRev;
@@ -28,7 +29,8 @@
         default = headscale;
       };
 
-      overlays.default = _: prev:
+      overlays.default =
+        _: prev:
         let
           pkgs = nixpkgs.legacyPackages.${prev.stdenv.hostPlatform.system};
           # Tracks the newest Go in nixpkgs so a Go release bump is a
@@ -96,22 +98,27 @@
           };
         };
     }
-    // flake-utils.lib.eachDefaultSystem
-      (system:
+    // flake-utils.lib.eachDefaultSystem (
+      system:
       let
         pkgs = import nixpkgs {
           overlays = [ self.overlays.default ];
           inherit system;
         };
-        buildDeps = with pkgs; [ git go_latest gnumake ];
-        devDeps = with pkgs;
+        buildDeps = with pkgs; [
+          git
+          go_latest
+          gnumake
+        ];
+        devDeps =
+          with pkgs;
           buildDeps
           ++ [
             golangci-lint
             golangci-lint-langserver
             golines
             prettier
-            nixpkgs-fmt
+            nixfmt
             goreleaser
             nfpm
             gotestsum
@@ -169,7 +176,11 @@
           vendorHash = (builtins.fromJSON (builtins.readFile ./flakehashes.json)).vendor.sri;
           goPkg = pkgs.go_latest;
           # //go:embed targets and test-read files outside the default whitelist.
-          embedDirs = [ ./hscontrol/assets ./hscontrol/db/schema.sql ./config-example.yaml ];
+          embedDirs = [
+            ./hscontrol/assets
+            ./hscontrol/db/schema.sql
+            ./config-example.yaml
+          ];
           extraSrc = [
             ./hscontrol/testdata
             ./hscontrol/types/testdata
@@ -186,49 +197,65 @@
           # from the test set but kept in source so cmd/hi and friends still
           # compile; TestPostgres* needs a server (the SQLite equivalents still
           # run). CGO off matches the build.
-          gotest = fc.goTest (common // {
-            testExclude = [ "/integration" "/hscontrol/servertest" ];
-            goSkip = [ "TestPostgres" ];
-            testEnv = "export CGO_ENABLED=0";
-          });
+          gotest = fc.goTest (
+            common
+            // {
+              testExclude = [
+                "/integration"
+                "/hscontrol/servertest"
+              ];
+              goSkip = [ "TestPostgres" ];
+              testEnv = "export CGO_ENABLED=0";
+            }
+          );
 
           # Full-tree golangci-lint (golines, gofumpt, etc.); uses the overlay's
           # golangci-lint built against the pinned Go.
           golangci-lint = fc.goLint common;
 
-          # nixpkgs-fmt + prettier, excluding generated output. goFmt = "off":
+          # nixfmt + prettier, excluding generated output. goFmt = "off":
           # Go formatting (golines, gofumpt) is enforced by the golangci-lint
           # check, not treefmt. prettierExts matches the old prettier-lint glob
           # (no json: testdata fixtures are hand-formatted).
-          formatting = fc.goFormat (common // {
-            goFmt = "off";
-            prettier = true;
-            prettierExts = [ "ts" "js" "md" "yaml" "yml" "sass" "css" "scss" "html" ];
-            # Mirror .prettierignore (docs/ are mkdocs-flavoured; gen/ generated).
-            fmtExclude = [ ./gen ./docs ];
-          });
+          formatting = fc.goFormat (
+            common
+            // {
+              goFmt = "off";
+              prettier = true;
+              prettierExts = [
+                "ts"
+                "js"
+                "md"
+                "yaml"
+                "yml"
+                "sass"
+                "css"
+                "scss"
+                "html"
+              ];
+              # Mirror .prettierignore (docs/ are mkdocs-flavoured; gen/ generated).
+              fmtExclude = [
+                ./gen
+                ./docs
+              ];
+            }
+          );
         };
       in
       {
         # `nix develop`
         devShells.default = pkgs.mkShell {
-          buildInputs =
-            devDeps
-            ++ [
-              (pkgs.writeShellScriptBin
-                "nix-vendor-sri"
-                ''
-                  set -eu
-                  exec go run ./cmd/vendorhash update "$@"
-                '')
+          buildInputs = devDeps ++ [
+            (pkgs.writeShellScriptBin "nix-vendor-sri" ''
+              set -eu
+              exec go run ./cmd/vendorhash update "$@"
+            '')
 
-              (pkgs.writeShellScriptBin
-                "go-mod-update-all"
-                ''
-                  cat go.mod | ${pkgs.ripgrep}/bin/rg "\t" | ${pkgs.ripgrep}/bin/rg -v '^\s*//' | ${pkgs.ripgrep}/bin/rg -v indirect | ${pkgs.gawk}/bin/awk '{print $1}' | ${pkgs.findutils}/bin/xargs go get -u
-                  go mod tidy
-                '')
-            ];
+            (pkgs.writeShellScriptBin "go-mod-update-all" ''
+              cat go.mod | ${pkgs.ripgrep}/bin/rg "\t" | ${pkgs.ripgrep}/bin/rg -v '^\s*//' | ${pkgs.ripgrep}/bin/rg -v indirect | ${pkgs.gawk}/bin/awk '{print $1}' | ${pkgs.findutils}/bin/xargs go get -u
+              go mod tidy
+            '')
+          ];
 
           shellHook = ''
             export PATH="$PWD/result/bin:$PATH"
@@ -257,5 +284,6 @@
         # The Go build/test checks are gated to Linux: parts of the tree are
         # Linux-specific and the pure unit subset is validated by CI.
         // pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux goChecks;
-      });
+      }
+    );
 }
diff --git a/nix/example-configuration.nix b/nix/example-configuration.nix
index e1f6cec7..d1239f72 100644
--- a/nix/example-configuration.nix
+++ b/nix/example-configuration.nix
@@ -49,7 +49,10 @@
         override_local_dns = true;
 
         nameservers = {
-          global = [ "1.1.1.1" "8.8.8.8" ];
+          global = [
+            "1.1.1.1"
+            "8.8.8.8"
+          ];
         };
       };
 
diff --git a/nix/module.nix b/nix/module.nix
index f47f09e7..8180c76c 100644
--- a/nix/module.nix
+++ b/nix/module.nix
@@ -1,7 +1,8 @@
-{ config
-, lib
-, pkgs
-, ...
+{
+  config,
+  lib,
+  pkgs,
+  ...
 }:
 let
   cfg = config.services.headscale;