diff --git a/flake.lock b/flake.lock
index 3fc95f3..fe90317 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780243769,
-        "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=",
+        "lastModified": 1783522502,
+        "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c",
+        "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612",
         "type": "github"
       },
       "original": {
@@ -18,28 +18,7 @@
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs",
-        "treefmt-nix": "treefmt-nix"
-      }
-    },
-    "treefmt-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780220602,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "treefmt-nix",
-        "type": "github"
+        "nixpkgs": "nixpkgs"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index 4b3ba5c..9b61420 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,33 +1,12 @@
 {
   description = "declarative-runtime: declarative NixOS service runtime config via paired OpenTofu providers";
 
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    treefmt-nix.url = "github:numtide/treefmt-nix";
-    treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
-  };
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
   outputs =
-    {
-      self,
-      nixpkgs,
-      treefmt-nix,
-    }:
+    inputs:
     let
-      systems = [
-        "x86_64-linux"
-        "aarch64-linux"
-      ];
-      forAllSystems =
-        f:
-        nixpkgs.lib.genAttrs systems (
-          system:
-          f {
-            inherit system;
-            pkgs = nixpkgs.legacyPackages.${system};
-          }
-        );
-      treefmtEval = forAllSystems ({ pkgs, ... }: treefmt-nix.lib.evalModule pkgs ./treefmt.nix);
+      inherit (inputs.nixpkgs) lib;
       # runnable examples (see ./examples/<name>/README.md). each `name`
       # surfaces as `nix run .#<name>` (the qemu vm) and as an eval-only
       # check, so option-name drift fails CI without paying for a full vm test.
@@ -36,10 +15,10 @@
       };
       exampleSystem =
         system: cfg:
-        nixpkgs.lib.nixosSystem {
+        lib.nixosSystem {
           inherit system;
           modules = [
-            self.nixosModules.default
+            inputs.self.nixosModules.default
             cfg
           ];
         };
@@ -51,29 +30,63 @@
       nixosModules.forgejo = ./services/forgejo/module.nix;
       nixosModules.keycloak = ./services/keycloak/module.nix;
 
-      nixosConfigurations = nixpkgs.lib.mapAttrs' (
-        name: cfg: nixpkgs.lib.nameValuePair "example-${name}" (exampleSystem "x86_64-linux" cfg)
+      nixosConfigurations = lib.mapAttrs' (
+        name: cfg: lib.nameValuePair "example-${name}" (exampleSystem "x86_64-linux" cfg)
       ) examples;
 
-      packages = forAllSystems (
-        { system, ... }:
-        nixpkgs.lib.mapAttrs (name: cfg: (exampleSystem system cfg).config.system.build.vm) examples
-      );
+      packages = lib.mapAttrs (
+        system: _pkgs: lib.mapAttrs (_name: cfg: (exampleSystem system cfg).config.system.build.vm) examples
+      ) inputs.nixpkgs.legacyPackages;
 
-      checks = forAllSystems (
-        { pkgs, system }:
-        # Per-service checks (one attrset per pairing under ./services/<svc>).
-        (import ./services/forgejo/checks.nix { inherit pkgs self; })
-        // (import ./services/keycloak/checks.nix { inherit pkgs self; })
-        // (nixpkgs.lib.mapAttrs' (
+      checks = lib.mapAttrs (
+        system: pkgs:
+        import ./services/forgejo/checks.nix {
+          inherit pkgs;
+          inherit (inputs) self;
+        }
+        // (import ./services/keycloak/checks.nix {
+          inherit pkgs;
+          inherit (inputs) self;
+        })
+        // (lib.mapAttrs' (
           name: cfg:
-          nixpkgs.lib.nameValuePair "example-${name}" (exampleSystem system cfg).config.system.build.toplevel
+          lib.nameValuePair "example-${name}" (exampleSystem system cfg).config.system.build.toplevel
         ) examples)
         // {
-          formatting = treefmtEval.${system}.config.build.check self;
+          formatting = inputs.self.formatter.${system}.check inputs.self;
         }
-      );
+      ) inputs.nixpkgs.legacyPackages;
 
-      formatter = forAllSystems ({ system, ... }: treefmtEval.${system}.config.build.wrapper);
+      formatter = lib.mapAttrs (
+        _: pkgs:
+        pkgs.treefmt.withConfig {
+          settings = {
+            tree-root-file = "flake.nix";
+            on-unmatched = "info";
+            formatter = {
+              nixfmt = {
+                command = lib.getExe pkgs.nixfmt;
+                includes = [ "*.nix" ];
+              };
+              statix = {
+                command = lib.getExe pkgs.statix;
+                options = [ "fix" ];
+                no-positional-arg-support = true;
+                includes = [ "*.nix" ];
+              };
+              deadnix = {
+                command = lib.getExe pkgs.deadnix;
+                options = [ "--edit" ];
+                includes = [ "*.nix" ];
+              };
+              prettier = {
+                command = lib.getExe pkgs.prettier;
+                options = [ "--write" ];
+                includes = [ "*.md" ];
+              };
+            };
+          };
+        }
+      ) inputs.nixpkgs.legacyPackages;
     };
 }
diff --git a/modules/lib/default.nix b/modules/lib/default.nix
index c6034a4..c9af551 100644
--- a/modules/lib/default.nix
+++ b/modules/lib/default.nix
@@ -133,13 +133,13 @@ rec {
                 if refSpec.required or false then
                   lib.mkOption {
                     type = base;
-                    description = refSpec.description;
+                    inherit (refSpec) description;
                   }
                 else
                   lib.mkOption {
                     type = ty.nullOr base;
                     default = null;
-                    description = refSpec.description;
+                    inherit (refSpec) description;
                   }
               ) spec.refs
               // lib.listToAttrs (
@@ -157,7 +157,7 @@ rec {
           }
         );
         default = { };
-        description = spec.description;
+        inherit (spec) description;
       }
     ) resourceTypes;
 
diff --git a/services/forgejo/module.nix b/services/forgejo/module.nix
index 60dfef5..c44f6bf 100644
--- a/services/forgejo/module.nix
+++ b/services/forgejo/module.nix
@@ -91,7 +91,7 @@ in
       declarative-forgejo = tflib.mkReconcileService {
         name = "declarative-forgejo";
         tfConfig = tf.config;
-        credentials = tf.credentials;
+        inherit (tf) credentials;
         afterUnits = [ "forgejo.service" ] ++ lib.optional bootstrapToken "${tokenServiceName}.service";
         healthUrl = "${cfg.baseUrl}/api/healthz";
         tokenFile = effectiveTokenFile;
diff --git a/services/keycloak/lib.nix b/services/keycloak/lib.nix
index 0b4ad91..7f60a11 100644
--- a/services/keycloak/lib.nix
+++ b/services/keycloak/lib.nix
@@ -13,7 +13,6 @@ let
     oSub
     oListSub
     rStr
-    rBool
     ;
 
   provider = pkgs.terraform-providers.keycloak_keycloak;
diff --git a/services/keycloak/module.nix b/services/keycloak/module.nix
index 7b64a39..427ed25 100644
--- a/services/keycloak/module.nix
+++ b/services/keycloak/module.nix
@@ -33,9 +33,7 @@ let
 in
 {
   options.services.keycloak.runtime = {
-    enable = mkEnableOption (
-      "declarative keycloak runtime config, applied via OpenTofu after keycloak.service starts"
-    );
+    enable = mkEnableOption "declarative keycloak runtime config, applied via OpenTofu after keycloak.service starts";
 
     baseUrl = mkOption {
       type = types.str;
diff --git a/treefmt.nix b/treefmt.nix
deleted file mode 100644
index e7a4f42..0000000
--- a/treefmt.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ ... }:
-{
-  projectRootFile = "flake.nix";
-  programs.nixfmt.enable = true;
-
-  # Markdown formatting. Scoped to *.md so prettier does not touch JSON/YAML/JS.
-  programs.prettier = {
-    enable = true;
-    includes = [ "*.md" ];
-  };
-}