diff --git a/.sops.yaml b/.sops.yaml
index e40716b..72b601e 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -6,76 +6,76 @@ creation_rules:
   - path_regex: secrets/de3911/yt.yaml
     key_groups:
       - age:
-        - *yt
-        - *cy
+          - *yt
+          - *cy
   - path_regex: secrets/de3911/chunk.yaml
     key_groups:
       - age:
-        - *chunk
-        - *cy
+          - *chunk
+          - *cy
   - path_regex: secrets/services/ntfy.yaml
     key_groups:
       - age:
-        - *chunk
-        - *yt
-        - *cy
+          - *chunk
+          - *yt
+          - *cy
   - path_regex: secrets/restic/yt.yaml
     key_groups:
       - age:
-        - *yt
-        - *cy
+          - *yt
+          - *cy
   - path_regex: secrets/borg/yt.yaml
     key_groups:
       - age:
-        - *yt
-        - *cy
+          - *yt
+          - *cy
   - path_regex: secrets/borg/chunk.yaml
     key_groups:
       - age:
-        - *chunk
-        - *cy
+          - *chunk
+          - *cy
   - path_regex: secrets/wireguard/yt.yaml
     key_groups:
       - age:
-        - *yt
-        - *cy
+          - *yt
+          - *cy
   - path_regex: secrets/wireguard/chunk.yaml
     key_groups:
       - age:
-        - *chunk
-        - *cy
+          - *chunk
+          - *cy
   - path_regex: secrets/services/caddy.yaml
     key_groups:
       - age:
-        - *chunk
-        - *cy
+          - *chunk
+          - *cy
   - path_regex: secrets/services/hedgedoc.yaml
     key_groups:
       - age:
-        - *chunk
-        - *cy
+          - *chunk
+          - *cy
   - path_regex: secrets/services/miniflux.yaml
     key_groups:
       - age:
-        - *chunk
-        - *cy
+          - *chunk
+          - *cy
   - path_regex: secrets/services/gitlab.yaml
     key_groups:
       - age:
-        - *chunk
-        - *cy
+          - *chunk
+          - *cy
   - path_regex: secrets/services/vaultwarden.yaml
     key_groups:
       - age:
-        - *chunk
-        - *cy
+          - *chunk
+          - *cy
   - path_regex: secrets/rclone/chunk.yaml
     key_groups:
       - age:
-        - *chunk
-        - *cy
+          - *chunk
+          - *cy
   - path_regex: secrets/newsboat.yaml
     key_groups:
       - age:
-        - *yt
-        - *cy
+          - *yt
+          - *cy
diff --git a/flake.nix b/flake.nix
index 9d2c7f9..f754bd2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -71,6 +71,9 @@
           projectRootFile = "flake.nix";
           programs.nixfmt.enable = true;
           programs.stylua.enable = true;
+          programs.yamlfmt.enable = true;
+          # sops does its own formatting
+          settings.formatter.yamlfmt.excludes = [ "secrets/*" ];
         }
       );
     in