diff --git a/Cargo.toml b/Cargo.toml
index f18cf761..a19750c1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,10 +1,6 @@
 [workspace]
 resolver = "3"
-members = [
-    "hive-ag3nt",
-    "hive-c0re",
-    "hive-sh4re",
-]
+members = ["hive-ag3nt", "hive-c0re", "hive-sh4re"]
 
 [workspace.package]
 edition = "2024"
@@ -25,6 +21,14 @@ hive-sh4re = { path = "hive-sh4re" }
 rusqlite = { version = "0.37", features = ["bundled"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-tokio = { version = "1", features = ["io-util", "macros", "net", "process", "rt-multi-thread", "signal", "time"] }
+tokio = { version = "1", features = [
+  "io-util",
+  "macros",
+  "net",
+  "process",
+  "rt-multi-thread",
+  "signal",
+  "time",
+] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
diff --git a/flake.nix b/flake.nix
index 9b480bbc..18f109cc 100644
--- a/flake.nix
+++ b/flake.nix
@@ -34,6 +34,7 @@
           keep-sorted.enable = true;
           nixfmt.enable = true;
           rustfmt.enable = true;
+          taplo.enable = true;
         };
       };
       forAllSystems =
@@ -126,16 +127,38 @@
       checks = forAllSystems (
         {
           treefmt-eval,
+          pkgs,
           naersk-lib,
           ...
         }:
         {
           formatting = treefmt-eval.config.build.check self;
-          clippy = naersk-lib.buildPackage {
-            src = ./.;
-            mode = "clippy";
-            cargoClippyOptions = orig: orig ++ [ "--all-targets" "--" "-D" "warnings" ];
-          };
+          # Clippy as a check: reuse naersk's vendored-deps environment but
+          # replace the build phase with `cargo clippy --workspace --all-targets
+          # -- -D warnings`. Naersk's own `mode = "clippy"` mangles the `--`
+          # separator, so we go through overrideAttrs instead.
+          clippy =
+            (naersk-lib.buildPackage {
+              src = ./.;
+              # Skip the actual build; we only care about the clippy lint.
+              doCheck = false;
+              copyTarget = false;
+            }).overrideAttrs
+              (old: {
+                name = "${old.name}-clippy";
+                nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.clippy ];
+                buildPhase = ''
+                  runHook preBuild
+                  cargo clippy --workspace --all-targets -- -D warnings
+                  runHook postBuild
+                '';
+                installPhase = ''
+                  runHook preInstall
+                  mkdir -p $out
+                  touch $out/.clippy-passed
+                  runHook postInstall
+                '';
+              });
         }
       );
     };
diff --git a/hive-c0re/src/agent_server.rs b/hive-c0re/src/agent_server.rs
index 66d484d5..b08e18f2 100644
--- a/hive-c0re/src/agent_server.rs
+++ b/hive-c0re/src/agent_server.rs
@@ -18,11 +18,7 @@ pub struct AgentSocket {
     pub handle: JoinHandle<()>,
 }
 
-pub fn start(
-    agent: &str,
-    socket_path: &Path,
-    broker: Arc<Broker>,
-) -> Result<AgentSocket> {
+pub fn start(agent: &str, socket_path: &Path, broker: Arc<Broker>) -> Result<AgentSocket> {
     let agent = agent.to_owned();
     if let Some(parent) = socket_path.parent() {
         std::fs::create_dir_all(parent)
diff --git a/hive-c0re/src/approvals.rs b/hive-c0re/src/approvals.rs
index 0dbeac17..8c32c407 100644
--- a/hive-c0re/src/approvals.rs
+++ b/hive-c0re/src/approvals.rs
@@ -36,7 +36,8 @@ impl Approvals {
         }
         let conn = Connection::open(path)
             .with_context(|| format!("open approvals db {}", path.display()))?;
-        conn.execute_batch(SCHEMA).context("apply approvals schema")?;
+        conn.execute_batch(SCHEMA)
+            .context("apply approvals schema")?;
         Ok(Self {
             conn: Mutex::new(conn),
         })
diff --git a/hive-c0re/src/main.rs b/hive-c0re/src/main.rs
index f31f2c1a..ce5aa10e 100644
--- a/hive-c0re/src/main.rs
+++ b/hive-c0re/src/main.rs
@@ -81,7 +81,9 @@ async fn main() -> Result<()> {
         }
         Cmd::List => render(client::request(&cli.socket, HostRequest::List).await?),
         Cmd::Pending => render(client::request(&cli.socket, HostRequest::Pending).await?),
-        Cmd::Approve { id } => render(client::request(&cli.socket, HostRequest::Approve { id }).await?),
+        Cmd::Approve { id } => {
+            render(client::request(&cli.socket, HostRequest::Approve { id }).await?)
+        }
         Cmd::Deny { id } => render(client::request(&cli.socket, HostRequest::Deny { id }).await?),
     }
 }