diff --git a/hosts/forgejo-runner/forgejo-runner.nix b/hosts/forgejo-runner/forgejo-runner.nix
index 7b77981..6c97af6 100644
--- a/hosts/forgejo-runner/forgejo-runner.nix
+++ b/hosts/forgejo-runner/forgejo-runner.nix
@@ -10,6 +10,7 @@
       labels = [
         "debian-stable:docker://docker.io/debian:stable-slim"
         "alpine-latest:docker://docker.io/alpine:latest"
+        "nix-latest:docker://docker.io/nixos/nix:latest"
         "buildkit:docker://docker.io/moby/buildkit:rootless"
       ];
       tokenFile = config.age.secrets.forgejo-runner-token-env.path;
@@ -65,6 +66,7 @@
         images=(
           docker.io/library/debian:stable-slim
           docker.io/library/alpine:latest
+          docker.io/nixos/nix:latest
           docker.io/moby/buildkit:latest
         )
         for image in "''${images[@]}"; do
diff --git a/hosts/monitoring/prometheus.nix b/hosts/monitoring/prometheus.nix
index f913373..c14b3a9 100644
--- a/hosts/monitoring/prometheus.nix
+++ b/hosts/monitoring/prometheus.nix
@@ -32,7 +32,9 @@
         scrape_interval = "15s";
         static_configs = [
           {
-            targets = [ "sql.${config.networking.domain}:${toString config.services.prometheus.exporters.postgres.port}" ];
+            targets = [
+              "sql.${config.networking.domain}:${toString config.services.prometheus.exporters.postgres.port}"
+            ];
           }
         ];
       }
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index f343c2c..60673b9 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -56,7 +56,13 @@ in
     _sql
     _monitoring
   ];
-  "postgres-forgejo.age".publicKeys = xengi ++ kaythxbye ++ [ _sql _git ];
+  "postgres-forgejo.age".publicKeys =
+    xengi
+    ++ kaythxbye
+    ++ [
+      _sql
+      _git
+    ];
   "postgres-extkuma.age".publicKeys = xengi ++ [ _sql ];
   "postgres-baikal.age".publicKeys = xengi ++ [
     _sql
@@ -68,8 +74,20 @@ in
   "caldav-export-config.age".publicKeys = xengi ++ [ _www ];
   "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ];
   "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
-  "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ];
-  "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git _runner ];
+  "forgejo-runner-token-snowden-env.age".publicKeys =
+    xengi
+    ++ kaythxbye
+    ++ [
+      _git
+      _runner
+    ];
+  "forgejo-runner-token-snowden.age".publicKeys =
+    xengi
+    ++ kaythxbye
+    ++ [
+      _git
+      _runner
+    ];
   "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
   "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
 }