diff --git a/.clang-format b/.clang-format
new file mode 100644
index 000000000..31b9d017a
--- /dev/null
+++ b/.clang-format
@@ -0,0 +1,19 @@
+---
+BasedOnStyle: LLVM
+AccessModifierOffset: -4
+AllowAllParametersOfDeclarationOnNextLine: false
+AllowShortBlocksOnASingleLine: false
+AllowShortCaseLabelsOnASingleLine: false
+AllowShortFunctionsOnASingleLine: false
+AllowShortIfStatementsOnASingleLine: false
+AllowShortLoopsOnASingleLine: false
+AlwaysBreakTemplateDeclarations: true
+BreakBeforeBraces: Linux
+BreakConstructorInitializersBeforeComma: true
+ColumnLimit: 100
+IndentWidth: 4
+ObjCSpaceAfterProperty: true
+PointerAlignment: Left
+TabWidth: 8
+UseTab: Never
+...
diff --git a/.clang-tidy b/.clang-tidy
new file mode 100644
index 000000000..2da8c1849
--- /dev/null
+++ b/.clang-tidy
@@ -0,0 +1,4 @@
+---
+Checks: 'readability-*'
+FormatStyle: none
+...
diff --git a/Makefile b/Makefile
index 8f4b511cb..c189902ec 100644
--- a/Makefile
+++ b/Makefile
@@ -15,6 +15,8 @@
 #
 
 #CC = clang
+CLANG_FORMAT ?= clang-format
+CLANG_TIDY   ?= clang-tidy
 SHELL = /bin/bash
 SRC_PATH = src
 ifneq ($(BUILD_PATH),)
@@ -47,8 +49,8 @@ PRINT_ERROR = printf "$@ $(ERROR_STRING)\n" | $(AWK_CMD) && printf "$(CMD)\n$$LO
 PRINT_ERROR_ = printf "$(ERROR_STRING)\n" | $(AWK_CMD) && printf "$(CMD)\n$$LOG\n" && false
 PRINT_WARNING = printf "$@ $(WARN_STRING)\n" | $(AWK_CMD) && printf "$(CMD)\n$$LOG\n"
 PRINT_WARNING_ = printf "$(WARN_STRING)\n" | $(AWK_CMD) && printf "$(CMD)\n$$LOG\n"
-BUILD_CMD = LOG=$$($(CMD) 2>&1) ; if [ $$? -eq 1 ]; then $(PRINT_ERROR); elif [ "$$LOG" != "" ] ; then $(PRINT_WARNING); else $(PRINT_OK); fi;
-BUILD_CMD_ = LOG=$$($(CMD) 2>&1) ; if [ $$? -eq 1 ]; then $(PRINT_ERROR_); elif [ "$$LOG" != "" ] ; then $(PRINT_WARNING_); else $(PRINT_OK_); fi;
+BUILD_CMD = LOG=$$($(CMD) 2>&1) ; if [ $$? -ne 0 ]; then $(PRINT_ERROR); elif [ "$$LOG" != "" ] ; then $(PRINT_WARNING); else $(PRINT_OK); fi;
+BUILD_CMD_ = LOG=$$($(CMD) 2>&1) ; if [ $$? -ne 0 ]; then $(PRINT_ERROR_); elif [ "$$LOG" != "" ] ; then $(PRINT_WARNING_); else $(PRINT_OK_); fi;
 
 PKGINFO_PATH = PKGINFO
 
@@ -297,6 +299,25 @@ $(OBJ_PATH)/%.o: $(SRC_PATH)/%.c
 	@echo -n "compile "
 	@$(BUILD_CMD)
 
+FMT_FIXUP += $(THEMIS_FMT_FIXUP) $(SOTER_FMT_FIXUP)
+FMT_CHECK += $(THEMIS_FMT_CHECK) $(SOTER_FMT_CHECK)
+
+$(OBJ_PATH)/%.c.fmt_fixup $(OBJ_PATH)/%.h.fmt_fixup: \
+    CMD = $(CLANG_TIDY) -fix $< -- $(CFLAGS) 2>/dev/null && $(CLANG_FORMAT) -i $< && touch $@
+
+$(OBJ_PATH)/%.c.fmt_check $(OBJ_PATH)/%.h.fmt_check: \
+    CMD = $(CLANG_FORMAT) $< | diff -u $< - && $(CLANG_TIDY) $< -- $(CFLAGS) 2>/dev/null && touch $@
+
+$(OBJ_PATH)/%.fmt_fixup: $(SRC_PATH)/%
+	@mkdir -p $(@D)
+	@echo -n "fixup $< "
+	@$(BUILD_CMD_)
+
+$(OBJ_PATH)/%.fmt_check: $(SRC_PATH)/%
+	@mkdir -p $(@D)
+	@echo -n "check $< "
+	@$(BUILD_CMD_)
+
 #$(AUD_PATH)/%: CMD = $(CC) $(CFLAGS) -E -dI -dD $< -o $@
 $(AUD_PATH)/%: CMD = ./scripts/pp.sh  $< $@
 
@@ -324,6 +345,9 @@ include tools/afl/fuzzy.mk
 
 err: ; $(ERROR)
 
+fmt: $(FMT_FIXUP)
+fmt_check: $(FMT_CHECK)
+
 clean: CMD = rm -rf $(BIN_PATH)
 
 clean: nist_rng_test_suite_clean clean_rust
diff --git a/src/soter/boringssl/soter.mk b/src/soter/boringssl/soter.mk
index d8d04069a..68bf589e0 100644
--- a/src/soter/boringssl/soter.mk
+++ b/src/soter/boringssl/soter.mk
@@ -14,7 +14,8 @@
 # limitations under the License.
 #
 
-SOTER_SRC += $(wildcard $(CRYPTO_ENGINE)/*.c)
+CRYPTO_ENGINE_SOURCES += $(wildcard $(CRYPTO_ENGINE)/*.c)
+CRYPTO_ENGINE_HEADERS += $(wildcard $(CRYPTO_ENGINE)/*.h)
 
 # Put path to your OpenSSL/LibreSSL here
 OPENSSL_DIR = libs/librebin
@@ -39,4 +40,4 @@ $(BIN_PATH)/boringssl/crypto/libcrypto.a $(BIN_PATH)/boringssl/decrepit/libdecre
 	@echo "building embedded BoringSSL..."
 	@mkdir -p $(BIN_PATH)/boringssl
 	@cd $(BIN_PATH)/boringssl && cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS="-fpic" ../../third_party/boringssl/src
-	@$(MAKE) -C $(BIN_PATH)/boringssl
\ No newline at end of file
+	@$(MAKE) -C $(BIN_PATH)/boringssl
diff --git a/src/soter/openssl/soter.mk b/src/soter/openssl/soter.mk
index 5dd9f3fd2..a0382c88b 100644
--- a/src/soter/openssl/soter.mk
+++ b/src/soter/openssl/soter.mk
@@ -14,9 +14,9 @@
 # limitations under the License.
 #
 
-SOTER_SRC += $(wildcard $(CRYPTO_ENGINE)/*.c)
-SOTER_AUD_SRC += $(wildcard $(CRYPTO_ENGINE)/*.c)
-SOTER_AUD_SRC += $(wildcard $(CRYPTO_ENGINE)/*.h)
+CRYPTO_ENGINE_SOURCES += $(wildcard $(CRYPTO_ENGINE)/*.c)
+CRYPTO_ENGINE_HEADERS += $(wildcard $(CRYPTO_ENGINE)/*.h)
+
 # Put path to your OpenSSL/LibreSSL here
 OPENSSL_DIR = libs/librebin
 
diff --git a/src/soter/soter.mk b/src/soter/soter.mk
index 16583df84..65fe24d1c 100644
--- a/src/soter/soter.mk
+++ b/src/soter/soter.mk
@@ -14,13 +14,19 @@
 # limitations under the License.
 #
 
-SOTER_SRC = $(wildcard $(SRC_PATH)/soter/*.c)
-SOTER_AUD_SRC = $(wildcard $(SRC_PATH)/soter/*.c)
-SOTER_AUD_SRC += $(wildcard $(SRC_PATH)/soter/*.h)
-# ed25519 we specify here, because it should be portable and does not depend on $(CRYPTO_ENGINE)
-SOTER_SRC += $(wildcard $(SRC_PATH)/soter/ed25519/*.c)
-SOTER_AUD_SRC += $(wildcard $(SRC_PATH)/soter/ed25519/*.c)
-SOTER_AUD_SRC += $(wildcard $(SRC_PATH)/soter/ed25519/*.h)
+SOTER_SOURCES = $(wildcard $(SRC_PATH)/soter/*.c)
+SOTER_HEADERS = $(wildcard $(SRC_PATH)/soter/*.h)
+ED25519_SOURCES = $(wildcard $(SRC_PATH)/soter/ed25519/*.c)
+ED25519_HEADERS = $(wildcard $(SRC_PATH)/soter/ed25519/*.h)
+
+SOTER_SRC = $(SOTER_SOURCES) $(ED25519_SOURCES) $(CRYPTO_ENGINE_SOURCES)
+
+SOTER_AUD_SRC += $(SOTER_SOURCES) $(ED25519_SOURCES) $(CRYPTO_ENGINE_SOURCES)
+SOTER_AUD_SRC += $(SOTER_HEADERS) $(ED25519_HEADERS) $(CRYPTO_ENGINE_HEADERS)
+
+# Ignore ed25519 during code reformatting as it is 3rd-party code (and it breaks clang-tidy)
+SOTER_FMT_SRC += $(SOTER_SOURCES) $(CRYPTO_ENGINE_SOURCES)
+SOTER_FMT_SRC += $(SOTER_HEADERS) $(CRYPTO_ENGINE_HEADERS)
 
 include $(CRYPTO_ENGINE)/soter.mk
 
@@ -28,6 +34,9 @@ SOTER_OBJ = $(patsubst $(SRC_PATH)/%.c,$(OBJ_PATH)/%.o, $(SOTER_SRC))
 
 SOTER_AUD = $(patsubst $(SRC_PATH)/%,$(AUD_PATH)/%, $(SOTER_AUD_SRC))
 
+SOTER_FMT_FIXUP = $(patsubst $(SRC_PATH)/%,$(OBJ_PATH)/%.fmt_fixup,$(SOTER_FMT_SRC))
+SOTER_FMT_CHECK = $(patsubst $(SRC_PATH)/%,$(OBJ_PATH)/%.fmt_check,$(SOTER_FMT_SRC))
+
 SOTER_BIN = soter
 
 soter_pkgconfig:
diff --git a/src/themis/themis.mk b/src/themis/themis.mk
index b3fa3b3c1..fce5571c8 100644
--- a/src/themis/themis.mk
+++ b/src/themis/themis.mk
@@ -14,14 +14,20 @@
 # limitations under the License.
 #
 
-THEMIS_SRC = $(wildcard $(SRC_PATH)/themis/*.c)
-THEMIS_AUD_SRC = $(wildcard $(SRC_PATH)/themis/*.c)
-THEMIS_AUD_SRC += $(wildcard $(SRC_PATH)/themis/*.h)
+THEMIS_SOURCES = $(wildcard $(SRC_PATH)/themis/*.c)
+THEMIS_HEADERS = $(wildcard $(SRC_PATH)/themis/*.h)
+
+THEMIS_SRC = $(THEMIS_SOURCES)
+THEMIS_AUD_SRC = $(THEMIS_SOURCES) $(THEMIS_HEADERS)
+THEMIS_FMT_SRC = $(THEMIS_SOURCES) $(THEMIS_HEADERS)
 
 THEMIS_OBJ = $(patsubst $(SRC_PATH)/%.c,$(OBJ_PATH)/%.o, $(THEMIS_SRC))
 
 THEMIS_AUD = $(patsubst $(SRC_PATH)/%,$(AUD_PATH)/%, $(THEMIS_AUD_SRC))
 
+THEMIS_FMT_FIXUP = $(patsubst $(SRC_PATH)/%,$(OBJ_PATH)/%.fmt_fixup,$(THEMIS_FMT_SRC))
+THEMIS_FMT_CHECK = $(patsubst $(SRC_PATH)/%,$(OBJ_PATH)/%.fmt_check,$(THEMIS_FMT_SRC))
+
 THEMIS_BIN = themis
 
 themis_pkgconfig:
diff --git a/tests/soter/nist-sts/.clang-format b/tests/soter/nist-sts/.clang-format
new file mode 100644
index 000000000..ef2ae21fa
--- /dev/null
+++ b/tests/soter/nist-sts/.clang-format
@@ -0,0 +1,4 @@
+---
+DisableFormat: true
+SortIncludes: false
+...