diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2c0b6fda77..e1b40c398d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,25 @@ on:
    branches: [master, develop]
 
 jobs:
+  treefmt:
+   name: Run treefmt
+   environment: cachix # for secrets
+   runs-on: ubuntu-latest
+   steps:
+     - uses: actions/checkout@v2
+       with:
+         submodules: true
+     - uses: cachix/install-nix-action@v14.1
+     - uses: cachix/cachix-action@v10
+       with:
+         name: wire-server
+         signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+     - name: Install treefmt and nixpkgs-fmt (without pulling in all of dev-env)
+       run: nix-env -if nix/default.nix -iA pkgs.treefmt pkgs.nixpkgs-fmt pkgs.shellcheck
+     - name: Run treefmt
+       run: treefmt
+
   build-docs:
     name: Build docs
     environment: cachix
diff --git a/Makefile b/Makefile
index 140ea42705..573fa4d6e6 100644
--- a/Makefile
+++ b/Makefile
@@ -108,7 +108,7 @@ ghcid:
 
 # Used by CI
 .PHONY: lint-all
-lint-all: formatc hlint-check-all shellcheck check-local-nix-derivations
+lint-all: formatc hlint-check-all check-local-nix-derivations treefmt
 
 .PHONY: hlint-check-all
 hlint-check-all:
@@ -171,9 +171,9 @@ add-license:
 	@echo ""
 	@echo "you might want to run 'make formatf' now to make sure ormolu is happy"
 
-.PHONY: shellcheck
-shellcheck:
-	./hack/bin/shellcheck.sh
+.PHONY: treefmt
+treefmt:
+	treefmt
 
 #################################
 ## docker targets
diff --git a/changelog.d/5-internal/treefmt b/changelog.d/5-internal/treefmt
new file mode 100644
index 0000000000..e3e735311a
--- /dev/null
+++ b/changelog.d/5-internal/treefmt
@@ -0,0 +1 @@
+Use treefmt to ensure consistent formatting of .nix files, use for shellcheck too (#2831)
diff --git a/hack/bin/generate-local-nix-packages.sh b/hack/bin/generate-local-nix-packages.sh
index 50e6e047f2..abfdfeb925 100755
--- a/hack/bin/generate-local-nix-packages.sh
+++ b/hack/bin/generate-local-nix-packages.sh
@@ -21,7 +21,7 @@ echo "$cabalFiles" \
 
 # shellcheck disable=SC2016
 echo "$cabalFiles" \
-    | xargs -I {} bash -c 'cd $(dirname {}); cabal2nix . --no-hpack --extra-arguments gitignoreSource | sed "s/.\/./gitignoreSource .\/./g" >> default.nix'
+    | xargs -I {} bash -c 'cd $(dirname {}); cabal2nix . --no-hpack --extra-arguments gitignoreSource | sed "s/.\/./gitignoreSource .\/./g" >> default.nix; nixpkgs-fmt default.nix &> /dev/null'
 
 overridesFile="$ROOT_DIR/nix/local-haskell-packages.nix"
 
@@ -30,3 +30,6 @@ cat "$warningFile" <(echo "{ gitignoreSource }: hsuper: hself: {") > "$overrides
 echo "$cabalFiles" \
     | xargs -I {} bash -c 'name=$(basename {} | sed "s|.cabal||"); echo "  $name = hself.callPackage $(realpath --relative-to='"$ROOT_DIR/nix"' "$(dirname {})")/default.nix { inherit gitignoreSource; };"' >> "$overridesFile"
 echo "}" >> "$overridesFile"
+
+# ensure the file is formatted
+nixpkgs-fmt "$overridesFile" &> /dev/null
diff --git a/hack/bin/shellcheck.sh b/hack/bin/shellcheck.sh
deleted file mode 100755
index ff551e5dc3..0000000000
--- a/hack/bin/shellcheck.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-
-set -eu
-
-# lint all shell scripts with ShellCheck
-# FUTUREWORK: Fix issues of the explicitly (no globbing) excluded files.
-
-mapfile -t SHELL_FILES_TO_LINT < <(
-    git ls-files |
-        grep "\.sh$" |
-        grep -v "dist-newstyle/" |
-        grep -v "services/nginz/third_party/" |
-        grep -v "libs/wire-api/test/golden/gentests.sh" |
-        grep -v "changelog.d/mk-changelog.sh" |
-        grep -v "hack/bin/integration-teardown.sh" |
-        grep -v "hack/bin/diff-failure.sh" |
-        grep -v "hack/bin/integration-setup.sh" |
-        grep -v "hack/bin/cabal-run-tests.sh" |
-        grep -v "hack/bin/integration-teardown-federation.sh" |
-        grep -v "hack/bin/integration-setup-federation.sh" |
-        grep -v "hack/bin/serve-charts.sh" |
-        grep -v "hack/bin/cabal-install-artefacts.sh" |
-        grep -v "hack/bin/helm-template.sh" |
-        grep -v "hack/bin/set-chart-image-version.sh" |
-        grep -v "hack/bin/copy-charts.sh" |
-        grep -v "hack/bin/set-helm-chart-version.sh" |
-        grep -v "hack/bin/integration-spring-cleaning.sh" |
-        grep -v "hack/bin/upload-helm-charts-s3.sh" |
-        grep -v "hack/bin/integration-test-logs.sh" |
-        grep -v "services/nginz/nginz_reload.sh" |
-        grep -v "services/spar/test-scim-suite/mk_collection.sh" |
-        grep -v "services/spar/test-scim-suite/runsuite.sh" |
-        grep -v "services/spar/test-scim-suite/run.sh" |
-        grep -v "services/brig/federation-tests.sh" |
-        grep -v "services/integration.sh" |
-        grep -v "hack/bin/create_test_team_members.sh" |
-        grep -v "hack/bin/create_test_team_scim.sh" |
-        grep -v "hack/bin/create_test_user.sh" |
-        grep -v "hack/bin/create_team_members.sh" |
-        grep -v "hack/bin/register_idp_internal.sh" |
-        grep -v "hack/bin/create_test_team_admins.sh" |
-        grep -v "deploy/dockerephemeral/init.sh" |
-        grep -v "tools/nginz_disco/nginz_disco.sh" |
-        grep -v "tools/rebase-onto-formatter.sh" |
-        grep -v "tools/sftd_disco/sftd_disco.sh" |
-        grep -v "tools/ormolu.sh" |
-        grep -v "tools/db/move-team/dump_merge_teams.sh"
-)
-
-shellcheck -x "${SHELL_FILES_TO_LINT[@]}"
diff --git a/libs/api-bot/default.nix b/libs/api-bot/default.nix
index 823fad86b1..8116ba9ceb 100644
--- a/libs/api-bot/default.nix
+++ b/libs/api-bot/default.nix
@@ -2,27 +2,89 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, ansi-terminal, api-client, async, attoparsec
-, base, base64-bytestring, bilge, bytestring, bytestring-conversion
-, cereal, containers, cryptobox-haskell, cryptonite, exceptions
-, filepath, gitignoreSource, HaskellNet, HaskellNet-SSL
-, http-client, imports, iso639, lib, memory, metrics-core, mime
-, monad-control, mwc-random, optparse-applicative, resource-pool
-, stm, text, time, tinylog, transformers-base, types-common
-, unordered-containers, uuid, vector
+{ mkDerivation
+, aeson
+, ansi-terminal
+, api-client
+, async
+, attoparsec
+, base
+, base64-bytestring
+, bilge
+, bytestring
+, bytestring-conversion
+, cereal
+, containers
+, cryptobox-haskell
+, cryptonite
+, exceptions
+, filepath
+, gitignoreSource
+, HaskellNet
+, HaskellNet-SSL
+, http-client
+, imports
+, iso639
+, lib
+, memory
+, metrics-core
+, mime
+, monad-control
+, mwc-random
+, optparse-applicative
+, resource-pool
+, stm
+, text
+, time
+, tinylog
+, transformers-base
+, types-common
+, unordered-containers
+, uuid
+, vector
 }:
 mkDerivation {
   pname = "api-bot";
   version = "0.4.2";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson ansi-terminal api-client async attoparsec base
-    base64-bytestring bilge bytestring bytestring-conversion cereal
-    containers cryptobox-haskell cryptonite exceptions filepath
-    HaskellNet HaskellNet-SSL http-client imports iso639 memory
-    metrics-core mime monad-control mwc-random optparse-applicative
-    resource-pool stm text time tinylog transformers-base types-common
-    unordered-containers uuid vector
+    aeson
+    ansi-terminal
+    api-client
+    async
+    attoparsec
+    base
+    base64-bytestring
+    bilge
+    bytestring
+    bytestring-conversion
+    cereal
+    containers
+    cryptobox-haskell
+    cryptonite
+    exceptions
+    filepath
+    HaskellNet
+    HaskellNet-SSL
+    http-client
+    imports
+    iso639
+    memory
+    metrics-core
+    mime
+    monad-control
+    mwc-random
+    optparse-applicative
+    resource-pool
+    stm
+    text
+    time
+    tinylog
+    transformers-base
+    types-common
+    unordered-containers
+    uuid
+    vector
   ];
   description = "(Internal) API automation around wire-client";
   license = lib.licenses.agpl3Only;
diff --git a/libs/api-client/default.nix b/libs/api-client/default.nix
index 52b3c069cd..bbf842e4f8 100644
--- a/libs/api-client/default.nix
+++ b/libs/api-client/default.nix
@@ -2,11 +2,34 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, async, base, bilge, bytestring
-, bytestring-conversion, connection, cookie, data-default-class
-, errors, exceptions, gitignoreSource, http-client, http-types
-, imports, lib, mime, retry, text, time, tinylog, transformers
-, types-common, unliftio, unordered-containers, uuid, websockets
+{ mkDerivation
+, aeson
+, async
+, base
+, bilge
+, bytestring
+, bytestring-conversion
+, connection
+, cookie
+, data-default-class
+, errors
+, exceptions
+, gitignoreSource
+, http-client
+, http-types
+, imports
+, lib
+, mime
+, retry
+, text
+, time
+, tinylog
+, transformers
+, types-common
+, unliftio
+, unordered-containers
+, uuid
+, websockets
 , wire-api
 }:
 mkDerivation {
@@ -14,10 +37,32 @@ mkDerivation {
   version = "0.4.2";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson async base bilge bytestring bytestring-conversion connection
-    cookie data-default-class errors exceptions http-client http-types
-    imports mime retry text time tinylog transformers types-common
-    unliftio unordered-containers uuid websockets wire-api
+    aeson
+    async
+    base
+    bilge
+    bytestring
+    bytestring-conversion
+    connection
+    cookie
+    data-default-class
+    errors
+    exceptions
+    http-client
+    http-types
+    imports
+    mime
+    retry
+    text
+    time
+    tinylog
+    transformers
+    types-common
+    unliftio
+    unordered-containers
+    uuid
+    websockets
+    wire-api
   ];
   description = "(Internal) Wire HTTP API Client";
   license = lib.licenses.agpl3Only;
diff --git a/libs/bilge/default.nix b/libs/bilge/default.nix
index 07dba5db2f..6a32b06d68 100644
--- a/libs/bilge/default.nix
+++ b/libs/bilge/default.nix
@@ -2,21 +2,59 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, ansi-terminal, base, bytestring
-, case-insensitive, cookie, errors, exceptions, gitignoreSource
-, http-client, http-types, imports, lens, lib, monad-control, mtl
-, text, tinylog, transformers-base, types-common, unliftio
-, uri-bytestring, wai, wai-extra
+{ mkDerivation
+, aeson
+, ansi-terminal
+, base
+, bytestring
+, case-insensitive
+, cookie
+, errors
+, exceptions
+, gitignoreSource
+, http-client
+, http-types
+, imports
+, lens
+, lib
+, monad-control
+, mtl
+, text
+, tinylog
+, transformers-base
+, types-common
+, unliftio
+, uri-bytestring
+, wai
+, wai-extra
 }:
 mkDerivation {
   pname = "bilge";
   version = "0.22.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson ansi-terminal base bytestring case-insensitive cookie errors
-    exceptions http-client http-types imports lens monad-control mtl
-    text tinylog transformers-base types-common unliftio uri-bytestring
-    wai wai-extra
+    aeson
+    ansi-terminal
+    base
+    bytestring
+    case-insensitive
+    cookie
+    errors
+    exceptions
+    http-client
+    http-types
+    imports
+    lens
+    monad-control
+    mtl
+    text
+    tinylog
+    transformers-base
+    types-common
+    unliftio
+    uri-bytestring
+    wai
+    wai-extra
   ];
   description = "Library for composing HTTP requests";
   license = lib.licenses.agpl3Only;
diff --git a/libs/brig-types/default.nix b/libs/brig-types/default.nix
index 46a87df55a..ba0b67dcec 100644
--- a/libs/brig-types/default.nix
+++ b/libs/brig-types/default.nix
@@ -2,29 +2,80 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, attoparsec, base, bytestring
-, bytestring-conversion, cassandra-util, containers
-, deriving-swagger2, gitignoreSource, imports, lib, QuickCheck
-, schema-profunctor, servant-server, servant-swagger
-, string-conversions, swagger2, tasty, tasty-hunit
-, tasty-quickcheck, text, time, tinylog, types-common
-, unordered-containers, wire-api
+{ mkDerivation
+, aeson
+, attoparsec
+, base
+, bytestring
+, bytestring-conversion
+, cassandra-util
+, containers
+, deriving-swagger2
+, gitignoreSource
+, imports
+, lib
+, QuickCheck
+, schema-profunctor
+, servant-server
+, servant-swagger
+, string-conversions
+, swagger2
+, tasty
+, tasty-hunit
+, tasty-quickcheck
+, text
+, time
+, tinylog
+, types-common
+, unordered-containers
+, wire-api
 }:
 mkDerivation {
   pname = "brig-types";
   version = "1.35.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson attoparsec base bytestring bytestring-conversion
-    cassandra-util containers deriving-swagger2 imports QuickCheck
-    schema-profunctor servant-server servant-swagger string-conversions
-    swagger2 text time tinylog types-common unordered-containers
+    aeson
+    attoparsec
+    base
+    bytestring
+    bytestring-conversion
+    cassandra-util
+    containers
+    deriving-swagger2
+    imports
+    QuickCheck
+    schema-profunctor
+    servant-server
+    servant-swagger
+    string-conversions
+    swagger2
+    text
+    time
+    tinylog
+    types-common
+    unordered-containers
     wire-api
   ];
   testHaskellDepends = [
-    aeson attoparsec base bytestring bytestring-conversion containers
-    imports QuickCheck swagger2 tasty tasty-hunit tasty-quickcheck text
-    time tinylog types-common unordered-containers wire-api
+    aeson
+    attoparsec
+    base
+    bytestring
+    bytestring-conversion
+    containers
+    imports
+    QuickCheck
+    swagger2
+    tasty
+    tasty-hunit
+    tasty-quickcheck
+    text
+    time
+    tinylog
+    types-common
+    unordered-containers
+    wire-api
   ];
   description = "User Service";
   license = lib.licenses.agpl3Only;
diff --git a/libs/cargohold-types/default.nix b/libs/cargohold-types/default.nix
index 523e4eab3a..6415170a56 100644
--- a/libs/cargohold-types/default.nix
+++ b/libs/cargohold-types/default.nix
@@ -2,15 +2,25 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, bytestring-conversion, gitignoreSource
-, imports, lib, types-common, wire-api
+{ mkDerivation
+, base
+, bytestring-conversion
+, gitignoreSource
+, imports
+, lib
+, types-common
+, wire-api
 }:
 mkDerivation {
   pname = "cargohold-types";
   version = "1.5.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    base bytestring-conversion imports types-common wire-api
+    base
+    bytestring-conversion
+    imports
+    types-common
+    wire-api
   ];
   description = "Asset Storage API Types";
   license = lib.licenses.agpl3Only;
diff --git a/libs/cassandra-util/default.nix b/libs/cassandra-util/default.nix
index fdc62d62b5..9f57e34427 100644
--- a/libs/cassandra-util/default.nix
+++ b/libs/cassandra-util/default.nix
@@ -2,19 +2,53 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, base, conduit, containers, cql, cql-io
-, cql-io-tinylog, exceptions, gitignoreSource, imports, lens
-, lens-aeson, lib, optparse-applicative, retry, split, text, time
-, tinylog, uuid, wreq
+{ mkDerivation
+, aeson
+, base
+, conduit
+, containers
+, cql
+, cql-io
+, cql-io-tinylog
+, exceptions
+, gitignoreSource
+, imports
+, lens
+, lens-aeson
+, lib
+, optparse-applicative
+, retry
+, split
+, text
+, time
+, tinylog
+, uuid
+, wreq
 }:
 mkDerivation {
   pname = "cassandra-util";
   version = "0.16.5";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson base conduit containers cql cql-io cql-io-tinylog exceptions
-    imports lens lens-aeson optparse-applicative retry split text time
-    tinylog uuid wreq
+    aeson
+    base
+    conduit
+    containers
+    cql
+    cql-io
+    cql-io-tinylog
+    exceptions
+    imports
+    lens
+    lens-aeson
+    optparse-applicative
+    retry
+    split
+    text
+    time
+    tinylog
+    uuid
+    wreq
   ];
   description = "Cassandra Utilities";
   license = lib.licenses.agpl3Only;
diff --git a/libs/deriving-swagger2/default.nix b/libs/deriving-swagger2/default.nix
index b11f6619f0..fdf39de254 100644
--- a/libs/deriving-swagger2/default.nix
+++ b/libs/deriving-swagger2/default.nix
@@ -2,7 +2,12 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, extra, gitignoreSource, imports, lib
+{ mkDerivation
+, base
+, extra
+, gitignoreSource
+, imports
+, lib
 , swagger2
 }:
 mkDerivation {
diff --git a/libs/dns-util/default.nix b/libs/dns-util/default.nix
index 1da76aea20..509dedafdc 100644
--- a/libs/dns-util/default.nix
+++ b/libs/dns-util/default.nix
@@ -2,18 +2,38 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, dns, gitignoreSource, hspec, hspec-discover
-, imports, iproute, lib, polysemy, random
+{ mkDerivation
+, base
+, dns
+, gitignoreSource
+, hspec
+, hspec-discover
+, imports
+, iproute
+, lib
+, polysemy
+, random
 }:
 mkDerivation {
   pname = "dns-util";
   version = "0.1.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    base dns imports iproute polysemy random
+    base
+    dns
+    imports
+    iproute
+    polysemy
+    random
   ];
   testHaskellDepends = [
-    base dns hspec imports iproute polysemy random
+    base
+    dns
+    hspec
+    imports
+    iproute
+    polysemy
+    random
   ];
   testToolDepends = [ hspec-discover ];
   description = "Library to deal with DNS SRV records";
diff --git a/libs/extended/default.nix b/libs/extended/default.nix
index 0f193232ce..d51ab0466c 100644
--- a/libs/extended/default.nix
+++ b/libs/extended/default.nix
@@ -2,26 +2,76 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, base, bytestring, cassandra-util, containers
-, errors, exceptions, extra, gitignoreSource, hspec, hspec-discover
-, http-types, imports, lib, metrics-wai, optparse-applicative
-, servant, servant-server, servant-swagger, string-conversions
-, temporary, tinylog, wai
+{ mkDerivation
+, aeson
+, base
+, bytestring
+, cassandra-util
+, containers
+, errors
+, exceptions
+, extra
+, gitignoreSource
+, hspec
+, hspec-discover
+, http-types
+, imports
+, lib
+, metrics-wai
+, optparse-applicative
+, servant
+, servant-server
+, servant-swagger
+, string-conversions
+, temporary
+, tinylog
+, wai
 }:
 mkDerivation {
   pname = "extended";
   version = "0.1.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson base bytestring cassandra-util containers errors exceptions
-    extra http-types imports metrics-wai optparse-applicative servant
-    servant-server servant-swagger string-conversions tinylog wai
+    aeson
+    base
+    bytestring
+    cassandra-util
+    containers
+    errors
+    exceptions
+    extra
+    http-types
+    imports
+    metrics-wai
+    optparse-applicative
+    servant
+    servant-server
+    servant-swagger
+    string-conversions
+    tinylog
+    wai
   ];
   testHaskellDepends = [
-    aeson base bytestring cassandra-util containers errors exceptions
-    extra hspec http-types imports metrics-wai optparse-applicative
-    servant servant-server servant-swagger string-conversions temporary
-    tinylog wai
+    aeson
+    base
+    bytestring
+    cassandra-util
+    containers
+    errors
+    exceptions
+    extra
+    hspec
+    http-types
+    imports
+    metrics-wai
+    optparse-applicative
+    servant
+    servant-server
+    servant-swagger
+    string-conversions
+    temporary
+    tinylog
+    wai
   ];
   testToolDepends = [ hspec-discover ];
   description = "Extended versions of common modules";
diff --git a/libs/galley-types/default.nix b/libs/galley-types/default.nix
index 9c499e4440..478a0c540e 100644
--- a/libs/galley-types/default.nix
+++ b/libs/galley-types/default.nix
@@ -2,11 +2,33 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, base, bytestring, bytestring-conversion
-, containers, cryptonite, currency-codes, errors, exceptions
-, gitignoreSource, imports, lens, lib, memory, QuickCheck
-, schema-profunctor, string-conversions, swagger2, tagged, tasty
-, tasty-hunit, tasty-quickcheck, text, time, types-common, uuid
+{ mkDerivation
+, aeson
+, base
+, bytestring
+, bytestring-conversion
+, containers
+, cryptonite
+, currency-codes
+, errors
+, exceptions
+, gitignoreSource
+, imports
+, lens
+, lib
+, memory
+, QuickCheck
+, schema-profunctor
+, string-conversions
+, swagger2
+, tagged
+, tasty
+, tasty-hunit
+, tasty-quickcheck
+, text
+, time
+, types-common
+, uuid
 , wire-api
 }:
 mkDerivation {
@@ -14,14 +36,41 @@ mkDerivation {
   version = "0.81.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson base bytestring bytestring-conversion containers cryptonite
-    currency-codes errors exceptions imports lens memory QuickCheck
-    schema-profunctor string-conversions swagger2 tagged text time
-    types-common uuid wire-api
+    aeson
+    base
+    bytestring
+    bytestring-conversion
+    containers
+    cryptonite
+    currency-codes
+    errors
+    exceptions
+    imports
+    lens
+    memory
+    QuickCheck
+    schema-profunctor
+    string-conversions
+    swagger2
+    tagged
+    text
+    time
+    types-common
+    uuid
+    wire-api
   ];
   testHaskellDepends = [
-    aeson base containers imports lens QuickCheck tasty tasty-hunit
-    tasty-quickcheck types-common wire-api
+    aeson
+    base
+    containers
+    imports
+    lens
+    QuickCheck
+    tasty
+    tasty-hunit
+    tasty-quickcheck
+    types-common
+    wire-api
   ];
   license = lib.licenses.agpl3Only;
 }
diff --git a/libs/gundeck-types/default.nix b/libs/gundeck-types/default.nix
index 19d76ecf6f..ea45673e17 100644
--- a/libs/gundeck-types/default.nix
+++ b/libs/gundeck-types/default.nix
@@ -2,9 +2,21 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, attoparsec, base, bytestring
-, bytestring-conversion, containers, gitignoreSource, imports, lens
-, lib, network-uri, text, types-common, unordered-containers
+{ mkDerivation
+, aeson
+, attoparsec
+, base
+, bytestring
+, bytestring-conversion
+, containers
+, gitignoreSource
+, imports
+, lens
+, lib
+, network-uri
+, text
+, types-common
+, unordered-containers
 , wire-api
 }:
 mkDerivation {
@@ -12,8 +24,18 @@ mkDerivation {
   version = "1.45.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson attoparsec base bytestring bytestring-conversion containers
-    imports lens network-uri text types-common unordered-containers
+    aeson
+    attoparsec
+    base
+    bytestring
+    bytestring-conversion
+    containers
+    imports
+    lens
+    network-uri
+    text
+    types-common
+    unordered-containers
     wire-api
   ];
   license = lib.licenses.agpl3Only;
diff --git a/libs/hscim/default.nix b/libs/hscim/default.nix
index 4ee4f9c87d..ff9dda2955 100644
--- a/libs/hscim/default.nix
+++ b/libs/hscim/default.nix
@@ -2,15 +2,49 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, aeson-qq, attoparsec, base, bytestring
-, case-insensitive, email-validate, gitignoreSource, hashable
-, hedgehog, hspec, hspec-discover, hspec-expectations, hspec-wai
-, http-api-data, http-media, http-types, hw-hspec-hedgehog
-, indexed-traversable, lib, list-t, microlens, mmorph, mtl
-, network-uri, retry, scientific, servant, servant-client
-, servant-client-core, servant-server, stm, stm-containers
-, string-conversions, template-haskell, text, time
-, unordered-containers, uuid, wai, wai-extra, warp
+{ mkDerivation
+, aeson
+, aeson-qq
+, attoparsec
+, base
+, bytestring
+, case-insensitive
+, email-validate
+, gitignoreSource
+, hashable
+, hedgehog
+, hspec
+, hspec-discover
+, hspec-expectations
+, hspec-wai
+, http-api-data
+, http-media
+, http-types
+, hw-hspec-hedgehog
+, indexed-traversable
+, lib
+, list-t
+, microlens
+, mmorph
+, mtl
+, network-uri
+, retry
+, scientific
+, servant
+, servant-client
+, servant-client-core
+, servant-server
+, stm
+, stm-containers
+, string-conversions
+, template-haskell
+, text
+, time
+, unordered-containers
+, uuid
+, wai
+, wai-extra
+, warp
 }:
 mkDerivation {
   pname = "hscim";
@@ -19,31 +53,124 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson aeson-qq attoparsec base bytestring case-insensitive
-    email-validate hashable hedgehog hspec hspec-expectations hspec-wai
-    http-api-data http-media http-types hw-hspec-hedgehog list-t
-    microlens mmorph mtl network-uri retry scientific servant
-    servant-client servant-client-core servant-server stm
-    stm-containers string-conversions template-haskell text time
-    unordered-containers uuid wai wai-extra warp
+    aeson
+    aeson-qq
+    attoparsec
+    base
+    bytestring
+    case-insensitive
+    email-validate
+    hashable
+    hedgehog
+    hspec
+    hspec-expectations
+    hspec-wai
+    http-api-data
+    http-media
+    http-types
+    hw-hspec-hedgehog
+    list-t
+    microlens
+    mmorph
+    mtl
+    network-uri
+    retry
+    scientific
+    servant
+    servant-client
+    servant-client-core
+    servant-server
+    stm
+    stm-containers
+    string-conversions
+    template-haskell
+    text
+    time
+    unordered-containers
+    uuid
+    wai
+    wai-extra
+    warp
   ];
   executableHaskellDepends = [
-    aeson aeson-qq attoparsec base bytestring case-insensitive
-    email-validate hashable hedgehog hspec hspec-expectations hspec-wai
-    http-api-data http-media http-types hw-hspec-hedgehog list-t
-    microlens mmorph mtl network-uri retry scientific servant
-    servant-client servant-client-core servant-server stm
-    stm-containers string-conversions template-haskell text time
-    unordered-containers uuid wai wai-extra warp
+    aeson
+    aeson-qq
+    attoparsec
+    base
+    bytestring
+    case-insensitive
+    email-validate
+    hashable
+    hedgehog
+    hspec
+    hspec-expectations
+    hspec-wai
+    http-api-data
+    http-media
+    http-types
+    hw-hspec-hedgehog
+    list-t
+    microlens
+    mmorph
+    mtl
+    network-uri
+    retry
+    scientific
+    servant
+    servant-client
+    servant-client-core
+    servant-server
+    stm
+    stm-containers
+    string-conversions
+    template-haskell
+    text
+    time
+    unordered-containers
+    uuid
+    wai
+    wai-extra
+    warp
   ];
   testHaskellDepends = [
-    aeson aeson-qq attoparsec base bytestring case-insensitive
-    email-validate hashable hedgehog hspec hspec-expectations hspec-wai
-    http-api-data http-media http-types hw-hspec-hedgehog
-    indexed-traversable list-t microlens mmorph mtl network-uri retry
-    scientific servant servant-client servant-client-core
-    servant-server stm stm-containers string-conversions
-    template-haskell text time unordered-containers uuid wai wai-extra
+    aeson
+    aeson-qq
+    attoparsec
+    base
+    bytestring
+    case-insensitive
+    email-validate
+    hashable
+    hedgehog
+    hspec
+    hspec-expectations
+    hspec-wai
+    http-api-data
+    http-media
+    http-types
+    hw-hspec-hedgehog
+    indexed-traversable
+    list-t
+    microlens
+    mmorph
+    mtl
+    network-uri
+    retry
+    scientific
+    servant
+    servant-client
+    servant-client-core
+    servant-server
+    stm
+    stm-containers
+    string-conversions
+    template-haskell
+    text
+    time
+    unordered-containers
+    uuid
+    wai
+    wai-extra
     warp
   ];
   testToolDepends = [ hspec-discover ];
diff --git a/libs/imports/default.nix b/libs/imports/default.nix
index d8b9861d17..728fca8f3b 100644
--- a/libs/imports/default.nix
+++ b/libs/imports/default.nix
@@ -2,17 +2,37 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, bytestring, containers, deepseq, extra
-, gitignoreSource, lib, mtl, text, transformers, unliftio
-, unliftio-core, unordered-containers
+{ mkDerivation
+, base
+, bytestring
+, containers
+, deepseq
+, extra
+, gitignoreSource
+, lib
+, mtl
+, text
+, transformers
+, unliftio
+, unliftio-core
+, unordered-containers
 }:
 mkDerivation {
   pname = "imports";
   version = "0.1.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    base bytestring containers deepseq extra mtl text transformers
-    unliftio unliftio-core unordered-containers
+    base
+    bytestring
+    containers
+    deepseq
+    extra
+    mtl
+    text
+    transformers
+    unliftio
+    unliftio-core
+    unordered-containers
   ];
   description = "Very common imports";
   license = lib.licenses.agpl3Only;
diff --git a/libs/jwt-tools/default.nix b/libs/jwt-tools/default.nix
index 13a50bca3c..4dff35909a 100644
--- a/libs/jwt-tools/default.nix
+++ b/libs/jwt-tools/default.nix
@@ -2,24 +2,58 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, base64-bytestring, bytestring
-, bytestring-conversion, either, extra, gitignoreSource, hspec
-, http-types, imports, lib, QuickCheck, rusty_jwt_tools_ffi
-, string-conversions, text, transformers, unliftio, uuid
+{ mkDerivation
+, base
+, base64-bytestring
+, bytestring
+, bytestring-conversion
+, either
+, extra
+, gitignoreSource
+, hspec
+, http-types
+, imports
+, lib
+, QuickCheck
+, rusty_jwt_tools_ffi
+, string-conversions
+, text
+, transformers
+, unliftio
+, uuid
 }:
 mkDerivation {
   pname = "jwt-tools";
   version = "0.1.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    base base64-bytestring bytestring bytestring-conversion http-types
-    imports QuickCheck string-conversions transformers unliftio
+    base
+    base64-bytestring
+    bytestring
+    bytestring-conversion
+    http-types
+    imports
+    QuickCheck
+    string-conversions
+    transformers
+    unliftio
   ];
   librarySystemDepends = [ rusty_jwt_tools_ffi ];
   testHaskellDepends = [
-    base base64-bytestring bytestring bytestring-conversion either
-    extra hspec http-types imports QuickCheck string-conversions text
-    transformers uuid
+    base
+    base64-bytestring
+    bytestring
+    bytestring-conversion
+    either
+    extra
+    hspec
+    http-types
+    imports
+    QuickCheck
+    string-conversions
+    text
+    transformers
+    uuid
   ];
   description = "FFI to rusty-jwt-tools";
   license = lib.licenses.agpl3Only;
diff --git a/libs/metrics-core/default.nix b/libs/metrics-core/default.nix
index eb21ca9b1e..f3eab69051 100644
--- a/libs/metrics-core/default.nix
+++ b/libs/metrics-core/default.nix
@@ -2,8 +2,17 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, containers, gitignoreSource, hashable
-, immortal, imports, lib, prometheus-client, text, time
+{ mkDerivation
+, base
+, containers
+, gitignoreSource
+, hashable
+, immortal
+, imports
+, lib
+, prometheus-client
+, text
+, time
 , unordered-containers
 }:
 mkDerivation {
@@ -11,8 +20,15 @@ mkDerivation {
   version = "0.3.2";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    base containers hashable immortal imports prometheus-client text
-    time unordered-containers
+    base
+    containers
+    hashable
+    immortal
+    imports
+    prometheus-client
+    text
+    time
+    unordered-containers
   ];
   description = "Metrics core";
   license = lib.licenses.agpl3Only;
diff --git a/libs/metrics-wai/default.nix b/libs/metrics-wai/default.nix
index 9449e05d91..7a3a90c45d 100644
--- a/libs/metrics-wai/default.nix
+++ b/libs/metrics-wai/default.nix
@@ -2,24 +2,62 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, bytestring, containers, gitignoreSource
-, hspec, hspec-discover, http-types, imports, lib, metrics-core
-, servant, servant-multipart, string-conversions, text, wai
-, wai-middleware-prometheus, wai-route, wai-routing
+{ mkDerivation
+, base
+, bytestring
+, containers
+, gitignoreSource
+, hspec
+, hspec-discover
+, http-types
+, imports
+, lib
+, metrics-core
+, servant
+, servant-multipart
+, string-conversions
+, text
+, wai
+, wai-middleware-prometheus
+, wai-route
+, wai-routing
 }:
 mkDerivation {
   pname = "metrics-wai";
   version = "0.5.7";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    base bytestring containers http-types imports metrics-core servant
-    servant-multipart string-conversions text wai
-    wai-middleware-prometheus wai-route wai-routing
+    base
+    bytestring
+    containers
+    http-types
+    imports
+    metrics-core
+    servant
+    servant-multipart
+    string-conversions
+    text
+    wai
+    wai-middleware-prometheus
+    wai-route
+    wai-routing
   ];
   testHaskellDepends = [
-    base bytestring containers hspec http-types imports metrics-core
-    servant servant-multipart string-conversions text wai
-    wai-middleware-prometheus wai-route wai-routing
+    base
+    bytestring
+    containers
+    hspec
+    http-types
+    imports
+    metrics-core
+    servant
+    servant-multipart
+    string-conversions
+    text
+    wai
+    wai-middleware-prometheus
+    wai-route
+    wai-routing
   ];
   testToolDepends = [ hspec-discover ];
   description = "Metrics WAI integration";
diff --git a/libs/polysemy-wire-zoo/default.nix b/libs/polysemy-wire-zoo/default.nix
index 178182a141..ea3e21fdf0 100644
--- a/libs/polysemy-wire-zoo/default.nix
+++ b/libs/polysemy-wire-zoo/default.nix
@@ -2,23 +2,59 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, cassandra-util, containers, gitignoreSource
-, HsOpenSSL, hspec, hspec-discover, imports, lib, polysemy
-, polysemy-check, polysemy-plugin, QuickCheck, saml2-web-sso, time
-, tinylog, types-common, unliftio, uuid, wire-api
+{ mkDerivation
+, base
+, cassandra-util
+, containers
+, gitignoreSource
+, HsOpenSSL
+, hspec
+, hspec-discover
+, imports
+, lib
+, polysemy
+, polysemy-check
+, polysemy-plugin
+, QuickCheck
+, saml2-web-sso
+, time
+, tinylog
+, types-common
+, unliftio
+, uuid
+, wire-api
 }:
 mkDerivation {
   pname = "polysemy-wire-zoo";
   version = "0.1.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    base cassandra-util HsOpenSSL hspec imports polysemy polysemy-check
-    polysemy-plugin QuickCheck saml2-web-sso time tinylog types-common
-    unliftio uuid wire-api
+    base
+    cassandra-util
+    HsOpenSSL
+    hspec
+    imports
+    polysemy
+    polysemy-check
+    polysemy-plugin
+    QuickCheck
+    saml2-web-sso
+    time
+    tinylog
+    types-common
+    unliftio
+    uuid
+    wire-api
   ];
   testHaskellDepends = [
-    base containers hspec imports polysemy polysemy-check
-    polysemy-plugin unliftio
+    base
+    containers
+    hspec
+    imports
+    polysemy
+    polysemy-check
+    polysemy-plugin
+    unliftio
   ];
   testToolDepends = [ hspec-discover ];
   description = "Polysemy interface for various libraries";
diff --git a/libs/ropes/default.nix b/libs/ropes/default.nix
index a97db02000..6dd3c1ed69 100644
--- a/libs/ropes/default.nix
+++ b/libs/ropes/default.nix
@@ -2,17 +2,35 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, base, bytestring, errors, gitignoreSource
-, http-client, http-types, imports, iso3166-country-codes, lib
-, text, time
+{ mkDerivation
+, aeson
+, base
+, bytestring
+, errors
+, gitignoreSource
+, http-client
+, http-types
+, imports
+, iso3166-country-codes
+, lib
+, text
+, time
 }:
 mkDerivation {
   pname = "ropes";
   version = "0.4.20";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson base bytestring errors http-client http-types imports
-    iso3166-country-codes text time
+    aeson
+    base
+    bytestring
+    errors
+    http-client
+    http-types
+    imports
+    iso3166-country-codes
+    text
+    time
   ];
   description = "Various ropes to tie together with external web services";
   license = lib.licenses.agpl3Only;
diff --git a/libs/schema-profunctor/default.nix b/libs/schema-profunctor/default.nix
index f2d47ba224..a498d97378 100644
--- a/libs/schema-profunctor/default.nix
+++ b/libs/schema-profunctor/default.nix
@@ -2,22 +2,55 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, aeson-qq, base, bifunctors, comonad
-, containers, gitignoreSource, imports, insert-ordered-containers
-, lens, lib, profunctors, swagger2, tasty, tasty-hunit, text
-, transformers, vector
+{ mkDerivation
+, aeson
+, aeson-qq
+, base
+, bifunctors
+, comonad
+, containers
+, gitignoreSource
+, imports
+, insert-ordered-containers
+, lens
+, lib
+, profunctors
+, swagger2
+, tasty
+, tasty-hunit
+, text
+, transformers
+, vector
 }:
 mkDerivation {
   pname = "schema-profunctor";
   version = "0.1.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson base bifunctors comonad containers imports lens profunctors
-    swagger2 text transformers vector
+    aeson
+    base
+    bifunctors
+    comonad
+    containers
+    imports
+    lens
+    profunctors
+    swagger2
+    text
+    transformers
+    vector
   ];
   testHaskellDepends = [
-    aeson aeson-qq base imports insert-ordered-containers lens swagger2
-    tasty tasty-hunit text
+    aeson
+    aeson-qq
+    base
+    imports
+    insert-ordered-containers
+    lens
+    swagger2
+    tasty
+    tasty-hunit
+    text
   ];
   license = lib.licenses.agpl3Only;
 }
diff --git a/libs/sodium-crypto-sign/default.nix b/libs/sodium-crypto-sign/default.nix
index b7ab77265d..16278c2952 100644
--- a/libs/sodium-crypto-sign/default.nix
+++ b/libs/sodium-crypto-sign/default.nix
@@ -2,15 +2,24 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, base64-bytestring, bytestring
-, gitignoreSource, imports, lib, libsodium
+{ mkDerivation
+, base
+, base64-bytestring
+, bytestring
+, gitignoreSource
+, imports
+, lib
+, libsodium
 }:
 mkDerivation {
   pname = "sodium-crypto-sign";
   version = "0.1.2";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    base base64-bytestring bytestring imports
+    base
+    base64-bytestring
+    bytestring
+    imports
   ];
   libraryPkgconfigDepends = [ libsodium ];
   description = "FFI to some of the libsodium crypto_sign_* functions";
diff --git a/libs/ssl-util/default.nix b/libs/ssl-util/default.nix
index 1ff0f94b88..1ec717b7f7 100644
--- a/libs/ssl-util/default.nix
+++ b/libs/ssl-util/default.nix
@@ -2,15 +2,29 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, byteable, bytestring, gitignoreSource
-, HsOpenSSL, http-client, imports, lib, time
+{ mkDerivation
+, base
+, byteable
+, bytestring
+, gitignoreSource
+, HsOpenSSL
+, http-client
+, imports
+, lib
+, time
 }:
 mkDerivation {
   pname = "ssl-util";
   version = "0.1.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    base byteable bytestring HsOpenSSL http-client imports time
+    base
+    byteable
+    bytestring
+    HsOpenSSL
+    http-client
+    imports
+    time
   ];
   description = "SSL-related utilities";
   license = lib.licenses.agpl3Only;
diff --git a/libs/tasty-cannon/default.nix b/libs/tasty-cannon/default.nix
index 4b79d90f24..297f3ce945 100644
--- a/libs/tasty-cannon/default.nix
+++ b/libs/tasty-cannon/default.nix
@@ -2,19 +2,47 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, async, base, bilge, bytestring
-, bytestring-conversion, data-timeout, exceptions, gitignoreSource
-, http-client, http-types, imports, lib, random, tasty-hunit
-, types-common, websockets, wire-api
+{ mkDerivation
+, aeson
+, async
+, base
+, bilge
+, bytestring
+, bytestring-conversion
+, data-timeout
+, exceptions
+, gitignoreSource
+, http-client
+, http-types
+, imports
+, lib
+, random
+, tasty-hunit
+, types-common
+, websockets
+, wire-api
 }:
 mkDerivation {
   pname = "tasty-cannon";
   version = "0.4.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson async base bilge bytestring bytestring-conversion
-    data-timeout exceptions http-client http-types imports random
-    tasty-hunit types-common websockets wire-api
+    aeson
+    async
+    base
+    bilge
+    bytestring
+    bytestring-conversion
+    data-timeout
+    exceptions
+    http-client
+    http-types
+    imports
+    random
+    tasty-hunit
+    types-common
+    websockets
+    wire-api
   ];
   description = "Cannon Integration Testing Utilities";
   license = lib.licenses.agpl3Only;
diff --git a/libs/types-common-aws/default.nix b/libs/types-common-aws/default.nix
index 229d7060bf..647dd6884d 100644
--- a/libs/types-common-aws/default.nix
+++ b/libs/types-common-aws/default.nix
@@ -2,17 +2,44 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, amazonka, amazonka-sqs, base, base64-bytestring
-, exceptions, gitignoreSource, imports, lens, lib, monad-control
-, proto-lens, resourcet, safe, tasty, tasty-hunit, text, time
+{ mkDerivation
+, amazonka
+, amazonka-sqs
+, base
+, base64-bytestring
+, exceptions
+, gitignoreSource
+, imports
+, lens
+, lib
+, monad-control
+, proto-lens
+, resourcet
+, safe
+, tasty
+, tasty-hunit
+, text
+, time
 }:
 mkDerivation {
   pname = "types-common-aws";
   version = "0.16.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    amazonka amazonka-sqs base base64-bytestring exceptions imports
-    lens monad-control proto-lens resourcet safe tasty tasty-hunit text
+    amazonka
+    amazonka-sqs
+    base
+    base64-bytestring
+    exceptions
+    imports
+    lens
+    monad-control
+    proto-lens
+    resourcet
+    safe
+    tasty
+    tasty-hunit
+    text
     time
   ];
   description = "Shared AWS type definitions";
diff --git a/libs/types-common-journal/default.nix b/libs/types-common-journal/default.nix
index 338c21abae..7dae825dfb 100644
--- a/libs/types-common-journal/default.nix
+++ b/libs/types-common-journal/default.nix
@@ -2,9 +2,19 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, bytestring, Cabal, gitignoreSource, imports
-, lib, proto-lens-protoc, proto-lens-runtime, proto-lens-setup
-, time, types-common, uuid
+{ mkDerivation
+, base
+, bytestring
+, Cabal
+, gitignoreSource
+, imports
+, lib
+, proto-lens-protoc
+, proto-lens-runtime
+, proto-lens-setup
+, time
+, types-common
+, uuid
 }:
 mkDerivation {
   pname = "types-common-journal";
@@ -12,7 +22,13 @@ mkDerivation {
   src = gitignoreSource ./.;
   setupHaskellDepends = [ base Cabal proto-lens-setup ];
   libraryHaskellDepends = [
-    base bytestring imports proto-lens-runtime time types-common uuid
+    base
+    bytestring
+    imports
+    proto-lens-runtime
+    time
+    types-common
+    uuid
   ];
   libraryToolDepends = [ proto-lens-protoc ];
   description = "Shared protobuf type definitions";
diff --git a/libs/types-common/default.nix b/libs/types-common/default.nix
index 425dfeffff..b1f22221ba 100644
--- a/libs/types-common/default.nix
+++ b/libs/types-common/default.nix
@@ -2,40 +2,140 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, attoparsec, attoparsec-iso8601, base
-, base16-bytestring, base64-bytestring, binary, bytestring
-, bytestring-conversion, cassandra-util, cereal, containers
-, cryptohash-md5, cryptohash-sha1, cryptonite, currency-codes
-, data-default, generic-random, gitignoreSource, hashable
-, http-api-data, imports, iproute, iso3166-country-codes, iso639
-, lens, lens-datetime, lib, mime, optparse-applicative, pem
-, protobuf, QuickCheck, quickcheck-instances, random
-, schema-profunctor, scientific, servant-server, singletons
-, string-conversions, swagger, swagger2, tagged, tasty, tasty-hunit
-, tasty-quickcheck, text, time, time-locale-compat, tinylog, unix
-, unordered-containers, uri-bytestring, uuid, vector, yaml
+{ mkDerivation
+, aeson
+, attoparsec
+, attoparsec-iso8601
+, base
+, base16-bytestring
+, base64-bytestring
+, binary
+, bytestring
+, bytestring-conversion
+, cassandra-util
+, cereal
+, containers
+, cryptohash-md5
+, cryptohash-sha1
+, cryptonite
+, currency-codes
+, data-default
+, generic-random
+, gitignoreSource
+, hashable
+, http-api-data
+, imports
+, iproute
+, iso3166-country-codes
+, iso639
+, lens
+, lens-datetime
+, lib
+, mime
+, optparse-applicative
+, pem
+, protobuf
+, QuickCheck
+, quickcheck-instances
+, random
+, schema-profunctor
+, scientific
+, servant-server
+, singletons
+, string-conversions
+, swagger
+, swagger2
+, tagged
+, tasty
+, tasty-hunit
+, tasty-quickcheck
+, text
+, time
+, time-locale-compat
+, tinylog
+, unix
+, unordered-containers
+, uri-bytestring
+, uuid
+, vector
+, yaml
 }:
 mkDerivation {
   pname = "types-common";
   version = "0.16.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson attoparsec attoparsec-iso8601 base base16-bytestring
-    base64-bytestring binary bytestring bytestring-conversion
-    cassandra-util containers cryptohash-md5 cryptohash-sha1 cryptonite
-    currency-codes data-default generic-random hashable http-api-data
-    imports iproute iso3166-country-codes iso639 lens lens-datetime
-    mime optparse-applicative pem protobuf QuickCheck
-    quickcheck-instances random schema-profunctor scientific
-    servant-server singletons string-conversions swagger swagger2
-    tagged tasty text time time-locale-compat tinylog unix
-    unordered-containers uri-bytestring uuid vector yaml
+    aeson
+    attoparsec
+    attoparsec-iso8601
+    base
+    base16-bytestring
+    base64-bytestring
+    binary
+    bytestring
+    bytestring-conversion
+    cassandra-util
+    containers
+    cryptohash-md5
+    cryptohash-sha1
+    cryptonite
+    currency-codes
+    data-default
+    generic-random
+    hashable
+    http-api-data
+    imports
+    iproute
+    iso3166-country-codes
+    iso639
+    lens
+    lens-datetime
+    mime
+    optparse-applicative
+    pem
+    protobuf
+    QuickCheck
+    quickcheck-instances
+    random
+    schema-profunctor
+    scientific
+    servant-server
+    singletons
+    string-conversions
+    swagger
+    swagger2
+    tagged
+    tasty
+    text
+    time
+    time-locale-compat
+    tinylog
+    unix
+    unordered-containers
+    uri-bytestring
+    uuid
+    vector
+    yaml
   ];
   testHaskellDepends = [
-    aeson base base16-bytestring base64-bytestring bytestring
-    bytestring-conversion cereal imports protobuf QuickCheck
-    string-conversions tasty tasty-hunit tasty-quickcheck text time
-    unordered-containers uuid
+    aeson
+    base
+    base16-bytestring
+    base64-bytestring
+    bytestring
+    bytestring-conversion
+    cereal
+    imports
+    protobuf
+    QuickCheck
+    string-conversions
+    tasty
+    tasty-hunit
+    tasty-quickcheck
+    text
+    time
+    unordered-containers
+    uuid
   ];
   description = "Shared type definitions";
   license = lib.licenses.agpl3Only;
diff --git a/libs/wai-utilities/default.nix b/libs/wai-utilities/default.nix
index ea9cebed79..93a249b3c7 100644
--- a/libs/wai-utilities/default.nix
+++ b/libs/wai-utilities/default.nix
@@ -2,24 +2,71 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, async, base, bytestring
-, bytestring-conversion, errors, exceptions, gitignoreSource
-, http-types, imports, kan-extensions, lib, metrics-core
-, metrics-wai, pipes, prometheus-client, servant-server
-, streaming-commons, string-conversions, swagger, swagger2, text
-, tinylog, types-common, unix, wai, wai-predicates, wai-routing
-, warp, warp-tls
+{ mkDerivation
+, aeson
+, async
+, base
+, bytestring
+, bytestring-conversion
+, errors
+, exceptions
+, gitignoreSource
+, http-types
+, imports
+, kan-extensions
+, lib
+, metrics-core
+, metrics-wai
+, pipes
+, prometheus-client
+, servant-server
+, streaming-commons
+, string-conversions
+, swagger
+, swagger2
+, text
+, tinylog
+, types-common
+, unix
+, wai
+, wai-predicates
+, wai-routing
+, warp
+, warp-tls
 }:
 mkDerivation {
   pname = "wai-utilities";
   version = "0.16.1";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson async base bytestring bytestring-conversion errors exceptions
-    http-types imports kan-extensions metrics-core metrics-wai pipes
-    prometheus-client servant-server streaming-commons
-    string-conversions swagger swagger2 text tinylog types-common unix
-    wai wai-predicates wai-routing warp warp-tls
+    aeson
+    async
+    base
+    bytestring
+    bytestring-conversion
+    errors
+    exceptions
+    http-types
+    imports
+    kan-extensions
+    metrics-core
+    metrics-wai
+    pipes
+    prometheus-client
+    servant-server
+    streaming-commons
+    string-conversions
+    swagger
+    swagger2
+    text
+    tinylog
+    types-common
+    unix
+    wai
+    wai-predicates
+    wai-routing
+    warp
+    warp-tls
   ];
   description = "Various helpers for WAI";
   license = lib.licenses.agpl3Only;
diff --git a/libs/wire-api-federation/default.nix b/libs/wire-api-federation/default.nix
index 1fffa573fb..3c7d80254e 100644
--- a/libs/wire-api-federation/default.nix
+++ b/libs/wire-api-federation/default.nix
@@ -2,39 +2,145 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, aeson-pretty, async, base, bytestring
-, bytestring-conversion, case-insensitive, containers, either
-, errors, exceptions, gitignoreSource, hspec, hspec-discover
-, http-media, http-types, http2, HUnit, imports, kan-extensions
-, lens, lib, lifted-base, metrics-wai, mtl, network, QuickCheck
-, retry, schema-profunctor, servant, servant-client
-, servant-client-core, servant-server, singletons, sop-core
-, streaming-commons, swagger2, template-haskell, text, time
-, time-manager, tls, transformers, types-common, uuid
-, wai-utilities, wire-api
+{ mkDerivation
+, aeson
+, aeson-pretty
+, async
+, base
+, bytestring
+, bytestring-conversion
+, case-insensitive
+, containers
+, either
+, errors
+, exceptions
+, gitignoreSource
+, hspec
+, hspec-discover
+, http-media
+, http-types
+, http2
+, HUnit
+, imports
+, kan-extensions
+, lens
+, lib
+, lifted-base
+, metrics-wai
+, mtl
+, network
+, QuickCheck
+, retry
+, schema-profunctor
+, servant
+, servant-client
+, servant-client-core
+, servant-server
+, singletons
+, sop-core
+, streaming-commons
+, swagger2
+, template-haskell
+, text
+, time
+, time-manager
+, tls
+, transformers
+, types-common
+, uuid
+, wai-utilities
+, wire-api
 }:
 mkDerivation {
   pname = "wire-api-federation";
   version = "0.1.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson async base bytestring bytestring-conversion case-insensitive
-    containers either errors exceptions http-media http-types http2
-    imports kan-extensions lens lifted-base metrics-wai mtl network
-    QuickCheck schema-profunctor servant servant-client
-    servant-client-core servant-server singletons sop-core
-    streaming-commons swagger2 template-haskell text time time-manager
-    tls transformers types-common wai-utilities wire-api
+    aeson
+    async
+    base
+    bytestring
+    bytestring-conversion
+    case-insensitive
+    containers
+    either
+    errors
+    exceptions
+    http-media
+    http-types
+    http2
+    imports
+    kan-extensions
+    lens
+    lifted-base
+    metrics-wai
+    mtl
+    network
+    QuickCheck
+    schema-profunctor
+    servant
+    servant-client
+    servant-client-core
+    servant-server
+    singletons
+    sop-core
+    streaming-commons
+    swagger2
+    template-haskell
+    text
+    time
+    time-manager
+    tls
+    transformers
+    types-common
+    wai-utilities
+    wire-api
   ];
   testHaskellDepends = [
-    aeson aeson-pretty async base bytestring bytestring-conversion
-    case-insensitive containers either errors exceptions hspec
-    http-media http-types http2 HUnit imports kan-extensions lens
-    lifted-base metrics-wai mtl network QuickCheck retry
-    schema-profunctor servant servant-client servant-client-core
-    servant-server singletons sop-core streaming-commons swagger2
-    template-haskell text time time-manager tls transformers
-    types-common uuid wai-utilities wire-api
+    aeson
+    aeson-pretty
+    async
+    base
+    bytestring
+    bytestring-conversion
+    case-insensitive
+    containers
+    either
+    errors
+    exceptions
+    hspec
+    http-media
+    http-types
+    http2
+    HUnit
+    imports
+    kan-extensions
+    lens
+    lifted-base
+    metrics-wai
+    mtl
+    network
+    QuickCheck
+    retry
+    schema-profunctor
+    servant
+    servant-client
+    servant-client-core
+    servant-server
+    singletons
+    sop-core
+    streaming-commons
+    swagger2
+    template-haskell
+    text
+    time
+    time-manager
+    tls
+    transformers
+    types-common
+    uuid
+    wai-utilities
+    wire-api
   ];
   testToolDepends = [ hspec-discover ];
   description = "The Wire server-to-server API for federation";
diff --git a/libs/wire-api/default.nix b/libs/wire-api/default.nix
index 0569448d06..8564a5767a 100644
--- a/libs/wire-api/default.nix
+++ b/libs/wire-api/default.nix
@@ -2,61 +2,254 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, aeson-pretty, aeson-qq, async, attoparsec
-, base, base64-bytestring, binary, binary-parsers, bytestring
-, bytestring-arbitrary, bytestring-conversion, case-insensitive
-, cassandra-util, cassava, cereal, comonad, conduit, constraints
-, containers, cookie, cryptonite, currency-codes, deriving-aeson
-, deriving-swagger2, directory, either, email-validate, errors
-, extended, extra, filepath, generic-random, generics-sop, ghc-prim
-, gitignoreSource, hashable, hex, hostname-validate, hscim
-, http-api-data, http-media, http-types, imports
-, insert-ordered-containers, iproute, iso3166-country-codes, iso639
-, lens, lib, memory, metrics-wai, mime, mtl, pem, polysemy, pretty
-, process, proto-lens, protobuf, QuickCheck, quickcheck-instances
-, random, resourcet, saml2-web-sso, schema-profunctor, scientific
-, servant, servant-client, servant-client-core, servant-conduit
-, servant-multipart, servant-server, servant-swagger
-, servant-swagger-ui, singletons, sop-core, string-conversions
-, swagger, swagger2, tagged, tasty, tasty-expected-failure
-, tasty-hunit, tasty-quickcheck, text, time, types-common, unliftio
-, unordered-containers, uri-bytestring, utf8-string, uuid, vector
-, wai, wai-extra, wai-utilities, wai-websockets, websockets
-, wire-message-proto-lens, x509, zauth
+{ mkDerivation
+, aeson
+, aeson-pretty
+, aeson-qq
+, async
+, attoparsec
+, base
+, base64-bytestring
+, binary
+, binary-parsers
+, bytestring
+, bytestring-arbitrary
+, bytestring-conversion
+, case-insensitive
+, cassandra-util
+, cassava
+, cereal
+, comonad
+, conduit
+, constraints
+, containers
+, cookie
+, cryptonite
+, currency-codes
+, deriving-aeson
+, deriving-swagger2
+, directory
+, either
+, email-validate
+, errors
+, extended
+, extra
+, filepath
+, generic-random
+, generics-sop
+, ghc-prim
+, gitignoreSource
+, hashable
+, hex
+, hostname-validate
+, hscim
+, http-api-data
+, http-media
+, http-types
+, imports
+, insert-ordered-containers
+, iproute
+, iso3166-country-codes
+, iso639
+, lens
+, lib
+, memory
+, metrics-wai
+, mime
+, mtl
+, pem
+, polysemy
+, pretty
+, process
+, proto-lens
+, protobuf
+, QuickCheck
+, quickcheck-instances
+, random
+, resourcet
+, saml2-web-sso
+, schema-profunctor
+, scientific
+, servant
+, servant-client
+, servant-client-core
+, servant-conduit
+, servant-multipart
+, servant-server
+, servant-swagger
+, servant-swagger-ui
+, singletons
+, sop-core
+, string-conversions
+, swagger
+, swagger2
+, tagged
+, tasty
+, tasty-expected-failure
+, tasty-hunit
+, tasty-quickcheck
+, text
+, time
+, types-common
+, unliftio
+, unordered-containers
+, uri-bytestring
+, utf8-string
+, uuid
+, vector
+, wai
+, wai-extra
+, wai-utilities
+, wai-websockets
+, websockets
+, wire-message-proto-lens
+, x509
+, zauth
 }:
 mkDerivation {
   pname = "wire-api";
   version = "0.1.0";
   src = gitignoreSource ./.;
   libraryHaskellDepends = [
-    aeson attoparsec base base64-bytestring binary binary-parsers
-    bytestring bytestring-conversion case-insensitive cassandra-util
-    cassava cereal comonad conduit constraints containers cookie
-    cryptonite currency-codes deriving-aeson deriving-swagger2 either
-    email-validate errors extended extra filepath generic-random
-    generics-sop ghc-prim hashable hostname-validate hscim
-    http-api-data http-media http-types imports
-    insert-ordered-containers iproute iso3166-country-codes iso639 lens
-    memory metrics-wai mime mtl pem polysemy proto-lens protobuf
-    QuickCheck quickcheck-instances random resourcet saml2-web-sso
-    schema-profunctor scientific servant servant-client
-    servant-client-core servant-conduit servant-multipart
-    servant-server servant-swagger servant-swagger-ui singletons
-    sop-core string-conversions swagger swagger2 tagged text time
-    types-common unordered-containers uri-bytestring utf8-string uuid
-    vector wai wai-extra wai-utilities wai-websockets websockets
-    wire-message-proto-lens x509 zauth
+    aeson
+    attoparsec
+    base
+    base64-bytestring
+    binary
+    binary-parsers
+    bytestring
+    bytestring-conversion
+    case-insensitive
+    cassandra-util
+    cassava
+    cereal
+    comonad
+    conduit
+    constraints
+    containers
+    cookie
+    cryptonite
+    currency-codes
+    deriving-aeson
+    deriving-swagger2
+    either
+    email-validate
+    errors
+    extended
+    extra
+    filepath
+    generic-random
+    generics-sop
+    ghc-prim
+    hashable
+    hostname-validate
+    hscim
+    http-api-data
+    http-media
+    http-types
+    imports
+    insert-ordered-containers
+    iproute
+    iso3166-country-codes
+    iso639
+    lens
+    memory
+    metrics-wai
+    mime
+    mtl
+    pem
+    polysemy
+    proto-lens
+    protobuf
+    QuickCheck
+    quickcheck-instances
+    random
+    resourcet
+    saml2-web-sso
+    schema-profunctor
+    scientific
+    servant
+    servant-client
+    servant-client-core
+    servant-conduit
+    servant-multipart
+    servant-server
+    servant-swagger
+    servant-swagger-ui
+    singletons
+    sop-core
+    string-conversions
+    swagger
+    swagger2
+    tagged
+    text
+    time
+    types-common
+    unordered-containers
+    uri-bytestring
+    utf8-string
+    uuid
+    vector
+    wai
+    wai-extra
+    wai-utilities
+    wai-websockets
+    websockets
+    wire-message-proto-lens
+    x509
+    zauth
   ];
   testHaskellDepends = [
-    aeson aeson-pretty aeson-qq async base binary bytestring
-    bytestring-arbitrary bytestring-conversion case-insensitive cassava
-    containers cryptonite currency-codes directory either filepath hex
-    hscim imports iso3166-country-codes iso639 lens memory metrics-wai
-    mime pem pretty process proto-lens QuickCheck saml2-web-sso
-    schema-profunctor servant servant-swagger-ui string-conversions
-    swagger2 tasty tasty-expected-failure tasty-hunit tasty-quickcheck
-    text time types-common unliftio unordered-containers uri-bytestring
-    uuid vector wire-message-proto-lens
+    aeson
+    aeson-pretty
+    aeson-qq
+    async
+    base
+    binary
+    bytestring
+    bytestring-arbitrary
+    bytestring-conversion
+    case-insensitive
+    cassava
+    containers
+    cryptonite
+    currency-codes
+    directory
+    either
+    filepath
+    hex
+    hscim
+    imports
+    iso3166-country-codes
+    iso639
+    lens
+    memory
+    metrics-wai
+    mime
+    pem
+    pretty
+    process
+    proto-lens
+    QuickCheck
+    saml2-web-sso
+    schema-profunctor
+    servant
+    servant-swagger-ui
+    string-conversions
+    swagger2
+    tasty
+    tasty-expected-failure
+    tasty-hunit
+    tasty-quickcheck
+    text
+    time
+    types-common
+    unliftio
+    unordered-containers
+    uri-bytestring
+    uuid
+    vector
+    wire-message-proto-lens
   ];
   license = lib.licenses.agpl3Only;
 }
diff --git a/libs/wire-message-proto-lens/default.nix b/libs/wire-message-proto-lens/default.nix
index 598b4edb7f..3c58511773 100644
--- a/libs/wire-message-proto-lens/default.nix
+++ b/libs/wire-message-proto-lens/default.nix
@@ -2,8 +2,14 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, Cabal, gitignoreSource, lib
-, proto-lens-protoc, proto-lens-runtime, proto-lens-setup
+{ mkDerivation
+, base
+, Cabal
+, gitignoreSource
+, lib
+, proto-lens-protoc
+, proto-lens-runtime
+, proto-lens-setup
 }:
 mkDerivation {
   pname = "wire-message-proto-lens";
diff --git a/libs/zauth/default.nix b/libs/zauth/default.nix
index 9cc4a774c0..0ff83b4703 100644
--- a/libs/zauth/default.nix
+++ b/libs/zauth/default.nix
@@ -2,11 +2,29 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, attoparsec, base, base64-bytestring, bytestring
-, bytestring-conversion, errors, exceptions, gitignoreSource
-, imports, lens, lib, mtl, mwc-random, optparse-applicative
-, sodium-crypto-sign, tasty, tasty-hunit, tasty-quickcheck, text
-, time, uuid, vector
+{ mkDerivation
+, attoparsec
+, base
+, base64-bytestring
+, bytestring
+, bytestring-conversion
+, errors
+, exceptions
+, gitignoreSource
+, imports
+, lens
+, lib
+, mtl
+, mwc-random
+, optparse-applicative
+, sodium-crypto-sign
+, tasty
+, tasty-hunit
+, tasty-quickcheck
+, text
+, time
+, uuid
+, vector
 }:
 mkDerivation {
   pname = "zauth";
@@ -15,17 +33,47 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    attoparsec base base64-bytestring bytestring bytestring-conversion
-    errors exceptions imports lens mtl mwc-random sodium-crypto-sign
-    time uuid vector
+    attoparsec
+    base
+    base64-bytestring
+    bytestring
+    bytestring-conversion
+    errors
+    exceptions
+    imports
+    lens
+    mtl
+    mwc-random
+    sodium-crypto-sign
+    time
+    uuid
+    vector
   ];
   executableHaskellDepends = [
-    base base64-bytestring bytestring bytestring-conversion errors
-    imports lens optparse-applicative sodium-crypto-sign uuid
+    base
+    base64-bytestring
+    bytestring
+    bytestring-conversion
+    errors
+    imports
+    lens
+    optparse-applicative
+    sodium-crypto-sign
+    uuid
   ];
   testHaskellDepends = [
-    base bytestring bytestring-conversion errors imports lens
-    sodium-crypto-sign tasty tasty-hunit tasty-quickcheck text uuid
+    base
+    bytestring
+    bytestring-conversion
+    errors
+    imports
+    lens
+    sodium-crypto-sign
+    tasty
+    tasty-hunit
+    tasty-quickcheck
+    text
+    uuid
   ];
   description = "Creation and validation of signed tokens";
   license = lib.licenses.agpl3Only;
diff --git a/nix/haskell-pins.nix b/nix/haskell-pins.nix
index 43ad8c1fc9..87875e4e3a 100644
--- a/nix/haskell-pins.nix
+++ b/nix/haskell-pins.nix
@@ -54,7 +54,7 @@
 # 1. Update version number.
 # 2. Make the 'sha256' blank string.
 # 3. Run step 3. from how to add a git pin.
-{lib, fetchgit}: hself: hsuper:
+{ lib, fetchgit }: hself: hsuper:
 let
   gitPins = {
     HaskellNet-SSL = {
@@ -70,7 +70,7 @@ let
         rev = "2e3282e5fb27ba8d989c271a0a989823fad7ec43";
         sha256 = "0vfzysn9sgpxymfvpahxrp74fczgjnw3kgknj6zk0473qk85488f";
       };
-      packages =  {
+      packages = {
         wai-middleware-prometheus = "wai-middleware-prometheus";
       };
     };
@@ -89,7 +89,8 @@ let
       };
       packages = {
         x509-store = "x509-store";
-      };};
+      };
+    };
     amazonka = {
       src = fetchgit {
         url = "https://github.com/wireapp/amazonka";
@@ -107,7 +108,8 @@ let
         amazonka-sqs = "lib/services/amazonka-sqs";
         amazonka-sso = "lib/services/amazonka-sso";
         amazonka-sts = "lib/services/amazonka-sts";
-      };};
+      };
+    };
     bloodhound = {
       src = fetchgit {
         url = "https://github.com/wireapp/bloodhound";
@@ -154,7 +156,8 @@ let
         http-client-openssl = "http-client-openssl";
         http-client-tls = "http-client-tls";
         http-conduit = "http-conduit";
-      };};
+      };
+    };
     http2 = {
       src = fetchgit {
         url = "https://github.com/wireapp/http2";
@@ -229,24 +232,39 @@ let
   };
   # Name -> Source -> Maybe Subpath -> Drv
   mkGitDrv = name: src: subpath:
-    let subpathArg = if subpath == null
-                     then ""
-                     else "--subpath='${subpath}'";
-    in hself.callCabal2nixWithOptions name src "${subpathArg}" {};
+    let
+      subpathArg =
+        if subpath == null
+        then ""
+        else "--subpath='${subpath}'";
+    in
+    hself.callCabal2nixWithOptions name src "${subpathArg}" { };
   # [[AtrrSet]]
-  gitPackages = lib.attrsets.mapAttrsToList (name: pin:
-    let packages = if pin?packages
-                   then pin.packages
-                   else { "${name}" = null;};
-    in lib.attrsets.mapAttrsToList (name: subpath:
-      {"${name}" = mkGitDrv name pin.src subpath;}
-    ) packages
-  ) gitPins;
+  gitPackages = lib.attrsets.mapAttrsToList
+    (name: pin:
+      let
+        packages =
+          if pin?packages
+          then pin.packages
+          else { "${name}" = null; };
+      in
+      lib.attrsets.mapAttrsToList
+        (name: subpath:
+          { "${name}" = mkGitDrv name pin.src subpath; }
+        )
+        packages
+    )
+    gitPins;
   # AttrSet
-  hackagePackages = lib.attrsets.mapAttrs (pkg: {version, sha256}:
-    hself.callHackageDirect {
-      ver = version;
-      inherit pkg sha256;
-    } {}
-  ) hackagePins;
-in lib.lists.foldr (a: b: a // b) hackagePackages (lib.lists.flatten gitPackages)
+  hackagePackages = lib.attrsets.mapAttrs
+    (pkg: { version, sha256 }:
+      hself.callHackageDirect
+        {
+          ver = version;
+          inherit pkg sha256;
+        }
+        { }
+    )
+    hackagePins;
+in
+lib.lists.foldr (a: b: a // b) hackagePackages (lib.lists.flatten gitPackages)
diff --git a/nix/pkgs/python-docs/sphinx-multiversion.nix b/nix/pkgs/python-docs/sphinx-multiversion.nix
index ef09691cb3..2b97e1ef91 100644
--- a/nix/pkgs/python-docs/sphinx-multiversion.nix
+++ b/nix/pkgs/python-docs/sphinx-multiversion.nix
@@ -1,9 +1,8 @@
-{
-  buildPythonApplication,
-  buildPythonPackage,
-  fetchPypi,
-
-  sphinx,
+{ buildPythonApplication
+, buildPythonPackage
+, fetchPypi
+, sphinx
+,
 }:
 buildPythonPackage rec {
   pname = "sphinx-multiversion";
diff --git a/nix/pkgs/python-docs/sphinx_reredirects.nix b/nix/pkgs/python-docs/sphinx_reredirects.nix
index 2985a9d775..1bff318055 100644
--- a/nix/pkgs/python-docs/sphinx_reredirects.nix
+++ b/nix/pkgs/python-docs/sphinx_reredirects.nix
@@ -1,9 +1,8 @@
-{
-  fetchPypi,
-  buildPythonPackage,
-
-  sphinx,
-} :
+{ fetchPypi
+, buildPythonPackage
+, sphinx
+,
+}:
 buildPythonPackage rec {
 
   pname = "sphinx_reredirects";
diff --git a/nix/pkgs/python-docs/sphinxcontrib-kroki.nix b/nix/pkgs/python-docs/sphinxcontrib-kroki.nix
index 5cfa07c365..f65a43a135 100644
--- a/nix/pkgs/python-docs/sphinxcontrib-kroki.nix
+++ b/nix/pkgs/python-docs/sphinxcontrib-kroki.nix
@@ -1,11 +1,10 @@
-{
-  fetchPypi,
-  buildPythonPackage,
-
-  sphinx,
-  requests,
-  pyyaml,
-} :
+{ fetchPypi
+, buildPythonPackage
+, sphinx
+, requests
+, pyyaml
+,
+}:
 buildPythonPackage rec {
 
   pname = "sphinxcontrib-kroki";
diff --git a/nix/pkgs/python-docs/svg2rlg.nix b/nix/pkgs/python-docs/svg2rlg.nix
index 7d7fd4a696..d154f21595 100644
--- a/nix/pkgs/python-docs/svg2rlg.nix
+++ b/nix/pkgs/python-docs/svg2rlg.nix
@@ -1,8 +1,6 @@
-{
-  buildPythonPackage,
-  fetchPypi,
-
-  reportlab
+{ buildPythonPackage
+, fetchPypi
+, reportlab
 }:
 buildPythonPackage rec {
   pname = "svg2rlg";
@@ -12,6 +10,6 @@ buildPythonPackage rec {
     sha256 = "sha256-BdtEgLkOkS4Icn1MskOF/jPoQ23vB5uPFJtho1Bji+4=";
   };
 
-  buildInputs = [reportlab];
+  buildInputs = [ reportlab ];
   doCheck = false;
 }
diff --git a/nix/wire-server.nix b/nix/wire-server.nix
index 0f36d942b1..194c90fff8 100644
--- a/nix/wire-server.nix
+++ b/nix/wire-server.nix
@@ -43,173 +43,189 @@
 # components and the required dependencies. We then use this package set along
 # with nixpkgs' dockerTools to make derivations for docker images that we need.
 pkgs:
-let lib = pkgs.lib;
-    hlib = pkgs.haskell.lib;
-    withCleanedPath = drv:
-      hlib.overrideCabal drv (old: {
-        src = lib.cleanSourceWith {
-          src = old.src;
-          filter = path: type:
-            let baseName = baseNameOf (toString path);
-            in baseName != "dist";
-        };
-      });
+let
+  lib = pkgs.lib;
+  hlib = pkgs.haskell.lib;
+  withCleanedPath = drv:
+    hlib.overrideCabal drv (old: {
+      src = lib.cleanSourceWith {
+        src = old.src;
+        filter = path: type:
+          let baseName = baseNameOf (toString path);
+          in baseName != "dist";
+      };
+    });
 
-    gitignoreSource =
-      let gitignoreSrc = pkgs.fetchFromGitHub {
-            owner = "hercules-ci";
-            repo = "gitignore.nix";
-            # put the latest commit sha of gitignore Nix library here:
-            rev = "a20de23b925fd8264fd7fad6454652e142fd7f73";
-            # use what nix suggests in the mismatch message here:
-            sha256 = "sha256:07vg2i9va38zbld9abs9lzqblz193vc5wvqd6h7amkmwf66ljcgh";
-          };
-      in (import gitignoreSrc { inherit (pkgs) lib; }).gitignoreSource;
+  gitignoreSource =
+    let
+      gitignoreSrc = pkgs.fetchFromGitHub {
+        owner = "hercules-ci";
+        repo = "gitignore.nix";
+        # put the latest commit sha of gitignore Nix library here:
+        rev = "a20de23b925fd8264fd7fad6454652e142fd7f73";
+        # use what nix suggests in the mismatch message here:
+        sha256 = "sha256:07vg2i9va38zbld9abs9lzqblz193vc5wvqd6h7amkmwf66ljcgh";
+      };
+    in
+    (import gitignoreSrc { inherit (pkgs) lib; }).gitignoreSource;
 
-    # Mapping from package -> [executable]
-    executablesMap = {
-      brig = ["brig" "brig-index" "brig-integration" "brig-schema"];
-      cannon = ["cannon"];
-      cargohold = ["cargohold" "cargohold-integration"];
-      federator = ["federator" "federator-integration"];
-      galley = ["galley" "galley-integration" "galley-schema" "galley-migrate-data"];
-      gundeck = ["gundeck" "gundeck-integration" "gundeck-schema"];
-      proxy = ["proxy"];
-      spar = ["spar" "spar-integration" "spar-schema" "spar-migrate-data"];
-      stern = ["stern"];
+  # Mapping from package -> [executable]
+  executablesMap = {
+    brig = [ "brig" "brig-index" "brig-integration" "brig-schema" ];
+    cannon = [ "cannon" ];
+    cargohold = [ "cargohold" "cargohold-integration" ];
+    federator = [ "federator" "federator-integration" ];
+    galley = [ "galley" "galley-integration" "galley-schema" "galley-migrate-data" ];
+    gundeck = [ "gundeck" "gundeck-integration" "gundeck-schema" ];
+    proxy = [ "proxy" ];
+    spar = [ "spar" "spar-integration" "spar-schema" "spar-migrate-data" ];
+    stern = [ "stern" ];
 
-      billing-team-member-backfill = ["billing-team-member-backfill"];
-      api-simulations = ["api-smoketest" "api-loadtest"];
-      zauth = ["zauth"];
-    };
+    billing-team-member-backfill = [ "billing-team-member-backfill" ];
+    api-simulations = [ "api-smoketest" "api-loadtest" ];
+    zauth = [ "zauth" ];
+  };
 
-    attrsets = lib.attrsets;
+  attrsets = lib.attrsets;
 
-    pinnedPackages = import ./haskell-pins.nix {
-      fetchgit = pkgs.fetchgit;
-      inherit lib;
-    };
+  pinnedPackages = import ./haskell-pins.nix {
+    fetchgit = pkgs.fetchgit;
+    inherit lib;
+  };
 
-    localPackages = {enableOptimization, enableDocs, enableTests}: hsuper: hself:
-      # The default packages are expected to have optimizations and docs turned
-      # on.
-      let defaultPkgs = import ./local-haskell-packages.nix {
-            inherit gitignoreSource;
-          } hsuper hself;
+  localPackages = { enableOptimization, enableDocs, enableTests }: hsuper: hself:
+    # The default packages are expected to have optimizations and docs turned
+    # on.
+    let
+      defaultPkgs = import ./local-haskell-packages.nix
+        {
+          inherit gitignoreSource;
+        }
+        hsuper
+        hself;
 
-          werror = _: hlib.failOnAllWarnings;
-          opt = _: drv:
-            if enableOptimization
-            then drv
-            else
-              # We need to explicitly add `-O0` because all the cabal files
-              # explicitly have `-O2` in them
-              hlib.appendConfigureFlag (hlib.disableOptimization drv) "--ghc-option=-O0";
-          tests = _: drv:
-            if enableTests
-            then drv
-            else hlib.dontCheck drv;
-          docs = _: drv: if enableDocs
-                         then drv
-                         else hlib.dontHaddock drv;
+      werror = _: hlib.failOnAllWarnings;
+      opt = _: drv:
+        if enableOptimization
+        then drv
+        else
+        # We need to explicitly add `-O0` because all the cabal files
+        # explicitly have `-O2` in them
+          hlib.appendConfigureFlag (hlib.disableOptimization drv) "--ghc-option=-O0";
+      tests = _: drv:
+        if enableTests
+        then drv
+        else hlib.dontCheck drv;
+      docs = _: drv:
+        if enableDocs
+        then drv
+        else hlib.dontHaddock drv;
 
-          overrideAll = fn: overrides:
-            attrsets.mapAttrs fn (overrides);
-      in lib.lists.foldr overrideAll defaultPkgs [
-        werror
-        opt
-        docs
-        tests
-      ];
-    manualOverrides = import ./manual-overrides.nix (with pkgs; {
-      inherit hlib libsodium protobuf mls-test-cli;
-    });
+      overrideAll = fn: overrides:
+        attrsets.mapAttrs fn (overrides);
+    in
+    lib.lists.foldr overrideAll defaultPkgs [
+      werror
+      opt
+      docs
+      tests
+    ];
+  manualOverrides = import ./manual-overrides.nix (with pkgs; {
+    inherit hlib libsodium protobuf mls-test-cli;
+  });
 
-    executables = hself: hsuper:
-      attrsets.genAttrs (builtins.attrNames executablesMap) (e: withCleanedPath hsuper.${e});
+  executables = hself: hsuper:
+    attrsets.genAttrs (builtins.attrNames executablesMap) (e: withCleanedPath hsuper.${e});
 
-    staticExecutables = hself: hsuper:
-      attrsets.mapAttrs' (name: _:
+  staticExecutables = hself: hsuper:
+    attrsets.mapAttrs'
+      (name: _:
         attrsets.nameValuePair "${name}-static" (hlib.justStaticExecutables hsuper."${name}")
-      ) executablesMap;
+      )
+      executablesMap;
 
-    hPkgs = localMods@{enableOptimization, enableDocs, enableTests}: pkgs.haskell.packages.ghc8107.override{
-      overrides = lib.composeManyExtensions [
-        pinnedPackages
-        (localPackages localMods)
-        manualOverrides
-        executables
-        staticExecutables
-      ];
+  hPkgs = localMods@{ enableOptimization, enableDocs, enableTests }: pkgs.haskell.packages.ghc8107.override {
+    overrides = lib.composeManyExtensions [
+      pinnedPackages
+      (localPackages localMods)
+      manualOverrides
+      executables
+      staticExecutables
+    ];
+  };
+
+  extractExec = localMods@{ enableOptimization, enableDocs, enableTests }: hPkgName: execName:
+    pkgs.stdenv.mkDerivation {
+      name = execName;
+      buildInputs = [ (hPkgs localMods)."${hPkgName}-static" ];
+      phases = "installPhase";
+      installPhase = ''
+        mkdir -p $out/bin
+        cp "${(hPkgs localMods)."${hPkgName}-static"}/bin/${execName}" "$out/bin/${execName}"
+      '';
     };
 
-    extractExec = localMods@{enableOptimization, enableDocs, enableTests}: hPkgName: execName:
-      pkgs.stdenv.mkDerivation {
-        name = execName;
-        buildInputs = [(hPkgs localMods)."${hPkgName}-static"];
-        phases = "installPhase";
-        installPhase = ''
-          mkdir -p $out/bin
-          cp "${(hPkgs localMods)."${hPkgName}-static"}/bin/${execName}" "$out/bin/${execName}"
-          '';
-      };
+  # We extract static executables out of the output of building the packages
+  # so they don't depend on all the haskell dependencies. These exectuables
+  # are "static" from the perspective of ghc, i.e. they don't dynamically
+  # depend on other haskell packages but they still dynamically depend on C
+  # dependencies like openssl, cryptobox, libxml2, etc. Doing this makes the
+  # final images that we generate much smaller as we don't have to carry
+  # around so files for all haskell packages.
+  staticExecs = localMods@{ enableOptimization, enableDocs, enableTests }:
+    let
+      nested = attrsets.mapAttrs
+        (hPkgName: execNames:
+          attrsets.genAttrs execNames (extractExec localMods hPkgName)
+        )
+        executablesMap;
+      unnested = lib.lists.foldr (x: y: x // y) { } (attrsets.attrValues nested);
+    in
+    unnested;
 
-    # We extract static executables out of the output of building the packages
-    # so they don't depend on all the haskell dependencies. These exectuables
-    # are "static" from the perspective of ghc, i.e. they don't dynamically
-    # depend on other haskell packages but they still dynamically depend on C
-    # dependencies like openssl, cryptobox, libxml2, etc. Doing this makes the
-    # final images that we generate much smaller as we don't have to carry
-    # around so files for all haskell packages.
-    staticExecs = localMods@{enableOptimization, enableDocs, enableTests}:
-      let nested = attrsets.mapAttrs (hPkgName: execNames:
-            attrsets.genAttrs execNames (extractExec localMods hPkgName)
-          ) executablesMap;
-          unnested = lib.lists.foldr (x: y: x // y) {} (attrsets.attrValues nested);
-      in unnested;
+  # Docker tools doesn't create tmp directories but some processes need this
+  # and so we have to create it ourself.
+  tmpDir = pkgs.runCommand "tmp-dir" { } ''
+    mkdir -p $out/tmp
+    mkdir -p $out/var/tmp
+  '';
 
-    # Docker tools doesn't create tmp directories but some processes need this
-    # and so we have to create it ourself.
-    tmpDir = pkgs.runCommand "tmp-dir" {} ''
-       mkdir -p $out/tmp
-       mkdir -p $out/var/tmp
+  brig-templates = pkgs.stdenvNoCC.mkDerivation {
+    name = "brig-templates";
+    src = ../services/brig/deb/opt/brig/templates;
+    installPhase = ''
+      mkdir -p $out/usr/share/wire
+      cp -r $src $out/usr/share/wire/templates
     '';
+  };
 
-    brig-templates = pkgs.stdenvNoCC.mkDerivation {
-      name = "brig-templates";
-      src = ../services/brig/deb/opt/brig/templates;
-      installPhase = ''
-         mkdir -p $out/usr/share/wire
-         cp -r $src $out/usr/share/wire/templates
-      '';
-    };
-
-    # Some images require extra things which is not possible to specify using
-    # cabal file dependencies, so cabal2nix cannot automatically add these.
-    #
-    # extraContents :: Map Text [Derivation]
-    extraContents = {
-      brig = [brig-templates];
-      brig-integration = [brig-templates pkgs.mls-test-cli];
-      galley-integration= [pkgs.mls-test-cli];
-    };
+  # Some images require extra things which is not possible to specify using
+  # cabal file dependencies, so cabal2nix cannot automatically add these.
+  #
+  # extraContents :: Map Text [Derivation]
+  extraContents = {
+    brig = [ brig-templates ];
+    brig-integration = [ brig-templates pkgs.mls-test-cli ];
+    galley-integration = [ pkgs.mls-test-cli ];
+  };
 
-    # useful to poke around a container during a 'kubectl exec'
-    debugUtils = with pkgs; [
-      bashInteractive
-      gnugrep
-      coreutils
-      dig
-      curl
-      less
-      gnutar
-      gzip
-      openssl
-      which
-    ];
+  # useful to poke around a container during a 'kubectl exec'
+  debugUtils = with pkgs; [
+    bashInteractive
+    gnugrep
+    coreutils
+    dig
+    curl
+    less
+    gnutar
+    gzip
+    openssl
+    which
+  ];
 
-    images = localMods@{enableOptimization, enableDocs, enableTests}:
-      attrsets.mapAttrs (execName: drv:
+  images = localMods@{ enableOptimization, enableDocs, enableTests }:
+    attrsets.mapAttrs
+      (execName: drv:
         pkgs.dockerTools.streamLayeredImage {
           name = "quay.io/wire/${execName}";
           maxLayers = 10;
@@ -223,108 +239,112 @@ let lib = pkgs.lib;
           # Any mkdir running in this step won't actually make it to the image,
           # hence we use the tmpDir derivation in the contents
           fakeRootCommands = ''
-                           chmod 1777 tmp
-                           chmod 1777 var/tmp
-                           '';
+            chmod 1777 tmp
+            chmod 1777 var/tmp
+          '';
           config = {
-            Entrypoint = ["${pkgs.dumb-init}/bin/dumb-init" "--" "${drv}/bin/${execName}"];
-            Env = ["SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"];
+            Entrypoint = [ "${pkgs.dumb-init}/bin/dumb-init" "--" "${drv}/bin/${execName}" ];
+            Env = [ "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt" ];
           };
         }
-      ) (staticExecs localMods);
+      )
+      (staticExecs localMods);
 
-    localModsEnableAll = {
-      enableOptimization = true;
-      enableDocs = true;
-      enableTests = true;
-    };
-    localModsOnlyTests = {
-      enableOptimization = false;
-      enableDocs = false;
-      enableTests = true;
-    };
-    localModsOnlyDocs = {
-      enableOptimization = false;
-      enableDocs = true;
-      enableTests = false;
-    };
+  localModsEnableAll = {
+    enableOptimization = true;
+    enableDocs = true;
+    enableTests = true;
+  };
+  localModsOnlyTests = {
+    enableOptimization = false;
+    enableDocs = false;
+    enableTests = true;
+  };
+  localModsOnlyDocs = {
+    enableOptimization = false;
+    enableDocs = true;
+    enableTests = false;
+  };
 
-    imagesList = pkgs.writeTextFile {
-      name = "imagesList";
-      text = "${lib.concatStringsSep "\n" (builtins.attrNames (images localModsEnableAll))}";
-    };
-    wireServerPackages = (builtins.attrNames (localPackages localModsEnableAll {} {}));
+  imagesList = pkgs.writeTextFile {
+    name = "imagesList";
+    text = "${lib.concatStringsSep "\n" (builtins.attrNames (images localModsEnableAll))}";
+  };
+  wireServerPackages = (builtins.attrNames (localPackages localModsEnableAll { } { }));
 
-    hoogle = (hPkgs localModsOnlyDocs).hoogleWithPackages (p: builtins.map (e: p.${e}) wireServerPackages);
+  hoogle = (hPkgs localModsOnlyDocs).hoogleWithPackages (p: builtins.map (e: p.${e}) wireServerPackages);
 
-    # More about dockerTools.streamLayeredImage:
-    # https://nixos.org/manual/nixpkgs/unstable/#ssec-pkgs-dockerTools-streamLayeredImage
-    hoogleImage = pkgs.dockerTools.streamLayeredImage {
-      name = "quay.io/wire/wire-server-hoogle";
-      maxLayers = 50;
-      contents = [
-        pkgs.cacert
-        pkgs.coreutils
-        pkgs.bashInteractive
-        pkgs.dumb-init
-        hoogle
-      ];
-      config = {
-        Entrypoint = ["${pkgs.dumb-init}/bin/dumb-init" "--" "${hoogle}/bin/hoogle" "server" "--local" "--host=*"];
-        Env = ["SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"];
-      };
+  # More about dockerTools.streamLayeredImage:
+  # https://nixos.org/manual/nixpkgs/unstable/#ssec-pkgs-dockerTools-streamLayeredImage
+  hoogleImage = pkgs.dockerTools.streamLayeredImage {
+    name = "quay.io/wire/wire-server-hoogle";
+    maxLayers = 50;
+    contents = [
+      pkgs.cacert
+      pkgs.coreutils
+      pkgs.bashInteractive
+      pkgs.dumb-init
+      hoogle
+    ];
+    config = {
+      Entrypoint = [ "${pkgs.dumb-init}/bin/dumb-init" "--" "${hoogle}/bin/hoogle" "server" "--local" "--host=*" ];
+      Env = [ "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt" ];
     };
+  };
 
-    # Tools common between CI and developers
-    commonTools =  [
-      pkgs.cabal2nix
-      pkgs.gnumake
-      pkgs.gnused
-      pkgs.helm
-      pkgs.helmfile
-      pkgs.hlint
-      pkgs.jq
-      pkgs.kubectl
-      pkgs.ormolu
-      pkgs.shellcheck
-      (hlib.justStaticExecutables pkgs.haskellPackages.cabal-fmt)
-    ] ++ pkgs.lib.optionals pkgs.stdenv.isLinux [
-      pkgs.skopeo
-    ];
+  # Tools common between CI and developers
+  commonTools = [
+    pkgs.cabal2nix
+    pkgs.gnumake
+    pkgs.gnused
+    pkgs.helm
+    pkgs.helmfile
+    pkgs.hlint
+    pkgs.jq
+    pkgs.kubectl
+    pkgs.nixpkgs-fmt
+    pkgs.ormolu
+    pkgs.shellcheck
+    pkgs.treefmt
+    (hlib.justStaticExecutables pkgs.haskellPackages.cabal-fmt)
+  ] ++ pkgs.lib.optionals pkgs.stdenv.isLinux [
+    pkgs.skopeo
+  ];
 
-    # Building an image which can do nix builds is hard. This is programmed
-    # nicely in docker.nix at the root of https://github.com/nixos/nix. We get
-    # this file using "${pkgs.nix.src}/docker.nix" so we don't have to also pin
-    # the nix repository along with the nixpkgs repository.
-    ciImage = import "${pkgs.nix.src}/docker.nix" {
-      inherit pkgs;
-      name = "quay.io/wire/wire-server-ci";
-      maxLayers = 2;
-      # We don't need to push the "latest" tag, every step in CI should depend
-      # deterministically on a specific image.
-      tag = null;
-      bundleNixpkgs = false;
-      extraPkgs = commonTools ++ [pkgs.cachix];
-      nixConf = {
-        experimental-features = "nix-command";
-      };
+  # Building an image which can do nix builds is hard. This is programmed
+  # nicely in docker.nix at the root of https://github.com/nixos/nix. We get
+  # this file using "${pkgs.nix.src}/docker.nix" so we don't have to also pin
+  # the nix repository along with the nixpkgs repository.
+  ciImage = import "${pkgs.nix.src}/docker.nix" {
+    inherit pkgs;
+    name = "quay.io/wire/wire-server-ci";
+    maxLayers = 2;
+    # We don't need to push the "latest" tag, every step in CI should depend
+    # deterministically on a specific image.
+    tag = null;
+    bundleNixpkgs = false;
+    extraPkgs = commonTools ++ [ pkgs.cachix ];
+    nixConf = {
+      experimental-features = "nix-command";
     };
+  };
 
-    shell = (hPkgs localModsOnlyTests).shellFor {
-      packages = p: builtins.map (e: p.${e}) wireServerPackages;
-    };
-    ghcWithPackages = shell.nativeBuildInputs ++ shell.buildInputs;
+  shell = (hPkgs localModsOnlyTests).shellFor {
+    packages = p: builtins.map (e: p.${e}) wireServerPackages;
+  };
+  ghcWithPackages = shell.nativeBuildInputs ++ shell.buildInputs;
 
-    profileEnv = pkgs.writeTextFile {
-      name = "profile-env";
-      destination = "/.profile";
-      # This gets sourced by direnv. Set NIX_PATH, so `nix-shell` uses the same nixpkgs as here.
-      text = ''
-        export NIX_PATH=nixpkgs=${toString pkgs.path}
-        export LOCALE_ARCHIVE=${pkgs.glibcLocales}/lib/locale/locale-archive
-        '';
-    };
-in {
+  profileEnv = pkgs.writeTextFile {
+    name = "profile-env";
+    destination = "/.profile";
+    # This gets sourced by direnv. Set NIX_PATH, so `nix-shell` uses the same nixpkgs as here.
+    text = ''
+      export NIX_PATH=nixpkgs=${toString pkgs.path}
+      export LOCALE_ARCHIVE=${pkgs.glibcLocales}/lib/locale/locale-archive
+    '';
+  };
+in
+{
   inherit ciImage hoogleImage;
 
   images = images localModsEnableAll;
diff --git a/services/brig/default.nix b/services/brig/default.nix
index c8ea67ba1d..cb9aa3523d 100644
--- a/services/brig/default.nix
+++ b/services/brig/default.nix
@@ -2,39 +2,157 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, amazonka, amazonka-dynamodb, amazonka-ses
-, amazonka-sqs, async, attoparsec, auto-update, base, base-prelude
-, base16-bytestring, base64-bytestring, bilge, binary, bloodhound
-, brig-types, bytestring, bytestring-conversion, cargohold-types
-, case-insensitive, cassandra-util, comonad, conduit, containers
-, cookie, cryptobox-haskell, currency-codes, data-default
-, data-timeout, dns, dns-util, either, email-validate
-, enclosed-exceptions, errors, exceptions, extended, extra
-, federator, file-embed, file-embed-lzma, filepath, fsnotify
-, galley-types, geoip2, gitignoreSource, gundeck-types, hashable
-, HaskellNet, HaskellNet-SSL, hscim, HsOpenSSL
-, HsOpenSSL-x509-system, html-entities, http-api-data, http-client
-, http-client-openssl, http-client-tls, http-media
-, http-reverse-proxy, http-types, imports
-, insert-ordered-containers, iproute, iso639, jwt-tools, lens
-, lens-aeson, lib, metrics-core, metrics-wai, mime, mime-mail
-, mmorph, MonadRandom, mtl, multihash, mwc-random, network
-, network-conduit-tls, optparse-applicative, pem, polysemy
-, polysemy-plugin, polysemy-wire-zoo, process, proto-lens
-, QuickCheck, random, random-shuffle, raw-strings-qq, resource-pool
-, resourcet, retry, ropes, safe, safe-exceptions, saml2-web-sso
-, schema-profunctor, scientific, scrypt, servant, servant-client
-, servant-client-core, servant-server, servant-swagger
-, servant-swagger-ui, sodium-crypto-sign, spar, split, ssl-util
-, statistics, stomp-queue, string-conversions, swagger, swagger2
-, tagged, tasty, tasty-cannon, tasty-hunit, tasty-quickcheck
-, template, template-haskell, temporary, text, text-icu-translit
-, time, tinylog, transformers, types-common, types-common-aws
-, types-common-journal, unliftio, unordered-containers
-, uri-bytestring, uuid, vector, wai, wai-extra
-, wai-middleware-gunzip, wai-predicates, wai-route, wai-routing
-, wai-utilities, warp, warp-tls, wire-api, wire-api-federation
-, yaml, zauth
+{ mkDerivation
+, aeson
+, amazonka
+, amazonka-dynamodb
+, amazonka-ses
+, amazonka-sqs
+, async
+, attoparsec
+, auto-update
+, base
+, base-prelude
+, base16-bytestring
+, base64-bytestring
+, bilge
+, binary
+, bloodhound
+, brig-types
+, bytestring
+, bytestring-conversion
+, cargohold-types
+, case-insensitive
+, cassandra-util
+, comonad
+, conduit
+, containers
+, cookie
+, cryptobox-haskell
+, currency-codes
+, data-default
+, data-timeout
+, dns
+, dns-util
+, either
+, email-validate
+, enclosed-exceptions
+, errors
+, exceptions
+, extended
+, extra
+, federator
+, file-embed
+, file-embed-lzma
+, filepath
+, fsnotify
+, galley-types
+, geoip2
+, gitignoreSource
+, gundeck-types
+, hashable
+, HaskellNet
+, HaskellNet-SSL
+, hscim
+, HsOpenSSL
+, HsOpenSSL-x509-system
+, html-entities
+, http-api-data
+, http-client
+, http-client-openssl
+, http-client-tls
+, http-media
+, http-reverse-proxy
+, http-types
+, imports
+, insert-ordered-containers
+, iproute
+, iso639
+, jwt-tools
+, lens
+, lens-aeson
+, lib
+, metrics-core
+, metrics-wai
+, mime
+, mime-mail
+, mmorph
+, MonadRandom
+, mtl
+, multihash
+, mwc-random
+, network
+, network-conduit-tls
+, optparse-applicative
+, pem
+, polysemy
+, polysemy-plugin
+, polysemy-wire-zoo
+, process
+, proto-lens
+, QuickCheck
+, random
+, random-shuffle
+, raw-strings-qq
+, resource-pool
+, resourcet
+, retry
+, ropes
+, safe
+, safe-exceptions
+, saml2-web-sso
+, schema-profunctor
+, scientific
+, scrypt
+, servant
+, servant-client
+, servant-client-core
+, servant-server
+, servant-swagger
+, servant-swagger-ui
+, sodium-crypto-sign
+, spar
+, split
+, ssl-util
+, statistics
+, stomp-queue
+, string-conversions
+, swagger
+, swagger2
+, tagged
+, tasty
+, tasty-cannon
+, tasty-hunit
+, tasty-quickcheck
+, template
+, template-haskell
+, temporary
+, text
+, text-icu-translit
+, time
+, tinylog
+, transformers
+, types-common
+, types-common-aws
+, types-common-journal
+, unliftio
+, unordered-containers
+, uri-bytestring
+, uuid
+, vector
+, wai
+, wai-extra
+, wai-middleware-gunzip
+, wai-predicates
+, wai-route
+, wai-routing
+, wai-utilities
+, warp
+, warp-tls
+, wire-api
+, wire-api-federation
+, yaml
+, zauth
 }:
 mkDerivation {
   pname = "brig";
@@ -43,56 +161,256 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson amazonka amazonka-dynamodb amazonka-ses amazonka-sqs async
-    attoparsec auto-update base base-prelude base16-bytestring
-    base64-bytestring bilge bloodhound brig-types bytestring
-    bytestring-conversion cassandra-util comonad conduit containers
-    cookie cryptobox-haskell currency-codes data-default data-timeout
-    dns dns-util either enclosed-exceptions errors exceptions extended
-    extra file-embed file-embed-lzma filepath fsnotify galley-types
-    geoip2 gundeck-types hashable HaskellNet HaskellNet-SSL HsOpenSSL
-    HsOpenSSL-x509-system html-entities http-client http-client-openssl
-    http-media http-types imports insert-ordered-containers iproute
-    iso639 jwt-tools lens lens-aeson metrics-core metrics-wai mime
-    mime-mail mmorph MonadRandom mtl multihash mwc-random network
-    network-conduit-tls optparse-applicative pem polysemy
-    polysemy-plugin polysemy-wire-zoo proto-lens random-shuffle
-    resource-pool resourcet retry ropes safe safe-exceptions
-    saml2-web-sso schema-profunctor scientific scrypt servant
-    servant-client servant-client-core servant-server servant-swagger
-    servant-swagger-ui sodium-crypto-sign split ssl-util statistics
-    stomp-queue string-conversions swagger swagger2 tagged template
-    template-haskell text text-icu-translit time tinylog transformers
-    types-common types-common-aws types-common-journal unliftio
-    unordered-containers uri-bytestring uuid vector wai wai-extra
-    wai-middleware-gunzip wai-predicates wai-routing wai-utilities warp
-    wire-api wire-api-federation yaml zauth
+    aeson
+    amazonka
+    amazonka-dynamodb
+    amazonka-ses
+    amazonka-sqs
+    async
+    attoparsec
+    auto-update
+    base
+    base-prelude
+    base16-bytestring
+    base64-bytestring
+    bilge
+    bloodhound
+    brig-types
+    bytestring
+    bytestring-conversion
+    cassandra-util
+    comonad
+    conduit
+    containers
+    cookie
+    cryptobox-haskell
+    currency-codes
+    data-default
+    data-timeout
+    dns
+    dns-util
+    either
+    enclosed-exceptions
+    errors
+    exceptions
+    extended
+    extra
+    file-embed
+    file-embed-lzma
+    filepath
+    fsnotify
+    galley-types
+    geoip2
+    gundeck-types
+    hashable
+    HaskellNet
+    HaskellNet-SSL
+    HsOpenSSL
+    HsOpenSSL-x509-system
+    html-entities
+    http-client
+    http-client-openssl
+    http-media
+    http-types
+    imports
+    insert-ordered-containers
+    iproute
+    iso639
+    jwt-tools
+    lens
+    lens-aeson
+    metrics-core
+    metrics-wai
+    mime
+    mime-mail
+    mmorph
+    MonadRandom
+    mtl
+    multihash
+    mwc-random
+    network
+    network-conduit-tls
+    optparse-applicative
+    pem
+    polysemy
+    polysemy-plugin
+    polysemy-wire-zoo
+    proto-lens
+    random-shuffle
+    resource-pool
+    resourcet
+    retry
+    ropes
+    safe
+    safe-exceptions
+    saml2-web-sso
+    schema-profunctor
+    scientific
+    scrypt
+    servant
+    servant-client
+    servant-client-core
+    servant-server
+    servant-swagger
+    servant-swagger-ui
+    sodium-crypto-sign
+    split
+    ssl-util
+    statistics
+    stomp-queue
+    string-conversions
+    swagger
+    swagger2
+    tagged
+    template
+    template-haskell
+    text
+    text-icu-translit
+    time
+    tinylog
+    transformers
+    types-common
+    types-common-aws
+    types-common-journal
+    unliftio
+    unordered-containers
+    uri-bytestring
+    uuid
+    vector
+    wai
+    wai-extra
+    wai-middleware-gunzip
+    wai-predicates
+    wai-routing
+    wai-utilities
+    warp
+    wire-api
+    wire-api-federation
+    yaml
+    zauth
   ];
   executableHaskellDepends = [
-    aeson async attoparsec base base16-bytestring base64-bytestring
-    bilge bloodhound brig-types bytestring bytestring-conversion
-    cargohold-types case-insensitive cassandra-util containers cookie
-    data-default data-timeout email-validate exceptions extended extra
-    federator filepath galley-types gundeck-types hscim HsOpenSSL
-    http-api-data http-client http-client-tls http-media
-    http-reverse-proxy http-types imports lens lens-aeson metrics-wai
-    mime MonadRandom mtl network optparse-applicative pem polysemy
-    polysemy-wire-zoo process proto-lens QuickCheck random
-    random-shuffle raw-strings-qq retry safe saml2-web-sso servant
-    servant-client servant-client-core spar string-conversions tasty
-    tasty-cannon tasty-hunit temporary text time tinylog transformers
-    types-common types-common-aws types-common-journal unliftio
-    unordered-containers uri-bytestring uuid vector wai wai-extra
-    wai-route wai-utilities warp warp-tls wire-api wire-api-federation
-    yaml zauth
+    aeson
+    async
+    attoparsec
+    base
+    base16-bytestring
+    base64-bytestring
+    bilge
+    bloodhound
+    brig-types
+    bytestring
+    bytestring-conversion
+    cargohold-types
+    case-insensitive
+    cassandra-util
+    containers
+    cookie
+    data-default
+    data-timeout
+    email-validate
+    exceptions
+    extended
+    extra
+    federator
+    filepath
+    galley-types
+    gundeck-types
+    hscim
+    HsOpenSSL
+    http-api-data
+    http-client
+    http-client-tls
+    http-media
+    http-reverse-proxy
+    http-types
+    imports
+    lens
+    lens-aeson
+    metrics-wai
+    mime
+    MonadRandom
+    mtl
+    network
+    optparse-applicative
+    pem
+    polysemy
+    polysemy-wire-zoo
+    process
+    proto-lens
+    QuickCheck
+    random
+    random-shuffle
+    raw-strings-qq
+    retry
+    safe
+    saml2-web-sso
+    servant
+    servant-client
+    servant-client-core
+    spar
+    string-conversions
+    tasty
+    tasty-cannon
+    tasty-hunit
+    temporary
+    text
+    time
+    tinylog
+    transformers
+    types-common
+    types-common-aws
+    types-common-journal
+    unliftio
+    unordered-containers
+    uri-bytestring
+    uuid
+    vector
+    wai
+    wai-extra
+    wai-route
+    wai-utilities
+    warp
+    warp-tls
+    wire-api
+    wire-api-federation
+    yaml
+    zauth
   ];
   testHaskellDepends = [
-    aeson base binary bloodhound brig-types bytestring containers
-    data-timeout dns dns-util exceptions HsOpenSSL http-types imports
-    lens polysemy polysemy-wire-zoo QuickCheck retry
-    servant-client-core string-conversions tasty tasty-hunit
-    tasty-quickcheck time tinylog types-common unliftio uri-bytestring
-    uuid wai-utilities wire-api wire-api-federation
+    aeson
+    base
+    binary
+    bloodhound
+    brig-types
+    bytestring
+    containers
+    data-timeout
+    dns
+    dns-util
+    exceptions
+    HsOpenSSL
+    http-types
+    imports
+    lens
+    polysemy
+    polysemy-wire-zoo
+    QuickCheck
+    retry
+    servant-client-core
+    string-conversions
+    tasty
+    tasty-hunit
+    tasty-quickcheck
+    time
+    tinylog
+    types-common
+    unliftio
+    uri-bytestring
+    uuid
+    wai-utilities
+    wire-api
+    wire-api-federation
   ];
   description = "User Service";
   license = lib.licenses.agpl3Only;
diff --git a/services/cannon/default.nix b/services/cannon/default.nix
index ef0bff58d7..ef66129761 100644
--- a/services/cannon/default.nix
+++ b/services/cannon/default.nix
@@ -2,16 +2,58 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, api-field-json-th, async, base, bilge
-, bytestring, bytestring-conversion, conduit, criterion
-, data-default, data-timeout, exceptions, extended, extra
-, gitignoreSource, gundeck-types, hashable, http-types, imports
-, lens, lens-family-core, lib, metrics-wai, mwc-random, QuickCheck
-, random, retry, safe-exceptions, servant, servant-conduit
-, servant-server, strict, swagger, tasty, tasty-hunit
-, tasty-quickcheck, text, tinylog, types-common, unix, unliftio
-, uuid, vector, wai, wai-extra, wai-predicates, wai-utilities
-, wai-websockets, warp, websockets, wire-api
+{ mkDerivation
+, aeson
+, api-field-json-th
+, async
+, base
+, bilge
+, bytestring
+, bytestring-conversion
+, conduit
+, criterion
+, data-default
+, data-timeout
+, exceptions
+, extended
+, extra
+, gitignoreSource
+, gundeck-types
+, hashable
+, http-types
+, imports
+, lens
+, lens-family-core
+, lib
+, metrics-wai
+, mwc-random
+, QuickCheck
+, random
+, retry
+, safe-exceptions
+, servant
+, servant-conduit
+, servant-server
+, strict
+, swagger
+, tasty
+, tasty-hunit
+, tasty-quickcheck
+, text
+, tinylog
+, types-common
+, unix
+, unliftio
+, uuid
+, vector
+, wai
+, wai-extra
+, wai-predicates
+, wai-utilities
+, wai-websockets
+, warp
+, websockets
+, wire-api
 }:
 mkDerivation {
   pname = "cannon";
@@ -20,24 +62,85 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson api-field-json-th async base bilge bytestring
-    bytestring-conversion conduit data-default data-timeout exceptions
-    extended extra gundeck-types hashable http-types imports lens
-    lens-family-core metrics-wai mwc-random retry safe-exceptions
-    servant servant-conduit servant-server strict swagger text tinylog
-    types-common unix unliftio uuid vector wai wai-extra wai-predicates
-    wai-utilities wai-websockets warp websockets wire-api
+    aeson
+    api-field-json-th
+    async
+    base
+    bilge
+    bytestring
+    bytestring-conversion
+    conduit
+    data-default
+    data-timeout
+    exceptions
+    extended
+    extra
+    gundeck-types
+    hashable
+    http-types
+    imports
+    lens
+    lens-family-core
+    metrics-wai
+    mwc-random
+    retry
+    safe-exceptions
+    servant
+    servant-conduit
+    servant-server
+    strict
+    swagger
+    text
+    tinylog
+    types-common
+    unix
+    unliftio
+    uuid
+    vector
+    wai
+    wai-extra
+    wai-predicates
+    wai-utilities
+    wai-websockets
+    warp
+    websockets
+    wire-api
   ];
   executableHaskellDepends = [ base extended imports types-common ];
   testHaskellDepends = [
-    async base bytestring criterion extended imports metrics-wai
-    QuickCheck random tasty tasty-hunit tasty-quickcheck types-common
-    uuid wai-utilities wire-api
+    async
+    base
+    bytestring
+    criterion
+    extended
+    imports
+    metrics-wai
+    QuickCheck
+    random
+    tasty
+    tasty-hunit
+    tasty-quickcheck
+    types-common
+    uuid
+    wai-utilities
+    wire-api
   ];
   benchmarkHaskellDepends = [
-    async base bytestring criterion extended imports metrics-wai
-    QuickCheck random tasty tasty-hunit tasty-quickcheck types-common
-    uuid wai-utilities
+    async
+    base
+    bytestring
+    criterion
+    extended
+    imports
+    metrics-wai
+    QuickCheck
+    random
+    tasty
+    tasty-hunit
+    tasty-quickcheck
+    types-common
+    uuid
+    wai-utilities
   ];
   description = "Push Notification API";
   license = lib.licenses.agpl3Only;
diff --git a/services/cargohold/default.nix b/services/cargohold/default.nix
index 23fc8e986b..082cf037e3 100644
--- a/services/cargohold/default.nix
+++ b/services/cargohold/default.nix
@@ -2,20 +2,74 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, amazonka, amazonka-core, amazonka-s3
-, attoparsec, auto-update, base, base64-bytestring, bilge
-, bytestring, bytestring-conversion, cargohold-types
-, case-insensitive, conduit, conduit-extra, containers, cryptonite
-, data-default, errors, exceptions, extended, federator
-, gitignoreSource, HsOpenSSL, HsOpenSSL-x509-system, http-api-data
-, http-client, http-client-openssl, http-client-tls, http-media
-, http-types, imports, kan-extensions, lens, lib, metrics-core
-, metrics-wai, mime, mmorph, mtl, optparse-applicative, resourcet
-, retry, safe, servant, servant-client, servant-client-core
-, servant-server, swagger, tagged, tasty, tasty-hunit, text, time
-, tinylog, types-common, types-common-aws, unliftio
-, unordered-containers, uri-bytestring, uuid, wai, wai-extra
-, wai-utilities, wire-api, wire-api-federation, yaml
+{ mkDerivation
+, aeson
+, amazonka
+, amazonka-core
+, amazonka-s3
+, attoparsec
+, auto-update
+, base
+, base64-bytestring
+, bilge
+, bytestring
+, bytestring-conversion
+, cargohold-types
+, case-insensitive
+, conduit
+, conduit-extra
+, containers
+, cryptonite
+, data-default
+, errors
+, exceptions
+, extended
+, federator
+, gitignoreSource
+, HsOpenSSL
+, HsOpenSSL-x509-system
+, http-api-data
+, http-client
+, http-client-openssl
+, http-client-tls
+, http-media
+, http-types
+, imports
+, kan-extensions
+, lens
+, lib
+, metrics-core
+, metrics-wai
+, mime
+, mmorph
+, mtl
+, optparse-applicative
+, resourcet
+, retry
+, safe
+, servant
+, servant-client
+, servant-client-core
+, servant-server
+, swagger
+, tagged
+, tasty
+, tasty-hunit
+, text
+, time
+, tinylog
+, types-common
+, types-common-aws
+, unliftio
+, unordered-containers
+, uri-bytestring
+, uuid
+, wai
+, wai-extra
+, wai-utilities
+, wire-api
+, wire-api-federation
+, yaml
 }:
 mkDerivation {
   pname = "cargohold";
@@ -24,25 +78,105 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson amazonka amazonka-core amazonka-s3 attoparsec auto-update
-    base base64-bytestring bilge bytestring bytestring-conversion
-    cargohold-types case-insensitive conduit conduit-extra containers
-    cryptonite data-default errors exceptions extended HsOpenSSL
-    HsOpenSSL-x509-system http-client http-client-openssl http-types
-    imports kan-extensions lens metrics-core metrics-wai mime
-    optparse-applicative resourcet retry safe servant servant-server
-    swagger text time tinylog types-common types-common-aws unliftio
-    unordered-containers uri-bytestring uuid wai wai-extra
-    wai-utilities wire-api wire-api-federation yaml
+    aeson
+    amazonka
+    amazonka-core
+    amazonka-s3
+    attoparsec
+    auto-update
+    base
+    base64-bytestring
+    bilge
+    bytestring
+    bytestring-conversion
+    cargohold-types
+    case-insensitive
+    conduit
+    conduit-extra
+    containers
+    cryptonite
+    data-default
+    errors
+    exceptions
+    extended
+    HsOpenSSL
+    HsOpenSSL-x509-system
+    http-client
+    http-client-openssl
+    http-types
+    imports
+    kan-extensions
+    lens
+    metrics-core
+    metrics-wai
+    mime
+    optparse-applicative
+    resourcet
+    retry
+    safe
+    servant
+    servant-server
+    swagger
+    text
+    time
+    tinylog
+    types-common
+    types-common-aws
+    unliftio
+    unordered-containers
+    uri-bytestring
+    uuid
+    wai
+    wai-extra
+    wai-utilities
+    wire-api
+    wire-api-federation
+    yaml
   ];
   executableHaskellDepends = [
-    aeson base base64-bytestring bilge bytestring bytestring-conversion
-    cargohold-types conduit containers cryptonite data-default errors
-    exceptions extended federator HsOpenSSL http-api-data http-client
-    http-client-tls http-media http-types imports kan-extensions lens
-    mime mmorph mtl optparse-applicative safe servant-client
-    servant-client-core tagged tasty tasty-hunit text time types-common
-    uuid wai wai-utilities wire-api wire-api-federation yaml
+    aeson
+    base
+    base64-bytestring
+    bilge
+    bytestring
+    bytestring-conversion
+    cargohold-types
+    conduit
+    containers
+    cryptonite
+    data-default
+    errors
+    exceptions
+    extended
+    federator
+    HsOpenSSL
+    http-api-data
+    http-client
+    http-client-tls
+    http-media
+    http-types
+    imports
+    kan-extensions
+    lens
+    mime
+    mmorph
+    mtl
+    optparse-applicative
+    safe
+    servant-client
+    servant-client-core
+    tagged
+    tasty
+    tasty-hunit
+    text
+    time
+    types-common
+    uuid
+    wai
+    wai-utilities
+    wire-api
+    wire-api-federation
+    yaml
   ];
   description = "Asset Storage API";
   license = lib.licenses.agpl3Only;
diff --git a/services/federator/default.nix b/services/federator/default.nix
index 40d51f9e4e..2704a157dc 100644
--- a/services/federator/default.nix
+++ b/services/federator/default.nix
@@ -2,21 +2,83 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, async, base, bilge, binary, bytestring
-, bytestring-conversion, connection, constraints, containers
-, cryptonite, data-default, directory, dns, dns-util, either
-, errors, exceptions, extended, filepath, gitignoreSource, hinotify
-, hspec, http-client, http-client-openssl, http-client-tls
-, http-media, http-types, http2, imports, interpolate
-, kan-extensions, lens, lib, metrics-core, metrics-wai, mtl
-, network, network-uri, optparse-applicative, pem, polysemy
-, polysemy-wire-zoo, QuickCheck, random, retry, servant
-, servant-client, servant-client-core, streaming-commons
-, string-conversions, tasty, tasty-hunit, tasty-quickcheck
-, temporary, text, time-manager, tinylog, tls, transformers
-, types-common, unix, uri-bytestring, uuid, wai, wai-extra
-, wai-utilities, warp, warp-tls, wire-api, wire-api-federation
-, x509, x509-store, x509-system, x509-validation, yaml
+{ mkDerivation
+, aeson
+, async
+, base
+, bilge
+, binary
+, bytestring
+, bytestring-conversion
+, connection
+, constraints
+, containers
+, cryptonite
+, data-default
+, directory
+, dns
+, dns-util
+, either
+, errors
+, exceptions
+, extended
+, filepath
+, gitignoreSource
+, hinotify
+, hspec
+, http-client
+, http-client-openssl
+, http-client-tls
+, http-media
+, http-types
+, http2
+, imports
+, interpolate
+, kan-extensions
+, lens
+, lib
+, metrics-core
+, metrics-wai
+, mtl
+, network
+, network-uri
+, optparse-applicative
+, pem
+, polysemy
+, polysemy-wire-zoo
+, QuickCheck
+, random
+, retry
+, servant
+, servant-client
+, servant-client-core
+, streaming-commons
+, string-conversions
+, tasty
+, tasty-hunit
+, tasty-quickcheck
+, temporary
+, text
+, time-manager
+, tinylog
+, tls
+, transformers
+, types-common
+, unix
+, uri-bytestring
+, uuid
+, wai
+, wai-extra
+, wai-utilities
+, warp
+, warp-tls
+, wire-api
+, wire-api-federation
+, x509
+, x509-store
+, x509-system
+, x509-validation
+, yaml
 }:
 mkDerivation {
   pname = "federator";
@@ -25,44 +87,200 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson async base bilge binary bytestring bytestring-conversion
-    constraints containers data-default dns dns-util either exceptions
-    extended filepath hinotify http-client http-client-openssl
-    http-media http-types http2 imports kan-extensions lens
-    metrics-core metrics-wai mtl network network-uri pem polysemy
-    polysemy-wire-zoo retry servant servant-client-core
-    streaming-commons string-conversions text time-manager tinylog tls
-    types-common unix uri-bytestring uuid wai wai-utilities warp
-    warp-tls wire-api wire-api-federation x509 x509-store x509-system
+    aeson
+    async
+    base
+    bilge
+    binary
+    bytestring
+    bytestring-conversion
+    constraints
+    containers
+    data-default
+    dns
+    dns-util
+    either
+    exceptions
+    extended
+    filepath
+    hinotify
+    http-client
+    http-client-openssl
+    http-media
+    http-types
+    http2
+    imports
+    kan-extensions
+    lens
+    metrics-core
+    metrics-wai
+    mtl
+    network
+    network-uri
+    pem
+    polysemy
+    polysemy-wire-zoo
+    retry
+    servant
+    servant-client-core
+    streaming-commons
+    string-conversions
+    text
+    time-manager
+    tinylog
+    tls
+    types-common
+    unix
+    uri-bytestring
+    uuid
+    wai
+    wai-utilities
+    warp
+    warp-tls
+    wire-api
+    wire-api-federation
+    x509
+    x509-store
+    x509-system
     x509-validation
   ];
   executableHaskellDepends = [
-    aeson async base bilge binary bytestring bytestring-conversion
-    connection constraints containers cryptonite data-default dns
-    dns-util either errors exceptions extended filepath hinotify hspec
-    http-client http-client-openssl http-client-tls http-media
-    http-types http2 imports kan-extensions lens metrics-core
-    metrics-wai mtl network network-uri optparse-applicative pem
-    polysemy polysemy-wire-zoo QuickCheck random retry servant
-    servant-client-core streaming-commons string-conversions tasty
-    tasty-hunit text time-manager tinylog tls types-common unix
-    uri-bytestring uuid wai wai-utilities warp warp-tls wire-api
-    wire-api-federation x509 x509-store x509-system x509-validation
+    aeson
+    async
+    base
+    bilge
+    binary
+    bytestring
+    bytestring-conversion
+    connection
+    constraints
+    containers
+    cryptonite
+    data-default
+    dns
+    dns-util
+    either
+    errors
+    exceptions
+    extended
+    filepath
+    hinotify
+    hspec
+    http-client
+    http-client-openssl
+    http-client-tls
+    http-media
+    http-types
+    http2
+    imports
+    kan-extensions
+    lens
+    metrics-core
+    metrics-wai
+    mtl
+    network
+    network-uri
+    optparse-applicative
+    pem
+    polysemy
+    polysemy-wire-zoo
+    QuickCheck
+    random
+    retry
+    servant
+    servant-client-core
+    streaming-commons
+    string-conversions
+    tasty
+    tasty-hunit
+    text
+    time-manager
+    tinylog
+    tls
+    types-common
+    unix
+    uri-bytestring
+    uuid
+    wai
+    wai-utilities
+    warp
+    warp-tls
+    wire-api
+    wire-api-federation
+    x509
+    x509-store
+    x509-system
+    x509-validation
     yaml
   ];
   testHaskellDepends = [
-    aeson async base bilge binary bytestring bytestring-conversion
-    constraints containers data-default directory dns dns-util either
-    exceptions extended filepath hinotify http-client
-    http-client-openssl http-media http-types http2 imports interpolate
-    kan-extensions lens metrics-core metrics-wai mtl network
-    network-uri pem polysemy polysemy-wire-zoo QuickCheck retry servant
-    servant-client servant-client-core streaming-commons
-    string-conversions tasty tasty-hunit tasty-quickcheck temporary
-    text time-manager tinylog tls transformers types-common unix
-    uri-bytestring uuid wai wai-extra wai-utilities warp warp-tls
-    wire-api wire-api-federation x509 x509-store x509-system
-    x509-validation yaml
+    aeson
+    async
+    base
+    bilge
+    binary
+    bytestring
+    bytestring-conversion
+    constraints
+    containers
+    data-default
+    directory
+    dns
+    dns-util
+    either
+    exceptions
+    extended
+    filepath
+    hinotify
+    http-client
+    http-client-openssl
+    http-media
+    http-types
+    http2
+    imports
+    interpolate
+    kan-extensions
+    lens
+    metrics-core
+    metrics-wai
+    mtl
+    network
+    network-uri
+    pem
+    polysemy
+    polysemy-wire-zoo
+    QuickCheck
+    retry
+    servant
+    servant-client
+    servant-client-core
+    streaming-commons
+    string-conversions
+    tasty
+    tasty-hunit
+    tasty-quickcheck
+    temporary
+    text
+    time-manager
+    tinylog
+    tls
+    transformers
+    types-common
+    unix
+    uri-bytestring
+    uuid
+    wai
+    wai-extra
+    wai-utilities
+    warp
+    warp-tls
+    wire-api
+    wire-api-federation
+    x509
+    x509-store
+    x509-system
+    x509-validation
+    yaml
   ];
   description = "Federation Service";
   license = lib.licenses.agpl3Only;
diff --git a/services/galley/default.nix b/services/galley/default.nix
index 6fecc03f56..cf8abcd206 100644
--- a/services/galley/default.nix
+++ b/services/galley/default.nix
@@ -2,32 +2,131 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, aeson-qq, amazonka, amazonka-sqs
-, asn1-encoding, asn1-types, async, base, base64-bytestring, bilge
-, binary, blake2, brig-types, bytestring, bytestring-conversion
-, case-insensitive, cassandra-util, cassava, cereal, comonad
-, conduit, containers, cookie, cryptonite, currency-codes
-, data-default, data-timeout, directory, either
-, enclosed-exceptions, errors, exceptions, extended, extra
-, federator, filepath, galley-types, gitignoreSource, gundeck-types
-, hex, HsOpenSSL, HsOpenSSL-x509-system, hspec, http-client
-, http-client-openssl, http-client-tls, http-media, http-types
-, imports, insert-ordered-containers, kan-extensions, lens
-, lens-aeson, lib, memory, metrics-core, metrics-wai, mtl
-, optparse-applicative, pem, polysemy, polysemy-wire-zoo, process
-, proto-lens, protobuf, QuickCheck, quickcheck-instances, random
-, raw-strings-qq, resourcet, retry, safe, safe-exceptions
-, saml2-web-sso, schema-profunctor, semigroups, servant
-, servant-client, servant-client-core, servant-server
-, servant-swagger, servant-swagger-ui, singletons, sop-core, split
-, ssl-util, stm, string-conversions, swagger, swagger2, tagged
-, tasty, tasty-cannon, tasty-hspec, tasty-hunit, tasty-quickcheck
-, temporary, text, time, tinylog, tls, transformers, types-common
-, types-common-aws, types-common-journal, unix, unliftio
-, unordered-containers, uri-bytestring, uuid, vector, wai
-, wai-extra, wai-middleware-gunzip, wai-predicates, wai-routing
-, wai-utilities, warp, warp-tls, wire-api, wire-api-federation
-, wire-message-proto-lens, x509, yaml
+{ mkDerivation
+, aeson
+, aeson-qq
+, amazonka
+, amazonka-sqs
+, asn1-encoding
+, asn1-types
+, async
+, base
+, base64-bytestring
+, bilge
+, binary
+, blake2
+, brig-types
+, bytestring
+, bytestring-conversion
+, case-insensitive
+, cassandra-util
+, cassava
+, cereal
+, comonad
+, conduit
+, containers
+, cookie
+, cryptonite
+, currency-codes
+, data-default
+, data-timeout
+, directory
+, either
+, enclosed-exceptions
+, errors
+, exceptions
+, extended
+, extra
+, federator
+, filepath
+, galley-types
+, gitignoreSource
+, gundeck-types
+, hex
+, HsOpenSSL
+, HsOpenSSL-x509-system
+, hspec
+, http-client
+, http-client-openssl
+, http-client-tls
+, http-media
+, http-types
+, imports
+, insert-ordered-containers
+, kan-extensions
+, lens
+, lens-aeson
+, lib
+, memory
+, metrics-core
+, metrics-wai
+, mtl
+, optparse-applicative
+, pem
+, polysemy
+, polysemy-wire-zoo
+, process
+, proto-lens
+, protobuf
+, QuickCheck
+, quickcheck-instances
+, random
+, raw-strings-qq
+, resourcet
+, retry
+, safe
+, safe-exceptions
+, saml2-web-sso
+, schema-profunctor
+, semigroups
+, servant
+, servant-client
+, servant-client-core
+, servant-server
+, servant-swagger
+, servant-swagger-ui
+, singletons
+, sop-core
+, split
+, ssl-util
+, stm
+, string-conversions
+, swagger
+, swagger2
+, tagged
+, tasty
+, tasty-cannon
+, tasty-hspec
+, tasty-hunit
+, tasty-quickcheck
+, temporary
+, text
+, time
+, tinylog
+, tls
+, transformers
+, types-common
+, types-common-aws
+, types-common-journal
+, unix
+, unliftio
+, unordered-containers
+, uri-bytestring
+, uuid
+, vector
+, wai
+, wai-extra
+, wai-middleware-gunzip
+, wai-predicates
+, wai-routing
+, wai-utilities
+, warp
+, warp-tls
+, wire-api
+, wire-api-federation
+, wire-message-proto-lens
+, x509
+, yaml
 }:
 mkDerivation {
   pname = "galley";
@@ -36,53 +135,237 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson amazonka amazonka-sqs asn1-encoding asn1-types async base
-    base64-bytestring bilge binary blake2 brig-types bytestring
-    bytestring-conversion case-insensitive cassandra-util cassava
-    cereal comonad containers cryptonite currency-codes data-default
-    data-timeout either enclosed-exceptions errors exceptions extended
-    extra galley-types gundeck-types hex HsOpenSSL
-    HsOpenSSL-x509-system http-client http-client-openssl
-    http-client-tls http-media http-types imports
-    insert-ordered-containers kan-extensions lens memory metrics-core
-    metrics-wai mtl optparse-applicative pem polysemy polysemy-wire-zoo
-    proto-lens protobuf QuickCheck random raw-strings-qq resourcet
-    retry safe safe-exceptions saml2-web-sso schema-profunctor
-    semigroups servant servant-client servant-client-core
-    servant-server servant-swagger servant-swagger-ui singletons
-    sop-core split ssl-util stm string-conversions swagger swagger2
-    tagged text time tinylog tls transformers types-common
-    types-common-aws types-common-journal unliftio unordered-containers
-    uri-bytestring uuid vector wai wai-extra wai-middleware-gunzip
-    wai-predicates wai-routing wai-utilities warp wire-api
-    wire-api-federation x509
+    aeson
+    amazonka
+    amazonka-sqs
+    asn1-encoding
+    asn1-types
+    async
+    base
+    base64-bytestring
+    bilge
+    binary
+    blake2
+    brig-types
+    bytestring
+    bytestring-conversion
+    case-insensitive
+    cassandra-util
+    cassava
+    cereal
+    comonad
+    containers
+    cryptonite
+    currency-codes
+    data-default
+    data-timeout
+    either
+    enclosed-exceptions
+    errors
+    exceptions
+    extended
+    extra
+    galley-types
+    gundeck-types
+    hex
+    HsOpenSSL
+    HsOpenSSL-x509-system
+    http-client
+    http-client-openssl
+    http-client-tls
+    http-media
+    http-types
+    imports
+    insert-ordered-containers
+    kan-extensions
+    lens
+    memory
+    metrics-core
+    metrics-wai
+    mtl
+    optparse-applicative
+    pem
+    polysemy
+    polysemy-wire-zoo
+    proto-lens
+    protobuf
+    QuickCheck
+    random
+    raw-strings-qq
+    resourcet
+    retry
+    safe
+    safe-exceptions
+    saml2-web-sso
+    schema-profunctor
+    semigroups
+    servant
+    servant-client
+    servant-client-core
+    servant-server
+    servant-swagger
+    servant-swagger-ui
+    singletons
+    sop-core
+    split
+    ssl-util
+    stm
+    string-conversions
+    swagger
+    swagger2
+    tagged
+    text
+    time
+    tinylog
+    tls
+    transformers
+    types-common
+    types-common-aws
+    types-common-journal
+    unliftio
+    unordered-containers
+    uri-bytestring
+    uuid
+    vector
+    wai
+    wai-extra
+    wai-middleware-gunzip
+    wai-predicates
+    wai-routing
+    wai-utilities
+    warp
+    wire-api
+    wire-api-federation
+    x509
   ];
   executableHaskellDepends = [
-    aeson aeson-qq amazonka amazonka-sqs async base base64-bytestring
-    bilge binary brig-types bytestring bytestring-conversion
-    case-insensitive cassandra-util cassava cereal comonad conduit
-    containers cookie cryptonite currency-codes data-default
-    data-timeout directory errors exceptions extended extra federator
-    filepath galley-types gundeck-types hex HsOpenSSL
-    HsOpenSSL-x509-system hspec http-client http-client-openssl
-    http-client-tls http-media http-types imports kan-extensions lens
-    lens-aeson memory metrics-wai mtl optparse-applicative pem process
-    proto-lens protobuf QuickCheck quickcheck-instances random
-    raw-strings-qq retry safe saml2-web-sso schema-profunctor servant
-    servant-client servant-client-core servant-server servant-swagger
-    singletons sop-core ssl-util string-conversions tagged tasty
-    tasty-cannon tasty-hunit temporary text time tinylog tls
-    transformers types-common types-common-journal unix unliftio
-    unordered-containers uri-bytestring uuid vector wai wai-extra
-    wai-utilities warp warp-tls wire-api wire-api-federation
-    wire-message-proto-lens yaml
+    aeson
+    aeson-qq
+    amazonka
+    amazonka-sqs
+    async
+    base
+    base64-bytestring
+    bilge
+    binary
+    brig-types
+    bytestring
+    bytestring-conversion
+    case-insensitive
+    cassandra-util
+    cassava
+    cereal
+    comonad
+    conduit
+    containers
+    cookie
+    cryptonite
+    currency-codes
+    data-default
+    data-timeout
+    directory
+    errors
+    exceptions
+    extended
+    extra
+    federator
+    filepath
+    galley-types
+    gundeck-types
+    hex
+    HsOpenSSL
+    HsOpenSSL-x509-system
+    hspec
+    http-client
+    http-client-openssl
+    http-client-tls
+    http-media
+    http-types
+    imports
+    kan-extensions
+    lens
+    lens-aeson
+    memory
+    metrics-wai
+    mtl
+    optparse-applicative
+    pem
+    process
+    proto-lens
+    protobuf
+    QuickCheck
+    quickcheck-instances
+    random
+    raw-strings-qq
+    retry
+    safe
+    saml2-web-sso
+    schema-profunctor
+    servant
+    servant-client
+    servant-client-core
+    servant-server
+    servant-swagger
+    singletons
+    sop-core
+    ssl-util
+    string-conversions
+    tagged
+    tasty
+    tasty-cannon
+    tasty-hunit
+    temporary
+    text
+    time
+    tinylog
+    tls
+    transformers
+    types-common
+    types-common-journal
+    unix
+    unliftio
+    unordered-containers
+    uri-bytestring
+    uuid
+    vector
+    wai
+    wai-extra
+    wai-utilities
+    warp
+    warp-tls
+    wire-api
+    wire-api-federation
+    wire-message-proto-lens
+    yaml
   ];
   testHaskellDepends = [
-    base case-insensitive containers extended extra galley-types
-    http-types imports lens QuickCheck raw-strings-qq safe
-    saml2-web-sso servant-client servant-swagger ssl-util tagged tasty
-    tasty-hspec tasty-hunit tasty-quickcheck transformers types-common
-    wai wai-predicates wire-api wire-api-federation
+    base
+    case-insensitive
+    containers
+    extended
+    extra
+    galley-types
+    http-types
+    imports
+    lens
+    QuickCheck
+    raw-strings-qq
+    safe
+    saml2-web-sso
+    servant-client
+    servant-swagger
+    ssl-util
+    tagged
+    tasty
+    tasty-hspec
+    tasty-hunit
+    tasty-quickcheck
+    transformers
+    types-common
+    wai
+    wai-predicates
+    wire-api
+    wire-api-federation
   ];
   description = "Conversations";
   license = lib.licenses.agpl3Only;
diff --git a/services/galley/schema/default.nix b/services/galley/schema/default.nix
index d8003a87ba..b4d117ecf8 100644
--- a/services/galley/schema/default.nix
+++ b/services/galley/schema/default.nix
@@ -1,5 +1,12 @@
-{ mkDerivation, base, filepath, imports, lib, optparse-applicative
-, shelly, system-filepath, text
+{ mkDerivation
+, base
+, filepath
+, imports
+, lib
+, optparse-applicative
+, shelly
+, system-filepath
+, text
 }:
 mkDerivation {
   pname = "makedeb";
@@ -8,7 +15,12 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    base filepath imports optparse-applicative shelly system-filepath
+    base
+    filepath
+    imports
+    optparse-applicative
+    shelly
+    system-filepath
     text
   ];
   executableHaskellDepends = [ base imports optparse-applicative ];
diff --git a/services/gundeck/default.nix b/services/gundeck/default.nix
index 6b191b5027..3b4c5dc779 100644
--- a/services/gundeck/default.nix
+++ b/services/gundeck/default.nix
@@ -2,24 +2,93 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, aeson-pretty, amazonka, amazonka-sns
-, amazonka-sqs, async, attoparsec, auto-update, base
-, base16-bytestring, bilge, bytestring, bytestring-conversion
-, cassandra-util, containers, criterion, data-default, errors
-, exceptions, extended, extra, gitignoreSource, gundeck-types
-, hedis, HsOpenSSL, http-client, http-client-tls, http-types
-, imports, kan-extensions, lens, lens-aeson, lib, metrics-core
-, metrics-wai, MonadRandom, mtl, multiset, network, network-uri
-, optparse-applicative, psqueues, QuickCheck, quickcheck-instances
-, quickcheck-state-machine, random, raw-strings-qq, resourcet
-, retry, safe, safe-exceptions, scientific, servant, servant-server
-, servant-swagger, servant-swagger-ui, streaming-commons
-, string-conversions, swagger, swagger2, tagged, tasty, tasty-hunit
-, tasty-quickcheck, text, time, tinylog, tls, tree-diff
-, types-common, types-common-aws, unix, unliftio
-, unordered-containers, uuid, wai, wai-extra, wai-middleware-gunzip
-, wai-predicates, wai-routing, wai-utilities, warp, warp-tls
-, websockets, wire-api, yaml
+{ mkDerivation
+, aeson
+, aeson-pretty
+, amazonka
+, amazonka-sns
+, amazonka-sqs
+, async
+, attoparsec
+, auto-update
+, base
+, base16-bytestring
+, bilge
+, bytestring
+, bytestring-conversion
+, cassandra-util
+, containers
+, criterion
+, data-default
+, errors
+, exceptions
+, extended
+, extra
+, gitignoreSource
+, gundeck-types
+, hedis
+, HsOpenSSL
+, http-client
+, http-client-tls
+, http-types
+, imports
+, kan-extensions
+, lens
+, lens-aeson
+, lib
+, metrics-core
+, metrics-wai
+, MonadRandom
+, mtl
+, multiset
+, network
+, network-uri
+, optparse-applicative
+, psqueues
+, QuickCheck
+, quickcheck-instances
+, quickcheck-state-machine
+, random
+, raw-strings-qq
+, resourcet
+, retry
+, safe
+, safe-exceptions
+, scientific
+, servant
+, servant-server
+, servant-swagger
+, servant-swagger-ui
+, streaming-commons
+, string-conversions
+, swagger
+, swagger2
+, tagged
+, tasty
+, tasty-hunit
+, tasty-quickcheck
+, text
+, time
+, tinylog
+, tls
+, tree-diff
+, types-common
+, types-common-aws
+, unix
+, unliftio
+, unordered-containers
+, uuid
+, wai
+, wai-extra
+, wai-middleware-gunzip
+, wai-predicates
+, wai-routing
+, wai-utilities
+, warp
+, warp-tls
+, websockets
+, wire-api
+, yaml
 }:
 mkDerivation {
   pname = "gundeck";
@@ -28,41 +97,169 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson amazonka amazonka-sns amazonka-sqs async attoparsec
-    auto-update base bilge bytestring bytestring-conversion
-    cassandra-util containers data-default errors exceptions extended
-    extra gundeck-types hedis HsOpenSSL http-client http-client-tls
-    http-types imports lens lens-aeson metrics-core metrics-wai mtl
-    network network-uri optparse-applicative psqueues resourcet retry
-    safe-exceptions servant servant-server servant-swagger
-    servant-swagger-ui swagger swagger2 text time tinylog tls
-    types-common types-common-aws unliftio unordered-containers uuid
-    wai wai-extra wai-middleware-gunzip wai-predicates wai-routing
-    wai-utilities wire-api yaml
+    aeson
+    amazonka
+    amazonka-sns
+    amazonka-sqs
+    async
+    attoparsec
+    auto-update
+    base
+    bilge
+    bytestring
+    bytestring-conversion
+    cassandra-util
+    containers
+    data-default
+    errors
+    exceptions
+    extended
+    extra
+    gundeck-types
+    hedis
+    HsOpenSSL
+    http-client
+    http-client-tls
+    http-types
+    imports
+    lens
+    lens-aeson
+    metrics-core
+    metrics-wai
+    mtl
+    network
+    network-uri
+    optparse-applicative
+    psqueues
+    resourcet
+    retry
+    safe-exceptions
+    servant
+    servant-server
+    servant-swagger
+    servant-swagger-ui
+    swagger
+    swagger2
+    text
+    time
+    tinylog
+    tls
+    types-common
+    types-common-aws
+    unliftio
+    unordered-containers
+    uuid
+    wai
+    wai-extra
+    wai-middleware-gunzip
+    wai-predicates
+    wai-routing
+    wai-utilities
+    wire-api
+    yaml
   ];
   executableHaskellDepends = [
-    aeson async base base16-bytestring bilge bytestring
-    bytestring-conversion cassandra-util containers exceptions extended
-    gundeck-types HsOpenSSL http-client http-client-tls imports
-    kan-extensions lens lens-aeson metrics-wai mtl network network-uri
-    optparse-applicative random raw-strings-qq retry safe
-    streaming-commons tagged tasty tasty-hunit text time tinylog
-    types-common unix unordered-containers uuid wai wai-utilities warp
-    warp-tls websockets wire-api yaml
+    aeson
+    async
+    base
+    base16-bytestring
+    bilge
+    bytestring
+    bytestring-conversion
+    cassandra-util
+    containers
+    exceptions
+    extended
+    gundeck-types
+    HsOpenSSL
+    http-client
+    http-client-tls
+    imports
+    kan-extensions
+    lens
+    lens-aeson
+    metrics-wai
+    mtl
+    network
+    network-uri
+    optparse-applicative
+    random
+    raw-strings-qq
+    retry
+    safe
+    streaming-commons
+    tagged
+    tasty
+    tasty-hunit
+    text
+    time
+    tinylog
+    types-common
+    unix
+    unordered-containers
+    uuid
+    wai
+    wai-utilities
+    warp
+    warp-tls
+    websockets
+    wire-api
+    yaml
   ];
   testHaskellDepends = [
-    aeson aeson-pretty amazonka async base bytestring containers
-    exceptions extended gundeck-types HsOpenSSL imports lens
-    metrics-wai MonadRandom mtl multiset network-uri QuickCheck
-    quickcheck-instances quickcheck-state-machine scientific
-    string-conversions tasty tasty-hunit tasty-quickcheck text time
-    tinylog tree-diff types-common unordered-containers uuid
-    wai-utilities wire-api
+    aeson
+    aeson-pretty
+    amazonka
+    async
+    base
+    bytestring
+    containers
+    exceptions
+    extended
+    gundeck-types
+    HsOpenSSL
+    imports
+    lens
+    metrics-wai
+    MonadRandom
+    mtl
+    multiset
+    network-uri
+    QuickCheck
+    quickcheck-instances
+    quickcheck-state-machine
+    scientific
+    string-conversions
+    tasty
+    tasty-hunit
+    tasty-quickcheck
+    text
+    time
+    tinylog
+    tree-diff
+    types-common
+    unordered-containers
+    uuid
+    wai-utilities
+    wire-api
   ];
   benchmarkHaskellDepends = [
-    aeson amazonka base bytestring criterion extended gundeck-types
-    HsOpenSSL imports lens random text time types-common
-    unordered-containers uuid
+    aeson
+    amazonka
+    base
+    bytestring
+    criterion
+    extended
+    gundeck-types
+    HsOpenSSL
+    imports
+    lens
+    random
+    text
+    time
+    types-common
+    unordered-containers
+    uuid
   ];
   description = "Push Notification Hub";
   license = lib.licenses.agpl3Only;
diff --git a/services/proxy/default.nix b/services/proxy/default.nix
index 384a1f55ac..62dc40a368 100644
--- a/services/proxy/default.nix
+++ b/services/proxy/default.nix
@@ -2,12 +2,36 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, base, bilge, bytestring, case-insensitive
-, configurator, data-default, exceptions, extended, gitignoreSource
-, http-client, http-client-tls, http-reverse-proxy, http-types
-, imports, lens, lib, metrics-wai, retry, text, tinylog
-, types-common, unliftio-core, wai, wai-predicates, wai-routing
-, wai-utilities, warp, wire-api
+{ mkDerivation
+, aeson
+, base
+, bilge
+, bytestring
+, case-insensitive
+, configurator
+, data-default
+, exceptions
+, extended
+, gitignoreSource
+, http-client
+, http-client-tls
+, http-reverse-proxy
+, http-types
+, imports
+, lens
+, lib
+, metrics-wai
+, retry
+, text
+, tinylog
+, types-common
+, unliftio-core
+, wai
+, wai-predicates
+, wai-routing
+, wai-utilities
+, warp
+, wire-api
 }:
 mkDerivation {
   pname = "proxy";
@@ -16,11 +40,33 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson base bilge bytestring case-insensitive configurator
-    data-default exceptions extended http-client http-client-tls
-    http-reverse-proxy http-types imports lens metrics-wai retry text
-    tinylog types-common unliftio-core wai wai-predicates wai-routing
-    wai-utilities warp wire-api
+    aeson
+    base
+    bilge
+    bytestring
+    case-insensitive
+    configurator
+    data-default
+    exceptions
+    extended
+    http-client
+    http-client-tls
+    http-reverse-proxy
+    http-types
+    imports
+    lens
+    metrics-wai
+    retry
+    text
+    tinylog
+    types-common
+    unliftio-core
+    wai
+    wai-predicates
+    wai-routing
+    wai-utilities
+    warp
+    wire-api
   ];
   executableHaskellDepends = [ base extended imports types-common ];
   license = lib.licenses.agpl3Only;
diff --git a/services/spar/default.nix b/services/spar/default.nix
index 0ee7dabd9c..02afd551c0 100644
--- a/services/spar/default.nix
+++ b/services/spar/default.nix
@@ -2,23 +2,88 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, aeson-qq, attoparsec, base
-, base64-bytestring, bilge, binary, brig-types, bytestring
-, bytestring-conversion, case-insensitive, cassandra-util, cassava
-, conduit, containers, cookie, cryptonite, data-default
-, email-validate, exceptions, extended, galley-types, ghc-prim
-, gitignoreSource, hscim, HsOpenSSL, hspec, hspec-discover
-, hspec-wai, http-api-data, http-client, http-media, http-types
-, imports, insert-ordered-containers, iso639, lens, lens-aeson, lib
-, memory, metrics-wai, MonadRandom, mtl, network-uri
-, optparse-applicative, polysemy, polysemy-check, polysemy-plugin
-, polysemy-wire-zoo, QuickCheck, random, raw-strings-qq, retry
-, saml2-web-sso, servant, servant-multipart, servant-server
-, servant-swagger, silently, string-conversions, swagger2
-, tasty-hunit, text, text-latin1, time, tinylog, transformers
-, types-common, unordered-containers, uri-bytestring, uuid, vector
-, wai, wai-extra, wai-utilities, warp, wire-api, x509, xml-conduit
-, yaml, zauth
+{ mkDerivation
+, aeson
+, aeson-qq
+, attoparsec
+, base
+, base64-bytestring
+, bilge
+, binary
+, brig-types
+, bytestring
+, bytestring-conversion
+, case-insensitive
+, cassandra-util
+, cassava
+, conduit
+, containers
+, cookie
+, cryptonite
+, data-default
+, email-validate
+, exceptions
+, extended
+, galley-types
+, ghc-prim
+, gitignoreSource
+, hscim
+, HsOpenSSL
+, hspec
+, hspec-discover
+, hspec-wai
+, http-api-data
+, http-client
+, http-media
+, http-types
+, imports
+, insert-ordered-containers
+, iso639
+, lens
+, lens-aeson
+, lib
+, memory
+, metrics-wai
+, MonadRandom
+, mtl
+, network-uri
+, optparse-applicative
+, polysemy
+, polysemy-check
+, polysemy-plugin
+, polysemy-wire-zoo
+, QuickCheck
+, random
+, raw-strings-qq
+, retry
+, saml2-web-sso
+, servant
+, servant-multipart
+, servant-server
+, servant-swagger
+, silently
+, string-conversions
+, swagger2
+, tasty-hunit
+, text
+, text-latin1
+, time
+, tinylog
+, transformers
+, types-common
+, unordered-containers
+, uri-bytestring
+, uuid
+, vector
+, wai
+, wai-extra
+, wai-utilities
+, warp
+, wire-api
+, x509
+, xml-conduit
+, yaml
+, zauth
 }:
 mkDerivation {
   pname = "spar";
@@ -27,51 +92,222 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson aeson-qq attoparsec base base64-bytestring bilge binary
-    brig-types bytestring bytestring-conversion case-insensitive
-    cassandra-util containers cookie cryptonite data-default
-    email-validate exceptions extended galley-types ghc-prim hscim
-    HsOpenSSL hspec http-api-data http-client http-media http-types
-    imports insert-ordered-containers lens memory metrics-wai mtl
-    network-uri optparse-applicative polysemy polysemy-check
-    polysemy-plugin polysemy-wire-zoo QuickCheck raw-strings-qq retry
-    saml2-web-sso servant servant-multipart servant-server
-    servant-swagger string-conversions swagger2 text text-latin1 time
-    tinylog transformers types-common unordered-containers
-    uri-bytestring uuid wai wai-utilities warp wire-api x509
-    xml-conduit yaml
+    aeson
+    aeson-qq
+    attoparsec
+    base
+    base64-bytestring
+    bilge
+    binary
+    brig-types
+    bytestring
+    bytestring-conversion
+    case-insensitive
+    cassandra-util
+    containers
+    cookie
+    cryptonite
+    data-default
+    email-validate
+    exceptions
+    extended
+    galley-types
+    ghc-prim
+    hscim
+    HsOpenSSL
+    hspec
+    http-api-data
+    http-client
+    http-media
+    http-types
+    imports
+    insert-ordered-containers
+    lens
+    memory
+    metrics-wai
+    mtl
+    network-uri
+    optparse-applicative
+    polysemy
+    polysemy-check
+    polysemy-plugin
+    polysemy-wire-zoo
+    QuickCheck
+    raw-strings-qq
+    retry
+    saml2-web-sso
+    servant
+    servant-multipart
+    servant-server
+    servant-swagger
+    string-conversions
+    swagger2
+    text
+    text-latin1
+    time
+    tinylog
+    transformers
+    types-common
+    unordered-containers
+    uri-bytestring
+    uuid
+    wai
+    wai-utilities
+    warp
+    wire-api
+    x509
+    xml-conduit
+    yaml
   ];
   executableHaskellDepends = [
-    aeson aeson-qq attoparsec base base64-bytestring bilge binary
-    brig-types bytestring bytestring-conversion case-insensitive
-    cassandra-util cassava conduit containers cookie cryptonite
-    data-default email-validate exceptions extended galley-types
-    ghc-prim hscim HsOpenSSL hspec hspec-wai http-api-data http-client
-    http-media http-types imports insert-ordered-containers iso639 lens
-    lens-aeson memory metrics-wai MonadRandom mtl network-uri
-    optparse-applicative polysemy polysemy-check polysemy-plugin
-    polysemy-wire-zoo QuickCheck random raw-strings-qq retry
-    saml2-web-sso servant servant-multipart servant-server
-    servant-swagger silently string-conversions swagger2 tasty-hunit
-    text text-latin1 time tinylog transformers types-common
-    unordered-containers uri-bytestring uuid vector wai wai-extra
-    wai-utilities warp wire-api x509 xml-conduit yaml zauth
+    aeson
+    aeson-qq
+    attoparsec
+    base
+    base64-bytestring
+    bilge
+    binary
+    brig-types
+    bytestring
+    bytestring-conversion
+    case-insensitive
+    cassandra-util
+    cassava
+    conduit
+    containers
+    cookie
+    cryptonite
+    data-default
+    email-validate
+    exceptions
+    extended
+    galley-types
+    ghc-prim
+    hscim
+    HsOpenSSL
+    hspec
+    hspec-wai
+    http-api-data
+    http-client
+    http-media
+    http-types
+    imports
+    insert-ordered-containers
+    iso639
+    lens
+    lens-aeson
+    memory
+    metrics-wai
+    MonadRandom
+    mtl
+    network-uri
+    optparse-applicative
+    polysemy
+    polysemy-check
+    polysemy-plugin
+    polysemy-wire-zoo
+    QuickCheck
+    random
+    raw-strings-qq
+    retry
+    saml2-web-sso
+    servant
+    servant-multipart
+    servant-server
+    servant-swagger
+    silently
+    string-conversions
+    swagger2
+    tasty-hunit
+    text
+    text-latin1
+    time
+    tinylog
+    transformers
+    types-common
+    unordered-containers
+    uri-bytestring
+    uuid
+    vector
+    wai
+    wai-extra
+    wai-utilities
+    warp
+    wire-api
+    x509
+    xml-conduit
+    yaml
+    zauth
   ];
   executableToolDepends = [ hspec-discover ];
   testHaskellDepends = [
-    aeson aeson-qq attoparsec base base64-bytestring bilge binary
-    brig-types bytestring bytestring-conversion case-insensitive
-    cassandra-util containers cookie cryptonite data-default
-    email-validate exceptions extended galley-types ghc-prim hscim
-    HsOpenSSL hspec http-api-data http-client http-media http-types
-    imports insert-ordered-containers lens lens-aeson memory
-    metrics-wai mtl network-uri optparse-applicative polysemy
-    polysemy-check polysemy-plugin polysemy-wire-zoo QuickCheck
-    raw-strings-qq retry saml2-web-sso servant servant-multipart
-    servant-server servant-swagger string-conversions swagger2 text
-    text-latin1 time tinylog transformers types-common
-    unordered-containers uri-bytestring uuid wai wai-utilities warp
-    wire-api x509 xml-conduit yaml
+    aeson
+    aeson-qq
+    attoparsec
+    base
+    base64-bytestring
+    bilge
+    binary
+    brig-types
+    bytestring
+    bytestring-conversion
+    case-insensitive
+    cassandra-util
+    containers
+    cookie
+    cryptonite
+    data-default
+    email-validate
+    exceptions
+    extended
+    galley-types
+    ghc-prim
+    hscim
+    HsOpenSSL
+    hspec
+    http-api-data
+    http-client
+    http-media
+    http-types
+    imports
+    insert-ordered-containers
+    lens
+    lens-aeson
+    memory
+    metrics-wai
+    mtl
+    network-uri
+    optparse-applicative
+    polysemy
+    polysemy-check
+    polysemy-plugin
+    polysemy-wire-zoo
+    QuickCheck
+    raw-strings-qq
+    retry
+    saml2-web-sso
+    servant
+    servant-multipart
+    servant-server
+    servant-swagger
+    string-conversions
+    swagger2
+    text
+    text-latin1
+    time
+    tinylog
+    transformers
+    types-common
+    unordered-containers
+    uri-bytestring
+    uuid
+    wai
+    wai-utilities
+    warp
+    wire-api
+    x509
+    xml-conduit
+    yaml
   ];
   testToolDepends = [ hspec-discover ];
   description = "User Service for SSO (Single Sign-On) provisioning and authentication";
diff --git a/services/spar/test-scim-suite/shell.nix b/services/spar/test-scim-suite/shell.nix
index 9a74950e8b..3ebec7b33e 100644
--- a/services/spar/test-scim-suite/shell.nix
+++ b/services/spar/test-scim-suite/shell.nix
@@ -1,5 +1,5 @@
 { pkgs ? (import ../../../nix).pkgs }:
 with pkgs;
 mkShell {
-  buildInputs = [newman jq coreutils curl];
+  buildInputs = [ newman jq coreutils curl ];
 }
diff --git a/tools/api-simulations/default.nix b/tools/api-simulations/default.nix
index f0e6856898..dfbc638256 100644
--- a/tools/api-simulations/default.nix
+++ b/tools/api-simulations/default.nix
@@ -2,11 +2,31 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, api-bot, api-client, base, bytestring
-, bytestring-conversion, cereal, containers, exceptions, extended
-, gitignoreSource, http-client, http-client-tls, imports, lens, lib
-, metrics-core, mime, mwc-random, optparse-applicative, text
-, tinylog, types-common, unliftio, uuid
+{ mkDerivation
+, api-bot
+, api-client
+, base
+, bytestring
+, bytestring-conversion
+, cereal
+, containers
+, exceptions
+, extended
+, gitignoreSource
+, http-client
+, http-client-tls
+, imports
+, lens
+, lib
+, metrics-core
+, mime
+, mwc-random
+, optparse-applicative
+, text
+, tinylog
+, types-common
+, unliftio
+, uuid
 }:
 mkDerivation {
   pname = "api-simulations";
@@ -15,14 +35,41 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    api-bot api-client base bytestring bytestring-conversion cereal
-    containers exceptions imports lens text types-common
+    api-bot
+    api-client
+    base
+    bytestring
+    bytestring-conversion
+    cereal
+    containers
+    exceptions
+    imports
+    lens
+    text
+    types-common
   ];
   executableHaskellDepends = [
-    api-bot api-client base bytestring bytestring-conversion containers
-    exceptions extended http-client http-client-tls imports lens
-    metrics-core mime mwc-random optparse-applicative text tinylog
-    types-common unliftio uuid
+    api-bot
+    api-client
+    base
+    bytestring
+    bytestring-conversion
+    containers
+    exceptions
+    extended
+    http-client
+    http-client-tls
+    imports
+    lens
+    metrics-core
+    mime
+    mwc-random
+    optparse-applicative
+    text
+    tinylog
+    types-common
+    unliftio
+    uuid
   ];
   description = "(Internal) Wire API simulations";
   license = lib.licenses.agpl3Only;
diff --git a/tools/db/assets/default.nix b/tools/db/assets/default.nix
index 56dc211e06..babe61ec77 100644
--- a/tools/db/assets/default.nix
+++ b/tools/db/assets/default.nix
@@ -2,12 +2,36 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, attoparsec, base, brig, brig-types
-, bytestring, bytestring-conversion, cassandra-util, conduit
-, containers, filepath, galley, gitignoreSource, imports, iproute
-, lens, lib, megaparsec, optparse-applicative, process
-, raw-strings-qq, stache, text, time, tinylog, types-common, uuid
-, vector, wire-api
+{ mkDerivation
+, aeson
+, attoparsec
+, base
+, brig
+, brig-types
+, bytestring
+, bytestring-conversion
+, cassandra-util
+, conduit
+, containers
+, filepath
+, galley
+, gitignoreSource
+, imports
+, iproute
+, lens
+, lib
+, megaparsec
+, optparse-applicative
+, process
+, raw-strings-qq
+, stache
+, text
+, time
+, tinylog
+, types-common
+, uuid
+, vector
+, wire-api
 }:
 mkDerivation {
   pname = "assets";
@@ -16,10 +40,32 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson attoparsec base brig brig-types bytestring
-    bytestring-conversion cassandra-util conduit containers filepath
-    galley imports iproute lens megaparsec optparse-applicative process
-    raw-strings-qq stache text time tinylog types-common uuid vector
+    aeson
+    attoparsec
+    base
+    brig
+    brig-types
+    bytestring
+    bytestring-conversion
+    cassandra-util
+    conduit
+    containers
+    filepath
+    galley
+    imports
+    iproute
+    lens
+    megaparsec
+    optparse-applicative
+    process
+    raw-strings-qq
+    stache
+    text
+    time
+    tinylog
+    types-common
+    uuid
+    vector
     wire-api
   ];
   executableHaskellDepends = [ base ];
diff --git a/tools/db/auto-whitelist/default.nix b/tools/db/auto-whitelist/default.nix
index c1fa285838..d749f584c9 100644
--- a/tools/db/auto-whitelist/default.nix
+++ b/tools/db/auto-whitelist/default.nix
@@ -2,9 +2,19 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, cassandra-util, extra, gitignoreSource
-, imports, lens, lib, optparse-applicative, tinylog, types-common
-, unliftio, wire-api
+{ mkDerivation
+, base
+, cassandra-util
+, extra
+, gitignoreSource
+, imports
+, lens
+, lib
+, optparse-applicative
+, tinylog
+, types-common
+, unliftio
+, wire-api
 }:
 mkDerivation {
   pname = "auto-whitelist";
@@ -13,8 +23,16 @@ mkDerivation {
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
-    base cassandra-util extra imports lens optparse-applicative tinylog
-    types-common unliftio wire-api
+    base
+    cassandra-util
+    extra
+    imports
+    lens
+    optparse-applicative
+    tinylog
+    types-common
+    unliftio
+    wire-api
   ];
   description = "Backfill service tables";
   license = lib.licenses.agpl3Only;
diff --git a/tools/db/billing-team-member-backfill/default.nix b/tools/db/billing-team-member-backfill/default.nix
index 4c298b9a95..18f60f04e7 100644
--- a/tools/db/billing-team-member-backfill/default.nix
+++ b/tools/db/billing-team-member-backfill/default.nix
@@ -2,9 +2,20 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, cassandra-util, conduit, containers
-, gitignoreSource, imports, lens, lib, optparse-applicative, text
-, tinylog, types-common, wire-api
+{ mkDerivation
+, base
+, cassandra-util
+, conduit
+, containers
+, gitignoreSource
+, imports
+, lens
+, lib
+, optparse-applicative
+, text
+, tinylog
+, types-common
+, wire-api
 }:
 mkDerivation {
   pname = "billing-team-member-backfill";
@@ -13,8 +24,17 @@ mkDerivation {
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
-    base cassandra-util conduit containers imports lens
-    optparse-applicative text tinylog types-common wire-api
+    base
+    cassandra-util
+    conduit
+    containers
+    imports
+    lens
+    optparse-applicative
+    text
+    tinylog
+    types-common
+    wire-api
   ];
   description = "Backfill billing_team_member table";
   license = lib.licenses.agpl3Only;
diff --git a/tools/db/find-undead/default.nix b/tools/db/find-undead/default.nix
index a058990e4d..510aeb134c 100644
--- a/tools/db/find-undead/default.nix
+++ b/tools/db/find-undead/default.nix
@@ -2,9 +2,23 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, base, bloodhound, brig-types, cassandra-util
-, conduit, containers, gitignoreSource, http-client, imports, lens
-, lib, optparse-applicative, text, tinylog, uuid
+{ mkDerivation
+, aeson
+, base
+, bloodhound
+, brig-types
+, cassandra-util
+, conduit
+, containers
+, gitignoreSource
+, http-client
+, imports
+, lens
+, lib
+, optparse-applicative
+, text
+, tinylog
+, uuid
 }:
 mkDerivation {
   pname = "find-undead";
@@ -13,8 +27,20 @@ mkDerivation {
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
-    aeson base bloodhound brig-types cassandra-util conduit containers
-    http-client imports lens optparse-applicative text tinylog uuid
+    aeson
+    base
+    bloodhound
+    brig-types
+    cassandra-util
+    conduit
+    containers
+    http-client
+    imports
+    lens
+    optparse-applicative
+    text
+    tinylog
+    uuid
   ];
   description = "Backfill billing_team_member table";
   license = lib.licenses.agpl3Only;
diff --git a/tools/db/migrate-sso-feature-flag/default.nix b/tools/db/migrate-sso-feature-flag/default.nix
index 8bc035482e..21223ca74e 100644
--- a/tools/db/migrate-sso-feature-flag/default.nix
+++ b/tools/db/migrate-sso-feature-flag/default.nix
@@ -2,9 +2,21 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, brig-types, cassandra-util, conduit, galley
-, gitignoreSource, imports, lens, lib, optparse-applicative
-, tinylog, types-common, unliftio, wire-api
+{ mkDerivation
+, base
+, brig-types
+, cassandra-util
+, conduit
+, galley
+, gitignoreSource
+, imports
+, lens
+, lib
+, optparse-applicative
+, tinylog
+, types-common
+, unliftio
+, wire-api
 }:
 mkDerivation {
   pname = "migrate-sso-feature-flag";
@@ -13,8 +25,18 @@ mkDerivation {
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
-    base brig-types cassandra-util conduit galley imports lens
-    optparse-applicative tinylog types-common unliftio wire-api
+    base
+    brig-types
+    cassandra-util
+    conduit
+    galley
+    imports
+    lens
+    optparse-applicative
+    tinylog
+    types-common
+    unliftio
+    wire-api
   ];
   description = "Backfill sso feature flag into teams that already have an IdP";
   license = lib.licenses.agpl3Only;
diff --git a/tools/db/move-team/default.nix b/tools/db/move-team/default.nix
index 61ac6561f0..a13200cc81 100644
--- a/tools/db/move-team/default.nix
+++ b/tools/db/move-team/default.nix
@@ -2,11 +2,33 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, base, brig-types, bytestring, cassandra-util
-, conduit, containers, filepath, galley, gitignoreSource, imports
-, iproute, lens, lib, megaparsec, optparse-applicative, process
-, raw-strings-qq, stache, text, time, tinylog, types-common, uuid
-, vector, wire-api
+{ mkDerivation
+, aeson
+, base
+, brig-types
+, bytestring
+, cassandra-util
+, conduit
+, containers
+, filepath
+, galley
+, gitignoreSource
+, imports
+, iproute
+, lens
+, lib
+, megaparsec
+, optparse-applicative
+, process
+, raw-strings-qq
+, stache
+, text
+, time
+, tinylog
+, types-common
+, uuid
+, vector
+, wire-api
 }:
 mkDerivation {
   pname = "move-team";
@@ -15,16 +37,56 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson base brig-types bytestring cassandra-util conduit containers
-    filepath galley imports iproute lens megaparsec
-    optparse-applicative process raw-strings-qq stache text time
-    tinylog types-common uuid vector wire-api
+    aeson
+    base
+    brig-types
+    bytestring
+    cassandra-util
+    conduit
+    containers
+    filepath
+    galley
+    imports
+    iproute
+    lens
+    megaparsec
+    optparse-applicative
+    process
+    raw-strings-qq
+    stache
+    text
+    time
+    tinylog
+    types-common
+    uuid
+    vector
+    wire-api
   ];
   executableHaskellDepends = [
-    aeson base brig-types bytestring cassandra-util conduit containers
-    filepath galley imports iproute lens megaparsec
-    optparse-applicative process raw-strings-qq stache text time
-    tinylog types-common uuid vector wire-api
+    aeson
+    base
+    brig-types
+    bytestring
+    cassandra-util
+    conduit
+    containers
+    filepath
+    galley
+    imports
+    iproute
+    lens
+    megaparsec
+    optparse-applicative
+    process
+    raw-strings-qq
+    stache
+    text
+    time
+    tinylog
+    types-common
+    uuid
+    vector
+    wire-api
   ];
   description = "Export a team from one backend, or import it into another";
   license = lib.licenses.agpl3Only;
diff --git a/tools/db/repair-handles/default.nix b/tools/db/repair-handles/default.nix
index 5c89be4ad9..ca0294873e 100644
--- a/tools/db/repair-handles/default.nix
+++ b/tools/db/repair-handles/default.nix
@@ -2,9 +2,23 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, brig, cassandra-util, conduit, containers
-, gitignoreSource, imports, lens, lib, mtl, optparse-applicative
-, string-conversions, text, tinylog, types-common, uuid
+{ mkDerivation
+, base
+, brig
+, cassandra-util
+, conduit
+, containers
+, gitignoreSource
+, imports
+, lens
+, lib
+, mtl
+, optparse-applicative
+, string-conversions
+, text
+, tinylog
+, types-common
+, uuid
 }:
 mkDerivation {
   pname = "repair-handles";
@@ -13,8 +27,19 @@ mkDerivation {
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
-    base brig cassandra-util conduit containers imports lens mtl
-    optparse-applicative string-conversions text tinylog types-common
+    base
+    brig
+    cassandra-util
+    conduit
+    containers
+    imports
+    lens
+    mtl
+    optparse-applicative
+    string-conversions
+    text
+    tinylog
+    types-common
     uuid
   ];
   description = "Repair inconsistencies between tables user and user_handle";
diff --git a/tools/db/service-backfill/default.nix b/tools/db/service-backfill/default.nix
index 44a13363d2..c778afe2db 100644
--- a/tools/db/service-backfill/default.nix
+++ b/tools/db/service-backfill/default.nix
@@ -2,9 +2,19 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, base, cassandra-util, conduit, gitignoreSource
-, imports, lens, lib, optparse-applicative, tinylog, types-common
-, unliftio, wire-api
+{ mkDerivation
+, base
+, cassandra-util
+, conduit
+, gitignoreSource
+, imports
+, lens
+, lib
+, optparse-applicative
+, tinylog
+, types-common
+, unliftio
+, wire-api
 }:
 mkDerivation {
   pname = "service-backfill";
@@ -13,8 +23,16 @@ mkDerivation {
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
-    base cassandra-util conduit imports lens optparse-applicative
-    tinylog types-common unliftio wire-api
+    base
+    cassandra-util
+    conduit
+    imports
+    lens
+    optparse-applicative
+    tinylog
+    types-common
+    unliftio
+    wire-api
   ];
   description = "Backfill service tables";
   license = lib.licenses.agpl3Only;
diff --git a/tools/rex/default.nix b/tools/rex/default.nix
index 240f1220f1..02d05d765d 100644
--- a/tools/rex/default.nix
+++ b/tools/rex/default.nix
@@ -2,10 +2,27 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, async, attoparsec, base, bytestring, clock, dns
-, exceptions, gitignoreSource, http-types, iproute, lib, mtl
-, network, optparse-applicative, prometheus, text, tinylog
-, unordered-containers, wai, warp
+{ mkDerivation
+, async
+, attoparsec
+, base
+, bytestring
+, clock
+, dns
+, exceptions
+, gitignoreSource
+, http-types
+, iproute
+, lib
+, mtl
+, network
+, optparse-applicative
+, prometheus
+, text
+, tinylog
+, unordered-containers
+, wai
+, warp
 }:
 mkDerivation {
   pname = "rex";
@@ -14,9 +31,24 @@ mkDerivation {
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
-    async attoparsec base bytestring clock dns exceptions http-types
-    iproute mtl network optparse-applicative prometheus text tinylog
-    unordered-containers wai warp
+    async
+    attoparsec
+    base
+    bytestring
+    clock
+    dns
+    exceptions
+    http-types
+    iproute
+    mtl
+    network
+    optparse-applicative
+    prometheus
+    text
+    tinylog
+    unordered-containers
+    wai
+    warp
   ];
   description = "Scrape and expose restund metrics for prometheus";
   license = lib.licenses.agpl3Only;
diff --git a/tools/stern/default.nix b/tools/stern/default.nix
index 175db25335..6eb54f2aa5 100644
--- a/tools/stern/default.nix
+++ b/tools/stern/default.nix
@@ -2,15 +2,52 @@
 # This file is generated by running hack/bin/generate-local-nix-packages.sh and
 # must be regenerated whenever local packages are added or removed, or
 # dependencies are added or removed.
-{ mkDerivation, aeson, base, bilge, brig-types, bytestring
-, bytestring-conversion, containers, data-default, errors
-, exceptions, extended, galley-types, gitignoreSource
-, gundeck-types, http-client, http-types, imports, lens, lib
-, metrics-wai, mtl, schema-profunctor, servant, servant-server
-, servant-swagger, servant-swagger-ui, split, string-conversions
-, swagger, swagger2, text, tinylog, transformers, types-common
-, unliftio, unordered-containers, uuid, wai, wai-extra
-, wai-predicates, wai-routing, wai-utilities, warp, wire-api, yaml
+{ mkDerivation
+, aeson
+, base
+, bilge
+, brig-types
+, bytestring
+, bytestring-conversion
+, containers
+, data-default
+, errors
+, exceptions
+, extended
+, galley-types
+, gitignoreSource
+, gundeck-types
+, http-client
+, http-types
+, imports
+, lens
+, lib
+, metrics-wai
+, mtl
+, schema-profunctor
+, servant
+, servant-server
+, servant-swagger
+, servant-swagger-ui
+, split
+, string-conversions
+, swagger
+, swagger2
+, text
+, tinylog
+, transformers
+, types-common
+, unliftio
+, unordered-containers
+, uuid
+, wai
+, wai-extra
+, wai-predicates
+, wai-routing
+, wai-utilities
+, warp
+, wire-api
+, yaml
 }:
 mkDerivation {
   pname = "stern";
@@ -19,17 +56,56 @@ mkDerivation {
   isLibrary = true;
   isExecutable = true;
   libraryHaskellDepends = [
-    aeson base bilge brig-types bytestring bytestring-conversion
-    containers data-default errors exceptions extended galley-types
-    gundeck-types http-client http-types imports lens metrics-wai mtl
-    schema-profunctor servant servant-server servant-swagger
-    servant-swagger-ui split string-conversions swagger swagger2 text
-    tinylog transformers types-common unliftio unordered-containers
-    uuid wai wai-extra wai-predicates wai-routing wai-utilities warp
-    wire-api yaml
+    aeson
+    base
+    bilge
+    brig-types
+    bytestring
+    bytestring-conversion
+    containers
+    data-default
+    errors
+    exceptions
+    extended
+    galley-types
+    gundeck-types
+    http-client
+    http-types
+    imports
+    lens
+    metrics-wai
+    mtl
+    schema-profunctor
+    servant
+    servant-server
+    servant-swagger
+    servant-swagger-ui
+    split
+    string-conversions
+    swagger
+    swagger2
+    text
+    tinylog
+    transformers
+    types-common
+    unliftio
+    unordered-containers
+    uuid
+    wai
+    wai-extra
+    wai-predicates
+    wai-routing
+    wai-utilities
+    warp
+    wire-api
+    yaml
   ];
   executableHaskellDepends = [
-    base extended imports types-common unliftio
+    base
+    extended
+    imports
+    types-common
+    unliftio
   ];
   license = lib.licenses.agpl3Only;
   mainProgram = "stern";
diff --git a/treefmt.toml b/treefmt.toml
new file mode 100644
index 0000000000..53c01bf871
--- /dev/null
+++ b/treefmt.toml
@@ -0,0 +1,51 @@
+[formatter.nix]
+command = "nixpkgs-fmt"
+includes = ["*.nix"]
+excludes = [
+  "nix/sources.nix" # managed by niv.
+]
+
+[formatter.shellcheck]
+command = "shellcheck"
+includes = ["*.sh"]
+excludes = [
+  "dist-newstyle/",
+  "services/nginz/third_party/",
+  "libs/wire-api/test/golden/gentests.sh",
+  "changelog.d/mk-changelog.sh",
+  "hack/bin/integration-teardown.sh",
+  "hack/bin/diff-failure.sh",
+  "hack/bin/integration-setup.sh",
+  "hack/bin/cabal-run-tests.sh",
+  "hack/bin/integration-teardown-federation.sh",
+  "hack/bin/integration-setup-federation.sh",
+  "hack/bin/serve-charts.sh",
+  "hack/bin/cabal-install-artefacts.sh",
+  "hack/bin/helm-template.sh",
+  "hack/bin/set-chart-image-version.sh",
+  "hack/bin/copy-charts.sh",
+  "hack/bin/set-helm-chart-version.sh",
+  "hack/bin/integration-spring-cleaning.sh",
+  "hack/bin/upload-helm-charts-s3.sh",
+  "hack/bin/integration-test-logs.sh",
+  "services/nginz/nginz_reload.sh",
+  "services/spar/test-scim-suite/mk_collection.sh",
+  "services/spar/test-scim-suite/runsuite.sh",
+  "services/spar/test-scim-suite/run.sh",
+  "services/brig/federation-tests.sh",
+  "services/integration.sh",
+  "services/nginz/third_party/nginx-module-vts/*",
+  "services/nginz/third_party/headers-more-nginx-module/*",
+  "hack/bin/create_test_team_members.sh",
+  "hack/bin/create_test_team_scim.sh",
+  "hack/bin/create_test_user.sh",
+  "hack/bin/create_team_members.sh",
+  "hack/bin/register_idp_internal.sh",
+  "hack/bin/create_test_team_admins.sh",
+  "deploy/dockerephemeral/init.sh",
+  "tools/nginz_disco/nginz_disco.sh",
+  "tools/rebase-onto-formatter.sh",
+  "tools/sftd_disco/sftd_disco.sh",
+  "tools/ormolu.sh",
+  "tools/db/move-team/dump_merge_teams.sh"
+]