diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 86fc00c2..aabadc72 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,8 +4,23 @@ on:
   workflow_call:
 
 jobs:
+  fmt:
+    name: Format
+    uses: ./.github/workflows/bake.yml
+    with:
+      bake_targets: '["fmt"]'
+      cargo_profiles: ${{vars.CARGO_PROFILES}}
+      docker_id: ${{vars.DOCKER_ID}}
+      feat_sets: ${{vars.FEAT_SETS}}
+      machines: ${{vars.MACHINES}}
+      rust_targets: ${{vars.RUST_TARGETS}}
+      rust_toolchains: '["nightly"]'
+      sys_names: ${{vars.SYS_NAMES}}
+      sys_targets: ${{vars.SYS_TARGETS}}
+      sys_versions: ${{vars.SYS_VERSIONS}}
+
   clippy:
-    name: Clippy Lints
+    name: Clippy
     uses: ./.github/workflows/bake.yml
     with:
       bake_targets: '["clippy"]'
diff --git a/docker/Dockerfile.deps b/docker/Dockerfile.cargo.deps
similarity index 100%
rename from docker/Dockerfile.deps
rename to docker/Dockerfile.cargo.deps
diff --git a/docker/Dockerfile.cargo.fmt b/docker/Dockerfile.cargo.fmt
new file mode 100644
index 00000000..2b91c2b7
--- /dev/null
+++ b/docker/Dockerfile.cargo.fmt
@@ -0,0 +1,23 @@
+# syntax = docker/dockerfile:1.11-labs
+
+FROM input AS cargo
+ARG sys_target
+ARG rust_toolchain="nightly"
+ARG RUSTUP_HOME
+ARG CARGO_HOME
+ARG fmt_args=""
+
+WORKDIR /usr/src/tuwunel
+RUN \
+--mount=type=cache,dst=${RUSTUP_HOME},sharing=locked \
+--mount=type=cache,dst=${CARGO_HOME},sharing=locked \
+<<EOF
+    env
+    set -eux
+    rustup run ${rust_toolchain} \
+        cargo fmt \
+            --all \
+            --check \
+            --manifest-path Cargo.toml \
+            ${fmt_args}
+EOF
diff --git a/docker/Dockerfile.install b/docker/Dockerfile.cargo.install
similarity index 100%
rename from docker/Dockerfile.install
rename to docker/Dockerfile.cargo.install
diff --git a/docker/Dockerfile.cookware b/docker/Dockerfile.cookware
index 0f0d1e24..18e22d88 100644
--- a/docker/Dockerfile.cookware
+++ b/docker/Dockerfile.cookware
@@ -39,7 +39,7 @@ RUN \
     rustup component add \
         --toolchain ${rust_toolchain} \
         --target ${CARGO_TARGET} \
-        clippy
+        clippy rustfmt
 EOF
 
 
diff --git a/docker/bake.hcl b/docker/bake.hcl
index d201e4f0..7c7e8e3e 100644
--- a/docker/bake.hcl
+++ b/docker/bake.hcl
@@ -440,7 +440,7 @@ target "installer" {
         elem_tag("installer", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
     ]
     target = "installer"
-    dockerfile = "docker/Dockerfile.install"
+    dockerfile = "docker/Dockerfile.cargo.install"
     labels = {
         "_group" = "install"
         "_cache" = "trunk"
@@ -680,6 +680,25 @@ target "check" {
     }
 }
 
+target "fmt" {
+    name = elem("fmt", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    tags = [
+        elem_tag("fmt", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target], "latest"),
+    ]
+    dockerfile = "docker/Dockerfile.cargo.fmt"
+    matrix = cargo_rust_feat_sys
+    inherits = [
+        elem("deps-base", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+        elem("cargo", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target]),
+    ]
+    contexts = {
+        input = elem("target:ingredients", [rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
+    }
+    args = {
+        fmt_args = "-- --color always"
+    }
+}
+
 target "cargo" {
     name = elem("cargo", [cargo_profile, rust_toolchain, rust_target, feat_set, sys_name, sys_version, sys_target])
     target = "cargo"
@@ -803,7 +822,7 @@ target "deps-base" {
     target = "deps"
     output = ["type=docker,compression=zstd,mode=min"]
     cache_to = ["type=local,compression=zstd,mode=min"]
-    dockerfile = "docker/Dockerfile.deps"
+    dockerfile = "docker/Dockerfile.cargo.deps"
     labels = {
         "_group" = "deps"
         "_cache" = "trunk"