diff --git a/bazel/ci/BUILD.bazel b/bazel/ci/BUILD.bazel
index 5815d18ad..5a8cfaf67 100644
--- a/bazel/ci/BUILD.bazel
+++ b/bazel/ci/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@bazel_gazelle//:def.bzl", "gazelle")
 load("@com_github_ash2k_bazel_tools//multirun:def.bzl", "multirun")
 load("@com_github_bazelbuild_buildtools//buildifier:def.bzl", "buildifier", "buildifier_test")
-load(":def.bzl", "sh_template")
+load(":def.bzl", "repo_command", "sh_template")
 
 gazelle(name = "gazelle_generate")
 
@@ -57,15 +57,26 @@ sh_template(
         "@go_sdk//:bin/go",
     ],
     substitutions = {
-        "@@BASE_LIB@@": "$(location :base_lib)",
-        "@@GO@@": "$(location @go_sdk//:bin/go)",
+        "@@BASE_LIB@@": "$(rootpath :base_lib)",
+        "@@GO@@": "$(rootpath @go_sdk//:bin/go)",
     },
     template = "tidy.sh.in",
 )
 
+repo_command(
+    name = "gofumpt",
+    args = [
+        "-l",
+        "-w",
+        ".",
+    ],
+    command = "@cc_mvdan_gofumpt//:gofumpt",
+)
+
 multirun(
     name = "tidy",
     commands = [
+        ":gofumpt",
         ":go_mod_tidy",
         ":gazelle_update_repos",
         ":gazelle_generate",
diff --git a/bazel/ci/def.bzl b/bazel/ci/def.bzl
index 89d355519..2faf8c600 100644
--- a/bazel/ci/def.bzl
+++ b/bazel/ci/def.bzl
@@ -8,7 +8,6 @@ def _sh_template_impl(ctx):
     substitutions = {}
     for k, v in ctx.attr.substitutions.items():
         sub = ctx.expand_location(v, ctx.attr.data)
-        sub = shell.quote(sub)
         substitutions[k] = sub
 
     ctx.actions.expand_template(
@@ -63,3 +62,31 @@ def sh_template(name, **kwargs):
         srcs = [script_name],
         **kwargs
     )
+
+def repo_command(name, **kwargs):
+    """Build a sh_binary that executes a single command.
+
+    Args:
+        name: name
+        **kwargs: **kwargs
+    """
+    cmd = kwargs.pop("command")
+    args = shell.array_literal(kwargs.pop("args", []))
+
+    substitutions = {
+        "@@ARGS@@": args,
+        "@@BASE_LIB@@": "$(rootpath :base_lib)",
+        "@@CMD@@": "$(rootpath %s)" % cmd,
+    }
+
+    data = kwargs.pop("data", [])
+    data.append(":base_lib")
+    data.append(cmd)
+
+    sh_template(
+        name = name,
+        data = data,
+        substitutions = substitutions,
+        template = "repo_command.sh.in",
+        **kwargs
+    )
diff --git a/bazel/ci/repo_command.sh.in b/bazel/ci/repo_command.sh.in
new file mode 100644
index 000000000..a3fd3ed74
--- /dev/null
+++ b/bazel/ci/repo_command.sh.in
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+lib=$(realpath @@BASE_LIB@@) || exit 1
+cmd=$(realpath @@CMD@@) || exit 1
+args=@@ARGS@@
+
+# shellcheck source=lib.bash
+if ! source "${lib}"; then
+  echo "Error: could not find import"
+  exit 1
+fi
+
+cd "${BUILD_WORKSPACE_DIRECTORY}" || exit 1
+
+"${cmd}" "${args[@]}"