diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 69544e00..8087cb0c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -11,6 +11,23 @@ stages:
   - release
   - distribute
 
+format:
+  stage: test
+  image: rust:latest
+  before_script:
+    - rustup component add rustfmt
+
+  script:
+    - cargo fmt --all -- --check --verbose
+
+  cache:
+    key: fmt-cache
+    paths:
+      - ~/.cargo/bin/
+      - ~/.cargo/git/db/
+      - ~/.cargo/registry/cache/
+      - ~/.cargo/registry/index/
+
 # base earthly setup for jobs
 .base:
   tags: [ saas-linux-medium-amd64 ]
diff --git a/veilid-core/src/network_manager/native/igd_manager.rs b/veilid-core/src/network_manager/native/igd_manager.rs
index f332ba81..e40c47a4 100644
--- a/veilid-core/src/network_manager/native/igd_manager.rs
+++ b/veilid-core/src/network_manager/native/igd_manager.rs
@@ -293,10 +293,10 @@ impl IGDManager {
                 at,
                 local_port,
             }, PortMapValue {
-                ext_ip, 
-                mapped_port, 
-                timestamp, 
-                renewal_lifetime: ((UPNP_MAPPING_LIFETIME_MS / 2) as u64 * 1000u64).into(), 
+                ext_ip,
+                mapped_port,
+                timestamp,
+                renewal_lifetime: ((UPNP_MAPPING_LIFETIME_MS / 2) as u64 * 1000u64).into(),
                 renewal_attempts: 0,
             });
 
diff --git a/veilid-core/src/network_manager/network_connection.rs b/veilid-core/src/network_manager/network_connection.rs
index 4a4d49c0..a236706e 100644
--- a/veilid-core/src/network_manager/network_connection.rs
+++ b/veilid-core/src/network_manager/network_connection.rs
@@ -310,7 +310,6 @@ impl NetworkConnection {
                     let sender_fut = receiver.recv_async().then(|res| async {
                         match res {
                             Ok((_span_id, message)) => {
-                                
                                 // Touch the LRU for this connection
                                 connection_manager.touch_connection_by_id(connection_id);
 
@@ -378,7 +377,6 @@ impl NetworkConnection {
                                         log_net!(debug "failed to process received envelope: {}", e);
                                         RecvLoopAction::Finish
                                     } else {
-                                        
                                         // Touch the LRU for this connection
                                         connection_manager.touch_connection_by_id(connection_id);
 
@@ -442,7 +440,6 @@ impl NetworkConnection {
             if let Err(e) = protocol_connection.close().await {
                 log_net!(debug "Protocol connection close error: {}", e);
             }
-            
         }.in_current_span())
     }
 
diff --git a/veilid-core/src/network_manager/send_data.rs b/veilid-core/src/network_manager/send_data.rs
index 46a4d5ec..40245e9b 100644
--- a/veilid-core/src/network_manager/send_data.rs
+++ b/veilid-core/src/network_manager/send_data.rs
@@ -93,7 +93,6 @@ impl NetworkManager {
                             target_node_ref,
                             relay_nr,
                         );
-                
                     }
                     | NodeContactMethod::InboundRelay(relay_nr) => {
                         // Relay loop or multiple relays
@@ -110,7 +109,7 @@ impl NetworkManager {
                         )
                     }
                     NodeContactMethod::SignalReverse(relay_nr, target_node_ref) => {
-                        let nres = 
+                        let nres =
                             this.send_data_ncm_signal_reverse(relay_nr.clone(), target_node_ref.clone(), data.clone())
                                 .await?;
                         if matches!(nres, NetworkResult::Timeout) {
@@ -123,7 +122,7 @@ impl NetworkManager {
                         }
                     }
                     NodeContactMethod::SignalHolePunch(relay_nr, target_node_ref) => {
-                        let nres = 
+                        let nres =
                             this.send_data_ncm_signal_hole_punch(relay_nr.clone(), target_node_ref.clone(), data.clone())
                                 .await?;
                         if matches!(nres, NetworkResult::Timeout) {
diff --git a/veilid-core/src/routing_table/bucket_entry.rs b/veilid-core/src/routing_table/bucket_entry.rs
index d0b8979e..ce00ca25 100644
--- a/veilid-core/src/routing_table/bucket_entry.rs
+++ b/veilid-core/src/routing_table/bucket_entry.rs
@@ -553,7 +553,7 @@ impl BucketEntryInner {
                 }
 
                 // Check if the connection is still considered live
-                let alive = 
+                let alive =
                     // Should we check the connection table?
                     if v.0.protocol_type().is_ordered() {
                         // Look the connection up in the connection manager and see if it's still there
diff --git a/veilid-core/src/routing_table/tasks/bootstrap.rs b/veilid-core/src/routing_table/tasks/bootstrap.rs
index 19be5262..474bc7c2 100644
--- a/veilid-core/src/routing_table/tasks/bootstrap.rs
+++ b/veilid-core/src/routing_table/tasks/bootstrap.rs
@@ -308,7 +308,7 @@ impl RoutingTable {
                     if !nr.signed_node_info_has_valid_signature(RoutingDomain::PublicInternet) {
                         log_rtab!(warn "bootstrap server is not responding");
                         log_rtab!(debug "bootstrap server is not responding for dialinfo: {}", bsdi);
-                        
+
                         // Try a different dialinfo next time
                         routing_table.network_manager().address_filter().set_dial_info_failed(bsdi);
                     } else {
diff --git a/veilid-core/src/rpc_processor/mod.rs b/veilid-core/src/rpc_processor/mod.rs
index 0d55628a..70dafc8e 100644
--- a/veilid-core/src/rpc_processor/mod.rs
+++ b/veilid-core/src/rpc_processor/mod.rs
@@ -1738,7 +1738,7 @@ impl RPCProcessor {
                     continue;
                 }
 
-                Ok(v) => { 
+                Ok(v) => {
                     v
                 }
             } => [ format!(": msg.header={:?}", msg.header) ] {});
diff --git a/veilid-core/src/rpc_processor/rpc_get_value.rs b/veilid-core/src/rpc_processor/rpc_get_value.rs
index 3a7b4f33..46f481bc 100644
--- a/veilid-core/src/rpc_processor/rpc_get_value.rs
+++ b/veilid-core/src/rpc_processor/rpc_get_value.rs
@@ -17,9 +17,9 @@ impl RPCProcessor {
     /// the identity of the node and defeat the private route.
 
     #[instrument(level = "trace", target = "rpc", skip(self, last_descriptor), 
-            fields(ret.value.data.len, 
-                ret.value.data.seq, 
-                ret.value.data.writer, 
+            fields(ret.value.data.len,
+                ret.value.data.seq,
+                ret.value.data.writer,
                 ret.peers.len,
                 ret.latency
             ),err)]
diff --git a/veilid-core/src/rpc_processor/rpc_inspect_value.rs b/veilid-core/src/rpc_processor/rpc_inspect_value.rs
index 589ab45a..8d57c462 100644
--- a/veilid-core/src/rpc_processor/rpc_inspect_value.rs
+++ b/veilid-core/src/rpc_processor/rpc_inspect_value.rs
@@ -19,7 +19,7 @@ impl RPCProcessor {
     ///  * the amount requested
     ///  * an amount truncated to MAX_INSPECT_VALUE_A_SEQS_LEN subkeys
     ///  * zero if nothing was found
-    #[  
+    #[
         instrument(level = "trace", target = "rpc", skip(self, last_descriptor), 
             fields(ret.peers.len,
                 ret.latency
diff --git a/veilid-core/src/rpc_processor/rpc_set_value.rs b/veilid-core/src/rpc_processor/rpc_set_value.rs
index 2b7ac63e..ad8d64e7 100644
--- a/veilid-core/src/rpc_processor/rpc_set_value.rs
+++ b/veilid-core/src/rpc_processor/rpc_set_value.rs
@@ -14,14 +14,14 @@ impl RPCProcessor {
     /// Because this leaks information about the identity of the node itself,
     /// replying to this request received over a private route will leak
     /// the identity of the node and defeat the private route.
-    #[instrument(level = "trace", target = "rpc", skip(self, value, descriptor), 
-        fields(value.data.len = value.value_data().data().len(), 
-            value.data.seq = value.value_data().seq(), 
-            value.data.writer = value.value_data().writer().to_string(), 
+    #[instrument(level = "trace", target = "rpc", skip(self, value, descriptor),
+        fields(value.data.len = value.value_data().data().len(),
+            value.data.seq = value.value_data().seq(),
+            value.data.writer = value.value_data().writer().to_string(),
             ret.set,
-            ret.value.data.len, 
-            ret.value.data.seq, 
-            ret.value.data.writer, 
+            ret.value.data.len,
+            ret.value.data.seq,
+            ret.value.data.writer,
             ret.peers.len,
             ret.latency
         ), err)]
diff --git a/veilid-core/src/storage_manager/get_value.rs b/veilid-core/src/storage_manager/get_value.rs
index f84f4e64..4a6563c0 100644
--- a/veilid-core/src/storage_manager/get_value.rs
+++ b/veilid-core/src/storage_manager/get_value.rs
@@ -177,7 +177,6 @@ impl StorageManager {
                         // Send an update since the value changed
                         ctx.send_partial_update = true;
                     }
-                    
                     // Return peers if we have some
                     log_network_result!(debug "GetValue fanout call returned peers {}", gva.answer.peers.len());
 
@@ -298,7 +297,7 @@ impl StorageManager {
             Box::new(
                 move |result: VeilidAPIResult<get_value::OutboundGetValueResult>| -> SendPinBoxFuture<bool> {
                     let this = this.clone();
-                    Box::pin(async move { 
+                    Box::pin(async move {
                         let result = match result {
                             Ok(v) => v,
                             Err(e) => {
diff --git a/veilid-core/src/storage_manager/set_value.rs b/veilid-core/src/storage_manager/set_value.rs
index b437c16e..6821f5cb 100644
--- a/veilid-core/src/storage_manager/set_value.rs
+++ b/veilid-core/src/storage_manager/set_value.rs
@@ -145,7 +145,6 @@ impl StorageManager {
                     // If we got a value back it should be different than the one we are setting
                     // But in the case of a benign bug, we can just move to the next node
                     if ctx.value.value_data() == value.value_data() {
-                        
                         ctx.value_nodes.push(next_node);
                         ctx.missed_since_last_set = 0;
 
@@ -298,7 +297,7 @@ impl StorageManager {
                 move |result: VeilidAPIResult<set_value::OutboundSetValueResult>| -> SendPinBoxFuture<bool> {
                     let this = this.clone();
                     let last_value_data = last_value_data.clone();
-                    Box::pin(async move { 
+                    Box::pin(async move {
                         let result = match result {
                             Ok(v) => v,
                             Err(e) => {
diff --git a/veilid-core/src/table_store/tests/test_table_store.rs b/veilid-core/src/table_store/tests/test_table_store.rs
index a17c82f3..e0331470 100644
--- a/veilid-core/src/table_store/tests/test_table_store.rs
+++ b/veilid-core/src/table_store/tests/test_table_store.rs
@@ -210,6 +210,7 @@ pub async fn test_protect_unprotect(vcrypto: CryptoSystemVersion, ts: TableStore
             0, 0, 0,
         ]),
     );
+
     let dek2 = TypedSharedSecret::new(
         vcrypto.kind(),
         SharedSecret::new([
@@ -217,6 +218,7 @@ pub async fn test_protect_unprotect(vcrypto: CryptoSystemVersion, ts: TableStore
             0, 0, 0xFF,
         ]),
     );
+
     let dek3 = TypedSharedSecret::new(
         vcrypto.kind(),
         SharedSecret::new([0x80u8; SHARED_SECRET_LENGTH]),
diff --git a/veilid-core/src/veilid_api/api.rs b/veilid-core/src/veilid_api/api.rs
index 79878848..4a825a89 100644
--- a/veilid-core/src/veilid_api/api.rs
+++ b/veilid-core/src/veilid_api/api.rs
@@ -278,9 +278,9 @@ impl VeilidAPI {
         sequencing: Sequencing,
     ) -> VeilidAPIResult<(RouteId, Vec<u8>)> {
         event!(target: "veilid_api", Level::DEBUG, 
-            "VeilidAPI::new_custom_private_route(crypto_kinds: {:?}, stability: {:?}, sequencing: {:?})", 
-            crypto_kinds, 
-            stability, 
+            "VeilidAPI::new_custom_private_route(crypto_kinds: {:?}, stability: {:?}, sequencing: {:?})",
+            crypto_kinds,
+            stability,
             sequencing);
 
         for kind in crypto_kinds {