diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e10fe91..3ca3778 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,6 +15,19 @@ permissions:
   contents: read
 
 jobs:
+  fmt:
+    name: 🎨 Check formatting
+    runs-on: ubuntu-latest
+    steps:
+      - name: 🛎️ Checkout
+        uses: actions/checkout@v5
+
+      - name: 🧰 Install rustfmt
+        run: rustup component add rustfmt
+
+      - name: 🎨 Cargo fmt
+        run: cargo fmt --all -- --check
+
   test:
     name: 🧪 Run Tests
     runs-on: ubuntu-latest
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..7d740cb
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,15 @@
+# Agent guidelines
+
+## Formatting
+
+This repository enforces formatting in CI via `cargo fmt --all -- --check`
+(the `fmt` job in `.github/workflows/release.yml`). A pull request will fail
+if any code is not formatted.
+
+After making any Rust code changes, always run:
+
+```sh
+cargo fmt --all
+```
+
+before committing, so that the formatting check passes.
diff --git a/chart-discovery/src/main.rs b/chart-discovery/src/main.rs
index 9284983..256e1d1 100644
--- a/chart-discovery/src/main.rs
+++ b/chart-discovery/src/main.rs
@@ -27,7 +27,12 @@ enum RegistryProvider {
 
 #[derive(Debug, Parser)]
 pub struct Config {
-    #[clap(long, env = "PLATZ_REGISTRY_PROVIDER", value_enum, default_value = "ecr")]
+    #[clap(
+        long,
+        env = "PLATZ_REGISTRY_PROVIDER",
+        value_enum,
+        default_value = "ecr"
+    )]
     provider: RegistryProvider,
 
     #[clap(flatten)]
diff --git a/chart-discovery/src/oci_poll.rs b/chart-discovery/src/oci_poll.rs
index 81106c3..1a512af 100644
--- a/chart-discovery/src/oci_poll.rs
+++ b/chart-discovery/src/oci_poll.rs
@@ -1,15 +1,11 @@
-use crate::charts::{
-    HELM_ARTIFACT_MEDIA_TYPE, download_chart_via_oci, record_helm_chart,
-};
+use crate::charts::{HELM_ARTIFACT_MEDIA_TYPE, download_chart_via_oci, record_helm_chart};
 use crate::kind::get_or_create_kind;
 use anyhow::{Result, anyhow};
 use chrono::prelude::*;
 use clap::Parser;
 use platz_chart_ext::ChartExt;
 use platz_db::schema::helm_chart::HelmChart;
-use platz_db::schema::helm_registry::{
-    HelmRegistry, HelmRegistryProvider, NewHelmRegistry,
-};
+use platz_db::schema::helm_registry::{HelmRegistry, HelmRegistryProvider, NewHelmRegistry};
 use serde::Deserialize;
 use std::collections::HashSet;
 use tokio::time;
diff --git a/k8s-agent/src/config.rs b/k8s-agent/src/config.rs
index 05293d3..359271b 100644
--- a/k8s-agent/src/config.rs
+++ b/k8s-agent/src/config.rs
@@ -15,7 +15,11 @@ pub struct Config {
     #[arg(long, env = "PLATZ_HELM_IMAGE")]
     pub helm_image: String,
 
-    #[arg(long, env = "PLATZ_DISABLE_DEPLOYMENT_CREDENTIALS", default_value = "false")]
+    #[arg(
+        long,
+        env = "PLATZ_DISABLE_DEPLOYMENT_CREDENTIALS",
+        default_value = "false"
+    )]
     pub disable_deployment_credentials: bool,
 
     #[arg(long, env = "PLATZ_OWN_URL")]
diff --git a/k8s-agent/src/k8s/cluster_discovery.rs b/k8s-agent/src/k8s/cluster_discovery.rs
index be010dc..375d150 100644
--- a/k8s-agent/src/k8s/cluster_discovery.rs
+++ b/k8s-agent/src/k8s/cluster_discovery.rs
@@ -28,7 +28,12 @@ pub struct Config {
 
     /// Selects how clusters are discovered. Defaults to `eks` (production behaviour);
     /// set to `local` for laptop/dev workflows that target a kubeconfig context.
-    #[arg(long, env = "PLATZ_CLUSTER_PROVIDER", value_enum, default_value = "eks")]
+    #[arg(
+        long,
+        env = "PLATZ_CLUSTER_PROVIDER",
+        value_enum,
+        default_value = "eks"
+    )]
     pub provider: ClusterProvider,
 
     /// Path to the kubeconfig file used in `local` mode.
@@ -129,10 +134,9 @@ async fn discover_local_cluster(config: &Config) -> Result<K8s> {
 
     let context_name = match &config.local_context {
         Some(name) => name.clone(),
-        None => kubeconfig
-            .current_context
-            .clone()
-            .ok_or_else(|| anyhow!("Kubeconfig has no current-context and PLATZ_LOCAL_CONTEXT is not set"))?,
+        None => kubeconfig.current_context.clone().ok_or_else(|| {
+            anyhow!("Kubeconfig has no current-context and PLATZ_LOCAL_CONTEXT is not set")
+        })?,
     };
 
     let context = kubeconfig
@@ -184,7 +188,9 @@ async fn discover_local_cluster(config: &Config) -> Result<K8s> {
     })))
 }
 
-async fn load_local_kubeconfig(explicit_path: Option<&std::path::Path>) -> Result<kube::config::Kubeconfig> {
+async fn load_local_kubeconfig(
+    explicit_path: Option<&std::path::Path>,
+) -> Result<kube::config::Kubeconfig> {
     if let Some(path) = explicit_path {
         debug!("Loading kubeconfig from {}", path.display());
         return Ok(kube::config::Kubeconfig::read_from(path)?);