diff --git a/docs/TODO.md b/docs/TODO.md
index 3a01d21..bab0211 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -99,6 +99,7 @@
 # tech debt
 
 - better remote deployment
+- expose remote deployment as a flake app, replacing the Fish-only `deploy-to` workflow
 - centralize shared system group names, starting with the `storage` group
 
 ## nix refactor
diff --git a/flake.lock b/flake.lock
index 5adf329..8a2988d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -465,7 +465,8 @@
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixvim": "nixvim",
         "sops-nix": "sops-nix",
-        "stylix": "stylix"
+        "stylix": "stylix",
+        "treefmt-nix": "treefmt-nix"
       }
     },
     "sops-nix": {
@@ -617,6 +618,26 @@
         "repo": "base16-zed",
         "type": "github"
       }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786901030,
+        "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 1e1aa0f..40bab76 100644
--- a/flake.nix
+++ b/flake.nix
@@ -62,6 +62,12 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    # Repository formatter and Nix lint wiring.
+    treefmt-nix = {
+      url = "github:numtide/treefmt-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # CachyOS kernel and binary cache.
     # This must not follow this flake's nixpkgs because Chaotic builds against its own pinned package set.
     # Its cache serves the kernel only when the overlay stays on the cache-friendly path.
@@ -70,11 +76,10 @@
 
   outputs =
     { self, nixpkgs, ... }@inputs:
-    {
-      nixosConfigurations = (import ./src/dotfiles {
-        inherit inputs self;
-        lib = nixpkgs.lib;
-        root = ./configs/nixos;
-      }).nixosConfigurations;
+    import ./src/dotfiles {
+      inherit inputs self;
+      lib = nixpkgs.lib;
+      root = ./configs/nixos;
+      system = "x86_64-linux";
     };
 }
diff --git a/src/dotfiles/apps.nix b/src/dotfiles/apps.nix
new file mode 100644
index 0000000..26a79c3
--- /dev/null
+++ b/src/dotfiles/apps.nix
@@ -0,0 +1,28 @@
+{
+  inputs,
+  lib,
+  formatter,
+  system,
+}:
+let
+  pkgs = inputs.nixpkgs.legacyPackages.${system};
+in
+{
+  fix = {
+    type = "app";
+    program = lib.getExe (pkgs.writeShellApplication {
+      name = "fix";
+      runtimeInputs = [
+        formatter.config.build.wrapper
+        pkgs.statix
+        pkgs.deadnix
+      ];
+      text = ''
+        treefmt
+        statix fix .
+        deadnix --edit --exclude configs/nixos/hosts/*/hardware-configuration.nix -- .
+        treefmt
+      '';
+    });
+  };
+}
diff --git a/src/dotfiles/default.nix b/src/dotfiles/default.nix
index b7426d5..285d819 100644
--- a/src/dotfiles/default.nix
+++ b/src/dotfiles/default.nix
@@ -3,6 +3,7 @@
   inputs,
   self,
   root,
+  system,
 }:
 let
   util = import ./util.nix { inherit lib; };
@@ -38,8 +39,23 @@ let
       ;
     registry = registry.collected;
   };
+
+  formatter = import ./formatter.nix {
+    inherit inputs system;
+  };
 in
 {
+  formatter.${system} = formatter.config.build.wrapper;
+
+  apps.${system} = import ./apps.nix {
+    inherit
+      inputs
+      lib
+      formatter
+      system
+      ;
+  };
+
   nixosConfigurations = import ./hosts.nix {
     inherit
       inputs
diff --git a/src/dotfiles/formatter.nix b/src/dotfiles/formatter.nix
new file mode 100644
index 0000000..f4cf85d
--- /dev/null
+++ b/src/dotfiles/formatter.nix
@@ -0,0 +1,10 @@
+{ inputs, system }:
+inputs.treefmt-nix.lib.evalModule inputs.nixpkgs.legacyPackages.${system} {
+  projectRootFile = "flake.nix";
+
+  programs.nixfmt.enable = true;
+
+  settings.formatter.nixfmt.excludes = [
+    "configs/nixos/hosts/*/hardware-configuration.nix"
+  ];
+}
diff --git a/statix.toml b/statix.toml
new file mode 100644
index 0000000..1a0d92f
--- /dev/null
+++ b/statix.toml
@@ -0,0 +1,3 @@
+disabled = [
+  "repeated_keys",
+]