diff --git a/src/bin/quire/commands/ci.rs b/src/bin/quire/commands/ci.rs
index 7954095..0dd1f20 100644
--- a/src/bin/quire/commands/ci.rs
+++ b/src/bin/quire/commands/ci.rs
@@ -41,11 +41,7 @@ pub async fn validate(maybe_sha: Option<&str>) -> Result<()> {
 /// default), creates a transient Run rooted at a tempdir, drives the
 /// pipeline through it, and prints each job's `(ci.sh …)` output to
 /// stdout. The tempdir is removed when the command exits.
-pub async fn run(
-    quire: &Quire,
-    maybe_sha: Option<&str>,
-    executor: Executor,
-) -> Result<()> {
+pub async fn run(quire: &Quire, maybe_sha: Option<&str>, executor: Executor) -> Result<()> {
     let repo_path = discover_repo()?;
     let commit = resolve_commit(maybe_sha)?;
     let ci = Ci::new(repo_path.clone());
diff --git a/src/ci/docker.rs b/src/ci/docker.rs
index 040d46c..8d6bad4 100644
--- a/src/ci/docker.rs
+++ b/src/ci/docker.rs
@@ -32,9 +32,7 @@ pub(crate) fn docker_build(dockerfile: &Path, context: &Path, tag: &str) -> Resu
         .map_err(|e| Error::ImageBuildFailed { source: e })?;
     if !output.status.success() {
         return Err(Error::ImageBuildFailed {
-            source: std::io::Error::other(
-                String::from_utf8_lossy(&output.stderr).into_owned(),
-            ),
+            source: std::io::Error::other(String::from_utf8_lossy(&output.stderr).into_owned()),
         });
     }
     Ok(())
@@ -58,11 +56,7 @@ impl ContainerSession {
     /// bind-mounted at `mount_target` inside the container, with
     /// `mount_target` as the working directory. Captures the container
     /// ID. Failures surface as `Error::ContainerStartFailed`.
-    pub(crate) fn start(
-        image_tag: &str,
-        mount_source: &Path,
-        mount_target: &str,
-    ) -> Result<Self> {
+    pub(crate) fn start(image_tag: &str, mount_source: &Path, mount_target: &str) -> Result<Self> {
         let mount = format!(
             "type=bind,src={},dst={}",
             mount_source.to_string_lossy(),
@@ -80,9 +74,7 @@ impl ContainerSession {
             .map_err(|e| Error::ContainerStartFailed { source: e })?;
         if !output.status.success() {
             return Err(Error::ContainerStartFailed {
-                source: std::io::Error::other(
-                    String::from_utf8_lossy(&output.stderr).into_owned(),
-                ),
+                source: std::io::Error::other(String::from_utf8_lossy(&output.stderr).into_owned()),
             });
         }
         let container_id = String::from_utf8_lossy(&output.stdout).trim().to_string();
@@ -128,8 +120,7 @@ mod tests {
         let dir = tempfile::tempdir().expect("tempdir");
         let context = dir.path();
         let dockerfile = context.join("Dockerfile");
-        fs_err::write(&dockerfile, "FROM alpine:3.19\nRUN echo built\n")
-            .expect("write Dockerfile");
+        fs_err::write(&dockerfile, "FROM alpine:3.19\nRUN echo built\n").expect("write Dockerfile");
 
         let tag = "quire-ci/test-task5:test";
         docker_build(&dockerfile, context, tag).expect("build should succeed");
@@ -169,7 +160,12 @@ mod tests {
 
         assert!(!session.container_id.is_empty());
         // Docker container IDs from `docker run` are 64-char SHA256 hex.
-        assert_eq!(session.container_id.len(), 64, "got: {}", session.container_id);
+        assert_eq!(
+            session.container_id.len(),
+            64,
+            "got: {}",
+            session.container_id
+        );
         // session drops here; docker stop runs.
     }
 
diff --git a/src/ci/run.rs b/src/ci/run.rs
index 1fcb1cc..11c933a 100644
--- a/src/ci/run.rs
+++ b/src/ci/run.rs
@@ -629,11 +629,7 @@ fn repo_segment(base: &Path) -> String {
 
 /// Materialize a working tree at `sha` into `workspace` via
 /// `git archive | tar -x`. Creates the workspace dir if needed.
-pub fn materialize_workspace(
-    git_dir: &Path,
-    sha: &str,
-    workspace: &Path,
-) -> Result<()> {
+pub fn materialize_workspace(git_dir: &Path, sha: &str, workspace: &Path) -> Result<()> {
     use std::process::{Command, Stdio};
 
     fs_err::create_dir_all(workspace)?;
@@ -1661,7 +1657,10 @@ mod tests {
     #[test]
     fn repo_segment_returns_final_component() {
         assert_eq!(repo_segment(Path::new("runs/test.git")), "test.git");
-        assert_eq!(repo_segment(Path::new("/var/lib/quire/runs/repo.git")), "repo.git");
+        assert_eq!(
+            repo_segment(Path::new("/var/lib/quire/runs/repo.git")),
+            "repo.git"
+        );
         assert_eq!(repo_segment(Path::new("")), "repo");
     }
 
@@ -1673,7 +1672,10 @@ mod tests {
         // Uppercase is rejected; lowercase fine.
         assert_eq!(repo_segment(Path::new("MyRepo.git")), "myrepo.git");
         // Other invalid characters become underscores.
-        assert_eq!(repo_segment(Path::new("repo with spaces")), "repo_with_spaces");
+        assert_eq!(
+            repo_segment(Path::new("repo with spaces")),
+            "repo_with_spaces"
+        );
     }
 
     #[test]
@@ -1706,11 +1708,8 @@ mod tests {
             assert!(out.status.success());
         }
         fs_err::create_dir_all(src_repo.join(".quire")).expect("mkdir .quire");
-        fs_err::write(
-            src_repo.join(".quire/Dockerfile"),
-            "FROM alpine:3.19\n",
-        )
-        .expect("write Dockerfile");
+        fs_err::write(src_repo.join(".quire/Dockerfile"), "FROM alpine:3.19\n")
+            .expect("write Dockerfile");
         for cmd in [vec!["add", "."], vec!["commit", "-m", "initial"]] {
             let out = std::process::Command::new("git")
                 .args(&cmd)