diff --git a/default.nix b/default.nix
index bebe7a05..945cf92f 100644
--- a/default.nix
+++ b/default.nix
@@ -9,7 +9,9 @@ let
   pre-commit-check =
     (import "${git-hooks}/nix" {
       inherit nixpkgs system;
-      gitignore-nix-src = gitignore;
+      gitignore-nix-src = {
+        lib = import gitignore { inherit lib; };
+      };
     }).run
       {
         src = ./.;
@@ -18,7 +20,7 @@ let
             ## Add a directory here if pre-commit hooks shouldn't apply to it.
             optout = [
               "npins"
-              "**/.terraform"
+              ".terraform"
             ];
             excludes = map (dir: "^${dir}/") optout;
             addExcludes = lib.mapAttrs (_: c: c // { inherit excludes; });
@@ -36,6 +38,9 @@ in
   shell = pkgs.mkShellNoCC {
     inherit (pre-commit-check) shellHook;
     buildInputs = pre-commit-check.enabledPackages;
+    packages = [
+      pkgs.nixfmt-rfc-style
+    ];
   };
 
   tests = {
diff --git a/infra/TODO.md b/infra/TODO.md
index 21d477a0..2ea93f86 100644
--- a/infra/TODO.md
+++ b/infra/TODO.md
@@ -13,7 +13,5 @@ refactor:
 
 test:
 - services tests
-- root test
-- root hook
 - secret shell
 - ci