diff --git a/flake.nix b/flake.nix
index 62c4f44..cac3686 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,6 +2,7 @@
   description = "NixOS configuration";
 
   inputs = {
+    # keep-sorted start block=yes
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     home-manager = {
       url = "github:nix-community/home-manager";
@@ -17,6 +18,7 @@
     };
     copyparty.url = "github:9001/copyparty";
     vscode-server.url = "github:nix-community/nixos-vscode-server";
+    # keep-sorted end
   };
 
   outputs =
diff --git a/hosts/desktop/configuration.nix b/hosts/desktop/configuration.nix
index 853c97b..20c467d 100644
--- a/hosts/desktop/configuration.nix
+++ b/hosts/desktop/configuration.nix
@@ -1,7 +1,4 @@
 {
-  pkgs,
-  hostName,
-  inputs,
   userName,
   ...
 }:
@@ -13,12 +10,14 @@
 
   # reusable modules
 
+  # keep-sorted start
   amd-gpu.enable = true;
   desktop.enable = true;
   external-speakers.enable = true;
   gaming.enable = true;
   link2c.enable = true;
   plasma.enable = true;
+  # keep-sorted end
 
   # config
 
@@ -33,10 +32,12 @@
 
   users.users.${userName} = {
     extraGroups = [
+      # keep-sorted start
       "networkmanager"
       "wheel"
       "scanner"
       "lp"
+      # keep-sorted end
     ];
     isNormalUser = true;
   };
diff --git a/hosts/desktop/home.nix b/hosts/desktop/home.nix
index 46cda65..b3e04b4 100644
--- a/hosts/desktop/home.nix
+++ b/hosts/desktop/home.nix
@@ -7,7 +7,9 @@
 
   # reusable modules
 
+  # keep-sorted start
   desktop.enable = true;
+  # keep-sorted end 
 
   # config
 
diff --git a/hosts/laptop/configuration.nix b/hosts/laptop/configuration.nix
index eb3d930..df774d4 100644
--- a/hosts/laptop/configuration.nix
+++ b/hosts/laptop/configuration.nix
@@ -1,7 +1,4 @@
 {
-  pkgs,
-  hostName,
-  inputs,
   userName,
   ...
 }:
@@ -13,14 +10,17 @@
 
   # reusable modules
 
+  # keep-sorted start
   amd-gpu.enable = true;
   desktop.enable = true;
   gnome.enable = true;
   tlp.enable = true;
+  # keep-sorted end
 
   # config
 
-  boot.initrd.luks.devices."luks-a7726a9d-535f-44bc-9c0e-adc501fad371".device = "/dev/disk/by-uuid/a7726a9d-535f-44bc-9c0e-adc501fad371";
+  boot.initrd.luks.devices."luks-a7726a9d-535f-44bc-9c0e-adc501fad371".device =
+    "/dev/disk/by-uuid/a7726a9d-535f-44bc-9c0e-adc501fad371";
 
   system.stateVersion = "24.11";
 
@@ -28,10 +28,12 @@
 
   users.users.${userName} = {
     extraGroups = [
+      # keep-sorted start
       "networkmanager"
       "wheel"
       "scanner"
       "lp"
+      # keep-sorted end
     ];
     isNormalUser = true;
   };
diff --git a/hosts/laptop/home.nix b/hosts/laptop/home.nix
index 46cda65..d79d582 100644
--- a/hosts/laptop/home.nix
+++ b/hosts/laptop/home.nix
@@ -7,7 +7,9 @@
 
   # reusable modules
 
+  # keep-sorted start
   desktop.enable = true;
+  # keep-sorted end
 
   # config
 
diff --git a/hosts/server/configuration.nix b/hosts/server/configuration.nix
index dfc2220..ab2bb69 100644
--- a/hosts/server/configuration.nix
+++ b/hosts/server/configuration.nix
@@ -1,7 +1,5 @@
 {
-  pkgs,
   hostName,
-  inputs,
   userName,
   ...
 }:
@@ -13,9 +11,11 @@
 
   # reusable modules
 
+  # keep-sorted start
   borgbackup-srv.enable = true;
   intel-gpu.enable = true;
   server.enable = true;
+  # keep-sorted end
 
   # config
 
@@ -29,8 +29,10 @@
     groups.${userName} = { };
     users.${userName} = {
       extraGroups = [
+        # keep-sorted start
         "wheel"
         "docker"
+        # keep-sorted end
       ];
       home = "/home/srv";
       isNormalUser = true;
diff --git a/modules/home-manager/bundles/desktop.nix b/modules/home-manager/bundles/desktop.nix
index c79a269..8b8dcb3 100644
--- a/modules/home-manager/bundles/desktop.nix
+++ b/modules/home-manager/bundles/desktop.nix
@@ -1,12 +1,18 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   feature = "desktop";
 in
 {
   config = lib.mkIf config.${feature}.enable {
+    # keep-sorted start
     kitty.enable = true;
     obsidian.enable = true;
     zellij.enable = true;
+    # keep-sorted end
   };
 
   imports = [ ];
diff --git a/modules/home-manager/default.nix b/modules/home-manager/default.nix
index 6d115f3..17d31ee 100644
--- a/modules/home-manager/default.nix
+++ b/modules/home-manager/default.nix
@@ -7,6 +7,7 @@ in
 {
   imports = (featureBundler ./bundles) ++ (featureBundler ./features);
 
+  # keep-sorted start
   bat.enable = lib.mkDefault true;
   direnv.enable = lib.mkDefault true;
   eza.enable = lib.mkDefault true;
@@ -16,4 +17,5 @@ in
   starship.enable = lib.mkDefault true;
   yazi.enable = lib.mkDefault true;
   zoxide.enable = lib.mkDefault true;
+  # keep-sorted end
 }
diff --git a/modules/home-manager/features/bat.nix b/modules/home-manager/features/bat.nix
index d24c674..30d5324 100644
--- a/modules/home-manager/features/bat.nix
+++ b/modules/home-manager/features/bat.nix
@@ -1,6 +1,5 @@
 {
   config,
-  pkgs,
   lib,
   ...
 }:
diff --git a/modules/home-manager/features/eza.nix b/modules/home-manager/features/eza.nix
index 733bb88..643ba8b 100644
--- a/modules/home-manager/features/eza.nix
+++ b/modules/home-manager/features/eza.nix
@@ -1,4 +1,8 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   feature = "eza";
 in
diff --git a/modules/home-manager/features/fish.nix b/modules/home-manager/features/fish.nix
index 3c31aaf..cfbf059 100644
--- a/modules/home-manager/features/fish.nix
+++ b/modules/home-manager/features/fish.nix
@@ -16,6 +16,7 @@ in
         set fish_greeting
       '';
       shellAliases = {
+        # keep-sorted start
         cat = "bat";
         cd = "j";
         g = "lazygit";
@@ -25,6 +26,7 @@ in
         ns = "nh os switch";
         vi = "nvim";
         vim = "nvim";
+        # keep-sorted end
       };
     };
 
diff --git a/modules/home-manager/features/git.nix b/modules/home-manager/features/git.nix
index e5c125b..1f8dbd5 100644
--- a/modules/home-manager/features/git.nix
+++ b/modules/home-manager/features/git.nix
@@ -20,6 +20,7 @@ in
       userEmail = "83637728+wi11-holdsworth@users.noreply.github.com";
 
       aliases = {
+        # keep-sorted start
         a = "add";
         aa = "add .";
         ap = "add -p";
@@ -36,6 +37,7 @@ in
         cob = "checkout -b";
         ps = "push";
         pl = "pull";
+        # keep-sorted end
       };
 
       extraConfig = {
diff --git a/modules/home-manager/features/obsidian.nix b/modules/home-manager/features/obsidian.nix
index 98c9046..54e2b90 100644
--- a/modules/home-manager/features/obsidian.nix
+++ b/modules/home-manager/features/obsidian.nix
@@ -25,6 +25,7 @@ in
           showRibbon = false;
         };
         communityPlugins = [
+          # keep-sorted start
           "obsidian-livesync"
           "oz-clear-unused-images"
           "obsidian-editor-shortcuts"
@@ -33,8 +34,10 @@ in
           "pdf-plus"
           "obsidian-excalidraw-plugin"
           "obsidian-relative-line-numbers"
+          # keep-sorted end
         ];
         corePlugins = [
+          # keep-sorted start
           "backlink"
           "bases"
           "bookmarks"
@@ -61,6 +64,7 @@ in
           "word-count"
           "workspaces"
           "zk-prefixer"
+          # keep-sorted end
         ];
         hotkeys = {
           "editor:swap-line-down" = [
diff --git a/modules/home-manager/features/yazi.nix b/modules/home-manager/features/yazi.nix
index 6121407..ff00bce 100644
--- a/modules/home-manager/features/yazi.nix
+++ b/modules/home-manager/features/yazi.nix
@@ -12,6 +12,7 @@ in
     programs.yazi = {
       enable = true;
       plugins = {
+        # keep-sorted start
         diff = pkgs.yaziPlugins.diff;
         git = pkgs.yaziPlugins.git;
         mediainfo = pkgs.yaziPlugins.mediainfo;
@@ -23,9 +24,8 @@ in
         starship = pkgs.yaziPlugins.starship;
         vcs-files = pkgs.yaziPlugins.vcs-files;
         yatline-githead = pkgs.yaziPlugins.yatline-githead;
+        # keep-sorted end 
       };
-      # flavors = {};
-      # themes = {};
     };
   };
 
diff --git a/modules/nixos/bundles/desktop.nix b/modules/nixos/bundles/desktop.nix
index 03a9da7..ad532ac 100644
--- a/modules/nixos/bundles/desktop.nix
+++ b/modules/nixos/bundles/desktop.nix
@@ -14,14 +14,15 @@ in
     print-and-scan.enable = true;
 
     environment.systemPackages = with pkgs; [
+      # keep-sorted start
       beeper
       brave
       calibre
       cameractrls-gtk3
       jellyfin-media-player
-      # TODO: break out into separate configuration module
       onlyoffice-desktopeditors
       sleek-todo
+      # keep-sorted end
     ];
   };
 
diff --git a/modules/nixos/bundles/dev.nix b/modules/nixos/bundles/dev.nix
index 13a444f..559a1e8 100644
--- a/modules/nixos/bundles/dev.nix
+++ b/modules/nixos/bundles/dev.nix
@@ -13,16 +13,15 @@ in
       with pkgs;
       (
         [
-          # general
+          # keep-sorted start
           devenv
           just
           mask
           vscode
-
-          # rust
           bacon
           cargo-info
           rusty-man
+          # keep-sorted end
         ]
         ++ (with jetbrains; [
           rider
diff --git a/modules/nixos/bundles/server.nix b/modules/nixos/bundles/server.nix
index 5f3ca48..df5c524 100644
--- a/modules/nixos/bundles/server.nix
+++ b/modules/nixos/bundles/server.nix
@@ -4,6 +4,7 @@ let
 in
 {
   config = lib.mkIf config.${feature}.enable {
+    # keep-sorted start
     couchdb.enable = true;
     copyparty.enable = true;
     flaresolverr.enable = true;
@@ -22,6 +23,7 @@ in
     qbittorrent.enable = true;
     vaultwarden.enable = true;
     vscode-server.enable = true;
+    # keep-sorted end
 
     users.groups.media = { };
   };
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index 32e1386..f62c5b9 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -24,8 +24,8 @@ in
   systemd-boot.enable = lib.mkDefault true;
   tailscale.enable = lib.mkDefault true;
 
-  # cli utils
   environment.systemPackages = with pkgs; [
+    # keep-sorted start
     dua # disk use analyser
     fd # find
     hyperfine # benchmarking tool
@@ -38,5 +38,6 @@ in
     ripunzip
     wiki-tui # wikipedia tui
     xh # curl
+    # keep-sorted end
   ];
 }
diff --git a/modules/nixos/features/copyparty.nix b/modules/nixos/features/copyparty.nix
index 580b7f1..8f204ac 100644
--- a/modules/nixos/features/copyparty.nix
+++ b/modules/nixos/features/copyparty.nix
@@ -2,7 +2,6 @@
   config,
   lib,
   inputs,
-  pkgs,
   ...
 }:
 let
diff --git a/modules/nixos/features/gaming.nix b/modules/nixos/features/gaming.nix
index 6021dd0..0784b92 100644
--- a/modules/nixos/features/gaming.nix
+++ b/modules/nixos/features/gaming.nix
@@ -10,8 +10,8 @@ in
 {
   config = lib.mkIf config.${feature}.enable {
     environment.systemPackages = with pkgs; [
+      # keep-sorted start
       heroic
-      # TODO: break out into separate module
       lutris
       mangohud
       nexusmods-app
@@ -20,6 +20,7 @@ in
       wine64
       winetricks
       prismlauncher
+      # keep-sorted end 
     ];
 
     programs = {
diff --git a/modules/nixos/features/gnome.nix b/modules/nixos/features/gnome.nix
index 1922d14..3ab290a 100644
--- a/modules/nixos/features/gnome.nix
+++ b/modules/nixos/features/gnome.nix
@@ -17,6 +17,7 @@ in
     environment = {
       # https://discourse.nixos.org/t/howto-disable-most-gnome-default-applications-and-what-they-are/13505
       gnome.excludePackages = with pkgs; [
+        # keep-sorted start
         # baobab # disk usage analyzer
         # cheese # photo booth
         # eog # image viewer
@@ -29,8 +30,6 @@ in
         # file-roller # archive manager
         geary # email client
         seahorse # password manager
-
-        # these should be self explanatory
         gnome-calculator
         gnome-calendar
         gnome-characters
@@ -47,6 +46,7 @@ in
         gnome-weather
         # gnome-disk-utility
         gnome-connections
+        # keep-sorted end 
       ];
     };
   };
diff --git a/modules/nixos/features/homepage-dashboard.nix b/modules/nixos/features/homepage-dashboard.nix
index a3fd0de..7494d9e 100644
--- a/modules/nixos/features/homepage-dashboard.nix
+++ b/modules/nixos/features/homepage-dashboard.nix
@@ -21,6 +21,7 @@ let
     '');
 
   secrets = [
+    # keep-sorted start
     "immich"
     "jellyfin"
     "lidarr"
@@ -29,6 +30,7 @@ let
     "prowlarr"
     "radarr"
     "sonarr"
+    # keep-sorted end
   ];
 in
 {
@@ -40,6 +42,7 @@ in
         listenPort = lib.toInt port;
         allowedHosts = "homepage-dashboard.fi33.buzz";
         services = [
+          # keep-sorted start block=yes
           {
             "Media Management" = [
               {
@@ -217,6 +220,7 @@ in
               }
             ];
           }
+          # keep-sorted end
         ];
         settings = {
           title = "Mission Control";
diff --git a/modules/nixos/features/intel-gpu.nix b/modules/nixos/features/intel-gpu.nix
index 9ac8862..744eb0b 100644
--- a/modules/nixos/features/intel-gpu.nix
+++ b/modules/nixos/features/intel-gpu.nix
@@ -14,11 +14,13 @@ in
       graphics = {
         enable = true;
         extraPackages = with pkgs; [
+          # keep-sorted start 
           intel-media-driver
           libva-vdpau-driver
           intel-compute-runtime
           vpl-gpu-rt
           intel-ocl
+          # keep-sorted end 
         ];
       };
     };
diff --git a/modules/nixos/features/jellyfin.nix b/modules/nixos/features/jellyfin.nix
index c1d9abb..a16e1ca 100644
--- a/modules/nixos/features/jellyfin.nix
+++ b/modules/nixos/features/jellyfin.nix
@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  userName,
   ...
 }:
 let
diff --git a/modules/nixos/features/plasma.nix b/modules/nixos/features/plasma.nix
index ff1e054..3df312d 100644
--- a/modules/nixos/features/plasma.nix
+++ b/modules/nixos/features/plasma.nix
@@ -20,14 +20,18 @@ in
     environment.systemPackages =
       with pkgs.kdePackages;
       [
+        # keep-sorted start
         kontact
         ktorrent
         kget
         kzones
+        # keep-sorted end
       ]
       ++ (with pkgs; [
+        # keep-sorted start
         kile
         haruna
+        # keep-sorted end
       ]);
   };
 
diff --git a/modules/nixos/features/syncthing.nix b/modules/nixos/features/syncthing.nix
index 710b3e3..47612b5 100644
--- a/modules/nixos/features/syncthing.nix
+++ b/modules/nixos/features/syncthing.nix
@@ -10,6 +10,7 @@ let
   port = "5008";
 
   devicesList = [
+    # keep-sorted start block=yes
     {
       device = "desktop";
       id = "SKDADYB-DQVC2EG-BZ67OJR-DO25ZUR-URP2G5U-FXRNC65-OWPEKHN-STTRRQG";
@@ -26,6 +27,7 @@ let
       device = "server";
       id = "OP7EU3A-7A4CCMY-D4T3ND7-YWMRBNJ-KVE34FG-ZJQFSLS-WMLRWB4-FL2O7AZ";
     }
+    # keep-sorted end
   ];
 
   devices = builtins.listToAttrs (
diff --git a/modules/nixos/features/tlp.nix b/modules/nixos/features/tlp.nix
index 93ecd2e..5aa7d1f 100644
--- a/modules/nixos/features/tlp.nix
+++ b/modules/nixos/features/tlp.nix
@@ -11,11 +11,13 @@ in
       tlp = {
         enable = true;
         settings = {
+          # keep-sorted start
           CPU_BOOST_ON_AC = 1;
           CPU_BOOST_ON_BAT = 0;
           CPU_SCALING_GOVERNOR_ON_AC = "performance";
           CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
           STOP_CHARGE_THRESH_BAT0 = 95;
+          # keep-sorted end
         };
       };
     };
diff --git a/modules/nixos/features/vaultwarden.nix b/modules/nixos/features/vaultwarden.nix
index 52f971e..8991a90 100644
--- a/modules/nixos/features/vaultwarden.nix
+++ b/modules/nixos/features/vaultwarden.nix
@@ -1,6 +1,5 @@
 {
   config,
-  inputs,
   lib,
   ...
 }:
diff --git a/modules/templates/feature.nix b/modules/templates/feature.nix
index 688fbc0..eaec9f6 100644
--- a/modules/templates/feature.nix
+++ b/modules/templates/feature.nix
@@ -1,4 +1,8 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   feature = "replace";
 in
diff --git a/modules/templates/web-feature.nix b/modules/templates/web-feature.nix
index 3de66ae..837b1c6 100644
--- a/modules/templates/web-feature.nix
+++ b/modules/templates/web-feature.nix
@@ -1,4 +1,8 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   feature = "replace";
   port = "port";
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index a0f4184..0dd99b5 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -1,13 +1,18 @@
 let
+  # keep-sorted start
   srv = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOeV0NxqIGIXXgLYE6ntkHE4PARceZBp1FTI7kKLBbk8";
   will = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPHAnTQP77HQ/8nbf1oX7xftfKYtbH6MSh83wic0qdBy";
+  # keep-sorted end
   users = [
+    # keep-sorted start
     srv
     will
+    # keep-sorted end
   ];
 
 in
 {
+  # keep-sorted start
   "api-miniflux.age".publicKeys = users;
   "borgbackup-server-offsite.age".publicKeys = users;
   "borgbackup-server-onsite.age".publicKeys = users;
@@ -24,4 +29,5 @@ in
   "radicale.age".publicKeys = users;
   "sonarr.age".publicKeys = users;
   "vaultwarden-admin.age".publicKeys = users;
+  # keep-sorted end
 }