diff --git a/.github/workflows/pr_pre-commit.yaml b/.github/workflows/pr_pre-commit.yaml
index ec55fe78..bdc3ddfd 100644
--- a/.github/workflows/pr_pre-commit.yaml
+++ b/.github/workflows/pr_pre-commit.yaml
@@ -6,7 +6,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  RUST_TOOLCHAIN_VERSION: "1.82.0"
+  RUST_TOOLCHAIN_VERSION: "nightly-2025-01-15"
   HADOLINT_VERSION: "v2.12.0"
   PYTHON_VERSION: "3.12"
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index a36fdcb7..c5bd8ad1 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -17,10 +17,6 @@ repos:
   - repo: https://github.com/doublify/pre-commit-rust
     rev: eeee35a89e69d5772bdee97db1a6a898467b686e # 1.0
     hooks:
-      - id: fmt
-        # Pinning to a specific rustc version, so that we get consistent formatting
-        entry: RUSTUP_TOOLCHAIN=nightly-2025-01-15 cargo fmt
-        args: ["--all", "--", "--check"]
       - id: clippy
         args: ["--all-targets", "--", "-D", "warnings"]
 
@@ -78,3 +74,10 @@ repos:
         entry: cargo test
         stages: [pre-commit, pre-merge-commit, manual]
         pass_filenames: false
+
+      - id: cargo-rustfmt
+        name: cargo-rustfmt
+        language: system
+        entry: cargo +nightly-2025-01-15 fmt --all -- --check
+        stages: [pre-commit]
+        pass_filenames: false
diff --git a/Cargo.lock b/Cargo.lock
index 6a7e97f3..1690d07f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1563,9 +1563,9 @@ checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
 
 [[package]]
 name = "openssl"
-version = "0.10.68"
+version = "0.10.70"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6174bc48f102d208783c2c84bf931bb75927a617866870de8a4ea85597f871f5"
+checksum = "61cfb4e166a8bb8c9b55c500bc2308550148ece889be90f609377e58140f42c6"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -1595,9 +1595,9 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.104"
+version = "0.9.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45abf306cbf99debc8195b66b7346498d7b10c210de50418b5ccd7ceba08c741"
+checksum = "8b22d5b84be05a8d6947c7cb71f7c849aa0f112acd4bf51c2a7c1c988ac0a9dc"
 dependencies = [
  "cc",
  "libc",
diff --git a/rust/crd/src/affinity.rs b/rust/crd/src/affinity.rs
index 275d10bd..c7b688af 100644
--- a/rust/crd/src/affinity.rs
+++ b/rust/crd/src/affinity.rs
@@ -76,12 +76,9 @@ pub fn get_affinity(
 
 #[cfg(test)]
 mod tests {
-    use super::*;
-
-    use rstest::rstest;
     use std::collections::BTreeMap;
 
-    use crate::DruidCluster;
+    use rstest::rstest;
     use stackable_operator::{
         commons::affinity::StackableAffinity,
         k8s_openapi::{
@@ -92,6 +89,9 @@ mod tests {
         },
     };
 
+    use super::*;
+    use crate::DruidCluster;
+
     #[rstest]
     #[case(DruidRole::Coordinator)]
     #[case(DruidRole::Broker)]
diff --git a/rust/crd/src/authentication.rs b/rust/crd/src/authentication.rs
index 537a3b22..2f69c180 100644
--- a/rust/crd/src/authentication.rs
+++ b/rust/crd/src/authentication.rs
@@ -232,19 +232,14 @@ impl AuthenticationClassesResolved {
 
 #[cfg(test)]
 mod tests {
-    use indoc::formatdoc;
-    use oidc::ClientAuthenticationOptions;
-
-    use crate::DruidClusterConfig;
-
     use std::pin::Pin;
 
-    use indoc::indoc;
+    use indoc::{formatdoc, indoc};
+    use oidc::ClientAuthenticationOptions;
     use stackable_operator::kube;
 
     use super::*;
-
-    use crate::authentication::AuthenticationClassesResolved;
+    use crate::{authentication::AuthenticationClassesResolved, DruidClusterConfig};
 
     const BASE_CLUSTER_CONFIG: &str = r#"
 deepStorage:
diff --git a/rust/crd/src/lib.rs b/rust/crd/src/lib.rs
index 84a2be00..73d5a978 100644
--- a/rust/crd/src/lib.rs
+++ b/rust/crd/src/lib.rs
@@ -7,12 +7,7 @@ pub mod security;
 pub mod storage;
 pub mod tls;
 
-use crate::{
-    affinity::get_affinity,
-    authorization::DruidAuthorization,
-    resource::RoleResource,
-    tls::{default_druid_tls, DruidTls},
-};
+use std::collections::{BTreeMap, HashMap, HashSet};
 
 use indoc::formatdoc;
 use product_config::types::PropertyNameKind;
@@ -55,9 +50,15 @@ use stackable_operator::{
         COMMON_BASH_TRAP_FUNCTIONS,
     },
 };
-use std::collections::{BTreeMap, HashMap, HashSet};
 use strum::{Display, EnumDiscriminants, EnumIter, EnumString, IntoStaticStr};
 
+use crate::{
+    affinity::get_affinity,
+    authorization::DruidAuthorization,
+    resource::RoleResource,
+    tls::{default_druid_tls, DruidTls},
+};
+
 pub const APP_NAME: &str = "druid";
 pub const OPERATOR_NAME: &str = "druid.stackable.tech";
 
diff --git a/rust/crd/src/memory.rs b/rust/crd/src/memory.rs
index b4fb005c..69042c52 100644
--- a/rust/crd/src/memory.rs
+++ b/rust/crd/src/memory.rs
@@ -167,9 +167,10 @@ fn format_for_druid(memory_quantity: &MemoryQuantity) -> String {
 
 #[cfg(test)]
 mod tests {
-    use super::*;
     use rstest::*;
 
+    use super::*;
+
     #[rstest]
     #[case(1000, 1)]
     #[case(1400, 1)]
diff --git a/rust/crd/src/resource.rs b/rust/crd/src/resource.rs
index f122a566..eda0fcb4 100644
--- a/rust/crd/src/resource.rs
+++ b/rust/crd/src/resource.rs
@@ -1,13 +1,8 @@
-use std::collections::BTreeMap;
-use std::sync::LazyLock;
+use std::{collections::BTreeMap, sync::LazyLock};
 
-use crate::memory::{HistoricalDerivedSettings, RESERVED_OS_MEMORY};
-use crate::storage::{self, default_free_percentage_empty_dir_fragment};
-use crate::{DruidRole, PATH_SEGMENT_CACHE, PROP_SEGMENT_CACHE_LOCATIONS};
 use snafu::{OptionExt, ResultExt, Snafu};
-use stackable_operator::builder;
-use stackable_operator::memory::MemoryQuantity;
 use stackable_operator::{
+    builder,
     builder::pod::{container::ContainerBuilder, volume::VolumeBuilder, PodBuilder},
     commons::resources::{
         CpuLimitsFragment, MemoryLimits, MemoryLimitsFragment, NoRuntimeLimits,
@@ -17,9 +12,16 @@ use stackable_operator::{
         api::core::v1::{EmptyDirVolumeSource, ResourceRequirements},
         apimachinery::pkg::api::resource::Quantity,
     },
+    memory::MemoryQuantity,
 };
 use strum::{EnumDiscriminants, IntoStaticStr};
 
+use crate::{
+    memory::{HistoricalDerivedSettings, RESERVED_OS_MEMORY},
+    storage::{self, default_free_percentage_empty_dir_fragment},
+    DruidRole, PATH_SEGMENT_CACHE, PROP_SEGMENT_CACHE_LOCATIONS,
+};
+
 // volume names
 const SEGMENT_CACHE_VOLUME_NAME: &str = "segment-cache";
 
@@ -242,13 +244,6 @@ pub static ROUTER_RESOURCES: LazyLock<ResourcesFragment<storage::DruidStorage, N
 
 #[cfg(test)]
 mod test {
-    use super::*;
-    use crate::{
-        storage::{default_free_percentage_empty_dir, HistoricalStorage},
-        tests::deserialize_yaml_file,
-        DruidCluster, MiddleManagerConfig,
-    };
-
     use rstest::*;
     use stackable_operator::{
         commons::resources::{
@@ -259,6 +254,13 @@ mod test {
         role_utils::{CommonConfiguration, RoleGroup},
     };
 
+    use super::*;
+    use crate::{
+        storage::{default_free_percentage_empty_dir, HistoricalStorage},
+        tests::deserialize_yaml_file,
+        DruidCluster, MiddleManagerConfig,
+    };
+
     #[rstest]
     #[case(
         Some(ResourcesFragment{
diff --git a/rust/crd/src/security.rs b/rust/crd/src/security.rs
index 627f0277..bcac14f6 100644
--- a/rust/crd/src/security.rs
+++ b/rust/crd/src/security.rs
@@ -1,8 +1,5 @@
-use crate::{
-    authentication::{self, AuthenticationClassesResolved},
-    DruidCluster, DruidRole, METRICS_PORT,
-};
-use crate::{STACKABLE_TRUST_STORE, STACKABLE_TRUST_STORE_PASSWORD};
+use std::collections::BTreeMap;
+
 use snafu::{ResultExt, Snafu};
 use stackable_operator::{
     builder::{
@@ -23,7 +20,10 @@ use stackable_operator::{
     time::Duration,
 };
 
-use std::collections::BTreeMap;
+use crate::{
+    authentication::{self, AuthenticationClassesResolved},
+    DruidCluster, DruidRole, METRICS_PORT, STACKABLE_TRUST_STORE, STACKABLE_TRUST_STORE_PASSWORD,
+};
 
 #[derive(Snafu, Debug)]
 pub enum Error {
diff --git a/rust/crd/src/storage.rs b/rust/crd/src/storage.rs
index a081bf0d..7b2ca280 100644
--- a/rust/crd/src/storage.rs
+++ b/rust/crd/src/storage.rs
@@ -1,7 +1,7 @@
 use serde::{Deserialize, Serialize};
-use stackable_operator::k8s_openapi::apimachinery::pkg::api::resource::Quantity;
 use stackable_operator::{
     config::{fragment::Fragment, merge::Merge},
+    k8s_openapi::apimachinery::pkg::api::resource::Quantity,
     schemars::{self, JsonSchema},
 };
 
diff --git a/rust/crd/src/tls.rs b/rust/crd/src/tls.rs
index 03aee159..b6eef5c8 100644
--- a/rust/crd/src/tls.rs
+++ b/rust/crd/src/tls.rs
@@ -31,9 +31,10 @@ pub fn tls_default() -> Option<String> {
 
 #[cfg(test)]
 mod tests {
-    use crate::{tests::deserialize_yaml_str, tls::DruidTls, DruidClusterConfig};
     use indoc::formatdoc;
 
+    use crate::{tests::deserialize_yaml_str, tls::DruidTls, DruidClusterConfig};
+
     const BASE_DRUID_CONFIGURATION: &str = r#"
 deepStorage:
   hdfs:
diff --git a/rust/operator-binary/src/authentication/ldap.rs b/rust/operator-binary/src/authentication/ldap.rs
index ac8e37d9..75b1fd8f 100644
--- a/rust/operator-binary/src/authentication/ldap.rs
+++ b/rust/operator-binary/src/authentication/ldap.rs
@@ -1,15 +1,14 @@
 use std::collections::BTreeMap;
 
 use snafu::ResultExt;
+use stackable_druid_crd::security::{
+    add_cert_to_trust_store_cmd, STACKABLE_TLS_DIR, TLS_STORE_PASSWORD,
+};
 use stackable_operator::{
     builder::pod::{container::ContainerBuilder, PodBuilder},
     commons::authentication::ldap::AuthenticationProvider,
 };
 
-use stackable_druid_crd::security::{
-    add_cert_to_trust_store_cmd, STACKABLE_TLS_DIR, TLS_STORE_PASSWORD,
-};
-
 use crate::authentication::{
     AddLdapVolumesSnafu, ConstructLdapEndpointUrlSnafu, Error, MissingLdapBindCredentialsSnafu,
 };
diff --git a/rust/operator-binary/src/discovery.rs b/rust/operator-binary/src/discovery.rs
index 0100208b..0d51f562 100644
--- a/rust/operator-binary/src/discovery.rs
+++ b/rust/operator-binary/src/discovery.rs
@@ -1,8 +1,6 @@
 //! Discovery for Druid.  We make Druid discoverable by putting a connection string to the router service
 //! inside a config map.  We only provide a connection string to the router service, since it serves as
 //! a gateway to the cluster for client queries.
-use crate::DRUID_CONTROLLER_NAME;
-
 use snafu::{OptionExt, ResultExt, Snafu};
 use stackable_druid_crd::{
     build_recommended_labels, security::DruidTlsSecurity, DruidCluster, DruidRole,
@@ -15,6 +13,8 @@ use stackable_operator::{
     utils::cluster_info::KubernetesClusterInfo,
 };
 
+use crate::DRUID_CONTROLLER_NAME;
+
 #[derive(Snafu, Debug)]
 pub enum Error {
     #[snafu(display("object {} is missing metadata to build owner reference", druid))]
diff --git a/rust/operator-binary/src/druid_controller.rs b/rust/operator-binary/src/druid_controller.rs
index 0715680b..afeee097 100644
--- a/rust/operator-binary/src/druid_controller.rs
+++ b/rust/operator-binary/src/druid_controller.rs
@@ -1334,12 +1334,12 @@ pub fn error_policy(
 
 #[cfg(test)]
 mod test {
-    use super::*;
-
     use product_config::{writer, ProductConfigManager};
     use rstest::*;
     use stackable_druid_crd::PROP_SEGMENT_CACHE_LOCATIONS;
 
+    use super::*;
+
     #[derive(Snafu, Debug, EnumDiscriminants)]
     #[strum_discriminants(derive(IntoStaticStr))]
     #[allow(clippy::enum_variant_names)]
diff --git a/rust/operator-binary/src/internal_secret.rs b/rust/operator-binary/src/internal_secret.rs
index 677b5d41..64066b75 100644
--- a/rust/operator-binary/src/internal_secret.rs
+++ b/rust/operator-binary/src/internal_secret.rs
@@ -1,12 +1,15 @@
+use std::collections::{BTreeMap, HashSet};
+
 use snafu::{OptionExt, ResultExt, Snafu};
-use stackable_druid_crd::security::INTERNAL_INITIAL_CLIENT_PASSWORD_ENV;
-use stackable_druid_crd::{DruidCluster, COOKIE_PASSPHRASE_ENV};
-use stackable_operator::k8s_openapi::api::core::v1::{EnvVar, EnvVarSource, SecretKeySelector};
-use stackable_operator::kube::ResourceExt;
+use stackable_druid_crd::{
+    security::INTERNAL_INITIAL_CLIENT_PASSWORD_ENV, DruidCluster, COOKIE_PASSPHRASE_ENV,
+};
 use stackable_operator::{
-    builder::meta::ObjectMetaBuilder, client::Client, k8s_openapi::api::core::v1::Secret,
+    builder::meta::ObjectMetaBuilder,
+    client::Client,
+    k8s_openapi::api::core::v1::{EnvVar, EnvVarSource, Secret, SecretKeySelector},
+    kube::ResourceExt,
 };
-use std::collections::{BTreeMap, HashSet};
 use strum::{EnumDiscriminants, IntoStaticStr};
 
 #[derive(Snafu, Debug, EnumDiscriminants)]
diff --git a/rust/operator-binary/src/main.rs b/rust/operator-binary/src/main.rs
index b22a760c..41dd5cad 100644
--- a/rust/operator-binary/src/main.rs
+++ b/rust/operator-binary/src/main.rs
@@ -13,10 +13,8 @@ use clap::{crate_description, crate_version, Parser};
 use druid_controller::{DRUID_CONTROLLER_NAME, FULL_CONTROLLER_NAME};
 use futures::StreamExt;
 use stackable_druid_crd::{DruidCluster, APP_NAME, OPERATOR_NAME};
-use stackable_operator::CustomResourceExt;
 use stackable_operator::{
-    cli::Command,
-    cli::ProductOperatorRun,
+    cli::{Command, ProductOperatorRun},
     k8s_openapi::api::{
         apps::v1::StatefulSet,
         core::v1::{ConfigMap, Service},
@@ -29,6 +27,7 @@ use stackable_operator::{
         },
     },
     logging::controller::report_controller_reconciled,
+    CustomResourceExt,
 };
 
 mod built_info {
diff --git a/rust/operator-binary/src/operations/graceful_shutdown.rs b/rust/operator-binary/src/operations/graceful_shutdown.rs
index eabd1e8f..046be7dd 100644
--- a/rust/operator-binary/src/operations/graceful_shutdown.rs
+++ b/rust/operator-binary/src/operations/graceful_shutdown.rs
@@ -1,10 +1,9 @@
 use indoc::formatdoc;
 use snafu::{ResultExt, Snafu};
-use stackable_druid_crd::security::DruidTlsSecurity;
-use stackable_druid_crd::DruidRole;
-use stackable_operator::k8s_openapi::api::core::v1::{ExecAction, LifecycleHandler};
+use stackable_druid_crd::{security::DruidTlsSecurity, DruidRole};
 use stackable_operator::{
     builder::pod::{container::ContainerBuilder, PodBuilder},
+    k8s_openapi::api::core::v1::{ExecAction, LifecycleHandler},
     time::Duration,
 };