diff --git a/contrib/coverage.sh b/contrib/coverage.sh
index f301d0ca6..2fb142b7a 100755
--- a/contrib/coverage.sh
+++ b/contrib/coverage.sh
@@ -2,7 +2,7 @@
 set -e
 
 # https://github.com/taiki-e/cargo-llvm-cov?tab=readme-ov-file#merge-coverages-generated-under-different-test-conditions
-cargo llvm-cov clean --workspace # remove artifacts that may affect the coverage results
-cargo llvm-cov --no-report --workspace --all-features --exclude payjoin-ffi # exclude payjoin-ffi because bindings are tested in their native language
+cargo llvm-cov clean --workspace                                                                 # remove artifacts that may affect the coverage results
+cargo llvm-cov --no-report --workspace --all-features --exclude payjoin-ffi                      # exclude payjoin-ffi because bindings are tested in their native language
 cargo llvm-cov --no-report --package payjoin-cli --no-default-features --features=v1,_manual-tls # Explicitly run payjoin-cli v1 e2e tests
-cargo llvm-cov report --lcov --output-path lcov.info # generate report without tests
+cargo llvm-cov report --lcov --output-path lcov.info                                             # generate report without tests
diff --git a/contrib/test.sh b/contrib/test.sh
index 1f089e181..ed072b4eb 100755
--- a/contrib/test.sh
+++ b/contrib/test.sh
@@ -50,4 +50,3 @@ for dep in $DEPS; do
         )
     done
 done
-
diff --git a/flake.lock b/flake.lock
index 903d2f00f..249a29b5b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1755993354,
-        "narHash": "sha256-FCRRAzSaL/+umLIm3RU3O/+fJ2ssaPHseI2SSFL8yZU=",
+        "lastModified": 1764903584,
+        "narHash": "sha256-RSkJtNtx0SEaQiYqsoFoRynwfZLo2OZ9z6rUq1DJR6g=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "25bd41b24426c7734278c2ff02e53258851db914",
+        "rev": "2b3a5a88d852575758e1eb6ac9ee677fcd633fc1",
         "type": "github"
       },
       "original": {
@@ -35,16 +35,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1763334038,
-        "narHash": "sha256-LBVOyaH6NFzQ3X/c6vfMZ9k4SV2ofhpxeL9YnhHNJQQ=",
+        "lastModified": 1764983851,
+        "narHash": "sha256-y7RPKl/jJ/KAP/VKLMghMgXTlvNIJMHKskl8/Uuar7o=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4c8cdd5b1a630e8f72c9dd9bf582b1afb3127d2c",
+        "rev": "d9bc5c7dceb30d8d6fafa10aeb6aa8a48c218454",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -64,11 +64,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756434910,
-        "narHash": "sha256-5UJRyxZ8QCm+pgh5pNHXFJMmopMqHVraUhRA1g2AmA0=",
+        "lastModified": 1764902447,
+        "narHash": "sha256-wNqkDBj+tjK619sTHPEA7uhjr7DHHEY8OsFou31dxy0=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "86e5140961c91a9ee1dde1c17d18a787d44ceef8",
+        "rev": "d914a744a83098eeb28125d2848ad383b209223f",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index eb3320d05..b63a83c38 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "rust-payjoin";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     flake-utils.url = "github:numtide/flake-utils";
     rust-overlay = {
       url = "github:oxalica/rust-overlay";
@@ -11,38 +11,55 @@
     crane.url = "github:ipetkov/crane";
   };
 
-  outputs = {
-    self,
-    nixpkgs,
-    flake-utils,
-    rust-overlay,
-    crane,
-  }:
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      rust-overlay,
+      crane,
+    }:
     flake-utils.lib.eachDefaultSystem (
-      system: let
+      system:
+      let
         pkgs = import nixpkgs {
           inherit system;
-          overlays = [rust-overlay.overlays.default];
+          overlays = [ rust-overlay.overlays.default ];
         };
 
         msrv = "1.85.0";
-        rustVersions = with pkgs.rust-bin;
-          builtins.mapAttrs (_name: rust-bin:
-            rust-bin.override {
-              extensions = ["rust-src" "rustfmt" "llvm-tools-preview"];
-            })
-          {
-            msrv = stable.${msrv}.default;
-            stable = stable.latest.default;
-            nightly = nightly.latest.default;
-          };
+        rustVersions =
+          with pkgs.rust-bin;
+          builtins.mapAttrs
+            (
+              _name: rust-bin:
+              rust-bin.override {
+                extensions = [
+                  "rust-src"
+                  "rustfmt"
+                  "llvm-tools-preview"
+                ];
+              }
+            )
+            {
+              msrv = stable.${msrv}.default;
+              stable = stable.latest.default;
+              nightly = nightly.latest.default;
+            };
 
         # Use crane to define nix packages for the workspace crate
         # based on https://crane.dev/examples/quick-start-workspace.html
         # default to nightly rust toolchain in crane, mainly due to rustfmt difference
-        craneLibVersions = builtins.mapAttrs (name: rust-bin: (crane.mkLib pkgs).overrideToolchain (_: rust-bin)) rustVersions;
+        craneLibVersions = builtins.mapAttrs (
+          name: rust-bin: (crane.mkLib pkgs).overrideToolchain (_: rust-bin)
+        ) rustVersions;
         craneLib = craneLibVersions.nightly;
-        src = craneLib.cleanCargoSource ./.;
+        src = nixpkgs.lib.cleanSourceWith {
+          src = ./.;
+          filter =
+            path: type: (builtins.match ".*.udl" path != null) || (craneLib.filterCargoSources path type);
+          name = "source";
+        };
         commonArgs = {
           inherit src;
           strictDeps = true;
@@ -62,14 +79,13 @@
         };
 
         cargoArtifacts = craneLib.buildDepsOnly commonArgs;
-        individualCrateArgs =
-          commonArgs
-          // {
-            inherit cargoArtifacts;
-            doCheck = false; # skip testing, since that's done in flake check
-          };
+        individualCrateArgs = commonArgs // {
+          inherit cargoArtifacts;
+          doCheck = false; # skip testing, since that's done in flake check
+        };
 
-        fileSetForCrate = subdir:
+        fileSetForCrate =
+          subdir:
           pkgs.lib.fileset.toSource {
             root = ./.;
             fileset = pkgs.lib.fileset.unions [
@@ -79,111 +95,134 @@
           };
 
         packages =
-          builtins.mapAttrs (
-            name: extraArgs:
-              craneLib.buildPackage (individualCrateArgs
-                // craneLib.crateNameFromCargoToml {cargoToml = builtins.toPath "${./.}/${name}/Cargo.toml";}
+          builtins.mapAttrs
+            (
+              name: extraArgs:
+              craneLib.buildPackage (
+                individualCrateArgs
+                // craneLib.crateNameFromCargoToml { cargoToml = builtins.toPath "${./.}/${name}/Cargo.toml"; }
                 // {
                   cargoExtraArgs = "--locked -p ${name} ${extraArgs}";
                   inherit src;
-                })
-          ) {
-            "payjoin" = "--features v2";
-            "payjoin-cli" = "--features v1,v2";
-            "payjoin-directory" = "";
-          };
+                }
+              )
+            )
+            {
+              "payjoin" = "--features v2";
+              "payjoin-cli" = "--features v1,v2";
+              "payjoin-directory" = "";
+            };
 
-        devShells = builtins.mapAttrs (_name: craneLib:
+        devShells = builtins.mapAttrs (
+          _name: craneLib:
           craneLib.devShell {
-            packages = with pkgs; [
-              cargo-edit
-              cargo-nextest
-              cargo-watch
-              rust-analyzer
-              dart
-            ] ++ pkgs.lib.optionals (!pkgs.stdenv.isDarwin) [
-              cargo-llvm-cov
-            ];
-          })
-        craneLibVersions;
-
-        simpleCheck = args:
-          pkgs.stdenvNoCC.mkDerivation ({
+            packages =
+              with pkgs;
+              [
+                cargo-edit
+                cargo-nextest
+                cargo-watch
+                rust-analyzer
+                dart
+              ]
+              ++ pkgs.lib.optionals (!pkgs.stdenv.isDarwin) [
+                cargo-llvm-cov
+              ];
+          }
+        ) craneLibVersions;
+
+        simpleCheck =
+          args:
+          pkgs.stdenvNoCC.mkDerivation (
+            {
               doCheck = true;
               dontFixup = true;
               installPhase = "mkdir $out";
             }
-            // args);
-      in {
+            // args
+          );
+      in
+      {
         packages = packages;
-        devShells = devShells // {default = devShells.nightly;};
-        formatter = pkgs.alejandra;
-        checks =
-          packages
-          // {
-            payjoin-workspace-nextest = craneLib.cargoNextest (commonArgs
-              // {
-                inherit cargoArtifacts;
-                partitions = 1;
-                partitionType = "count";
-                # TODO also run integration tests
-                # this needs --all-features to enable io,_manual-tls features
-                # unfortunately this can't yet work because running docker inside the nix sandbox is not possible,
-                # which precludes use of the redis test container
-                # cargoExtraArgs = "--locked --all-features";
-                # buildInputs = [ pkgs.bitcoind ]; # not verified to work
-              });
-
-            payjoin-workspace-nextest-msrv = craneLibVersions.msrv.cargoNextest (commonArgs
-              // {
-                cargoArtifacts = craneLibVersions.msrv.buildDepsOnly commonArgs;
-                partitions = 1;
-                partitionType = "count";
-              });
-
-            payjoin-workspace-clippy = craneLib.cargoClippy (commonArgs
-              // {
-                inherit cargoArtifacts;
-                cargoClippyExtraArgs = "--all-targets --all-features --keep-going -- --deny warnings";
-              });
-
-            payjoin-workspace-doc = craneLib.cargoDoc (commonArgs
-              // {
-                inherit cargoArtifacts;
-              });
-
-            payjoin-workspace-fmt = craneLib.cargoFmt (commonArgs
-              // {
-                inherit src;
-              });
-
-            nix-fmt-check = simpleCheck {
-              name = "nix-fmt-check";
-              src = pkgs.lib.sources.sourceFilesBySuffices ./. [".nix"];
-              nativeBuildInputs = [pkgs.alejandra];
-              checkPhase = ''
-                alejandra -c .
-              '';
-            };
+        devShells = devShells // {
+          default = devShells.nightly;
+        };
+        formatter = pkgs.nixfmt-tree;
+        checks = packages // {
+          payjoin-workspace-nextest = craneLib.cargoNextest (
+            commonArgs
+            // {
+              inherit cargoArtifacts;
+              partitions = 1;
+              partitionType = "count";
+              cargoExtraArgs = "--locked --all-features";
+              BITCOIND_EXE = nixpkgs.lib.getExe' pkgs.bitcoind "bitcoind";
+            }
+          );
+
+          payjoin-workspace-nextest-msrv = craneLibVersions.msrv.cargoNextest (
+            commonArgs
+            // {
+              cargoArtifacts = craneLibVersions.msrv.buildDepsOnly commonArgs;
+              partitions = 1;
+              partitionType = "count";
+              cargoExtraArgs = "--locked --all-features";
+              BITCOIND_EXE = nixpkgs.lib.getExe' pkgs.bitcoind "bitcoind";
+            }
+          );
 
-            shfmt = simpleCheck rec {
-              name = "shell-checks";
-              src = pkgs.lib.sources.sourceFilesBySuffices ./. [".sh"];
-              nativeBuildInputs = [pkgs.shfmt];
-              checkPhase = ''
-                shfmt -d -s -i 4 -ci ${src}
-              '';
-            };
+          payjoin-workspace-clippy = craneLib.cargoClippy (
+            commonArgs
+            // {
+              inherit cargoArtifacts;
+              cargoClippyExtraArgs = "--all-targets --all-features --keep-going -- --deny warnings";
+            }
+          );
 
-            shellcheck = simpleCheck rec {
-              name = "shell-checks";
-              src = pkgs.lib.sources.sourceFilesBySuffices ./. [".sh"];
-              nativeBuildInputs = [pkgs.shellcheck];
-              checkPhase = ''
-                shellcheck -x ${src}
-              '';
-            };
+          payjoin-workspace-doc = craneLib.cargoDoc (
+            commonArgs
+            // {
+              inherit cargoArtifacts;
+            }
+          );
+
+          payjoin-workspace-fmt = craneLib.cargoFmt (
+            commonArgs
+            // {
+              inherit src;
+            }
+          );
+
+          nix-fmt-check = simpleCheck {
+            name = "nix-fmt-check";
+            src = pkgs.lib.sources.sourceFilesBySuffices ./. [ ".nix" ];
+            nativeBuildInputs = [ pkgs.nixfmt-tree ];
+            checkPhase = ''
+              treefmt --ci
+            '';
           };
+
+          shfmt = simpleCheck rec {
+            name = "shfmt";
+            src = pkgs.lib.sources.sourceFilesBySuffices ./. [ ".sh" ];
+            nativeBuildInputs = [ pkgs.shfmt ];
+            checkPhase = ''
+              shfmt -d -s -i 4 -ci ${src}
+            '';
+          };
+
+          shellcheck = simpleCheck rec {
+            name = "shellcheck";
+            src = pkgs.lib.sources.sourceFilesBySuffices ./. [ ".sh" ];
+            nativeBuildInputs = [
+              pkgs.shellcheck
+              pkgs.findutils
+            ];
+            checkPhase = ''
+              find "${src}" -name '*.sh' -print0 | xargs -0 shellcheck -x
+            '';
+          };
+        };
       }
     );
 }
diff --git a/payjoin-cli/contrib/lint.sh b/payjoin-cli/contrib/lint.sh
index 7e1d3fbe8..61dfb96d6 100755
--- a/payjoin-cli/contrib/lint.sh
+++ b/payjoin-cli/contrib/lint.sh
@@ -1,10 +1,10 @@
- #!/usr/bin/env bash
+#!/usr/bin/env bash
 set -e
 
 # Individual features with no defaults.
 features=("v1" "v2")
 
 for feature in "${features[@]}"; do
-  # Don't duplicate --all-targets clippy. Clilppy end-user code, not tests.
-  cargo clippy --no-default-features --features "$feature" -- -D warnings
+    # Don't duplicate --all-targets clippy. Clilppy end-user code, not tests.
+    cargo clippy --no-default-features --features "$feature" -- -D warnings
 done
diff --git a/payjoin-directory/contrib/health-check.sh b/payjoin-directory/contrib/health-check.sh
index e60c8b4bc..8bc0b554d 100644
--- a/payjoin-directory/contrib/health-check.sh
+++ b/payjoin-directory/contrib/health-check.sh
@@ -10,7 +10,7 @@ DIRECTORIES=(
 FAILED_DIRS=()
 
 for dir in "${DIRECTORIES[@]}"; do
-    if ! curl -sf --max-time "$TIMEOUT" "${dir}/health" > /dev/null 2>&1; then
+    if ! curl -sf --max-time "$TIMEOUT" "${dir}/health" >/dev/null 2>&1; then
         FAILED_DIRS+=("$dir")
     fi
 done
diff --git a/payjoin-ffi/contrib/lint.sh b/payjoin-ffi/contrib/lint.sh
index 87fbb66e7..3370b2e25 100755
--- a/payjoin-ffi/contrib/lint.sh
+++ b/payjoin-ffi/contrib/lint.sh
@@ -5,6 +5,6 @@ set -e
 features=("_manual-tls" "_test-utils")
 
 for feature in "${features[@]}"; do
-  # Don't duplicate --all-targets clippy. Clippy end-user code, not tests.
-  cargo clippy --no-default-features --features "$feature" -- -D warnings
+    # Don't duplicate --all-targets clippy. Clippy end-user code, not tests.
+    cargo clippy --no-default-features --features "$feature" -- -D warnings
 done
diff --git a/payjoin-ffi/contrib/test.sh b/payjoin-ffi/contrib/test.sh
index 4dcbb18d9..3a8468532 100755
--- a/payjoin-ffi/contrib/test.sh
+++ b/payjoin-ffi/contrib/test.sh
@@ -3,8 +3,8 @@ set -e
 
 RUST_VERSION=$(rustc --version | awk '{print $2}')
 
-if [[ ! "$RUST_VERSION" =~ ^1\.85\. ]]; then
-  cargo test --package payjoin-ffi --verbose --features=_manual-tls,_test-utils
+if [[ ! $RUST_VERSION =~ ^1\.85\. ]]; then
+    cargo test --package payjoin-ffi --verbose --features=_manual-tls,_test-utils
 else
-  echo "Skipping payjoin-ffi tests for Rust version $RUST_VERSION (MSRV)"
+    echo "Skipping payjoin-ffi tests for Rust version $RUST_VERSION (MSRV)"
 fi
diff --git a/payjoin-ffi/dart/scripts/generate_bindings.sh b/payjoin-ffi/dart/scripts/generate_bindings.sh
index c218da80f..1eae49889 100755
--- a/payjoin-ffi/dart/scripts/generate_bindings.sh
+++ b/payjoin-ffi/dart/scripts/generate_bindings.sh
@@ -8,9 +8,9 @@ dart --version
 dart pub get
 
 # Install Rust targets if on macOS
-if [[ "$OS" == "Darwin" ]]; then
+if [[ $OS == "Darwin" ]]; then
     LIBNAME=libpayjoin_ffi.dylib
-elif [[ "$OS" == "Linux" ]]; then
+elif [[ $OS == "Linux" ]]; then
     LIBNAME=libpayjoin_ffi.so
 else
     echo "Unsupported os: $OS"
diff --git a/payjoin-ffi/javascript/scripts/generate_bindings.sh b/payjoin-ffi/javascript/scripts/generate_bindings.sh
index 5f4ff7b5c..347c6ee67 100755
--- a/payjoin-ffi/javascript/scripts/generate_bindings.sh
+++ b/payjoin-ffi/javascript/scripts/generate_bindings.sh
@@ -6,7 +6,7 @@ echo "Running on $OS"
 
 npm --version
 
-if [[ "$OS" == "Darwin" ]]; then
+if [[ $OS == "Darwin" ]]; then
     # TODO: check if brew & llvm are installed
     LLVM_PREFIX=$(brew --prefix llvm)
     export AR="$LLVM_PREFIX/bin/llvm-ar"
diff --git a/payjoin-ffi/python/scripts/generate_bindings.sh b/payjoin-ffi/python/scripts/generate_bindings.sh
index 3de60ee75..69d560e34 100644
--- a/payjoin-ffi/python/scripts/generate_bindings.sh
+++ b/payjoin-ffi/python/scripts/generate_bindings.sh
@@ -6,9 +6,9 @@ OS=$(uname -s)
 echo "Running on $OS"
 
 # Install Rust targets if on macOS
-if [[ "$OS" == "Darwin" ]]; then
+if [[ $OS == "Darwin" ]]; then
     LIBNAME=libpayjoin_ffi.dylib
-elif [[ "$OS" == "Linux" ]]; then
+elif [[ $OS == "Linux" ]]; then
     LIBNAME=libpayjoin_ffi.so
 else
     echo "Unsupported os: $OS"
@@ -19,10 +19,10 @@ uv run python --version
 
 cd ../
 # This is a test script the actual release should not include the test utils feature
-cargo build --features _test-utils --profile dev 
+cargo build --features _test-utils --profile dev
 cargo run --features _test-utils --profile dev --bin uniffi-bindgen generate --library ../target/debug/$LIBNAME --language python --out-dir python/src/payjoin/
 
-if [[ "$OS" == "Darwin" ]]; then
+if [[ $OS == "Darwin" ]]; then
     echo "Generating native binaries..."
     rustup target add aarch64-apple-darwin x86_64-apple-darwin
     # This is a test script the actual release should not include the test utils feature
diff --git a/payjoin/contrib/lint.sh b/payjoin/contrib/lint.sh
index b4b451b13..5d1734132 100755
--- a/payjoin/contrib/lint.sh
+++ b/payjoin/contrib/lint.sh
@@ -5,6 +5,6 @@ set -e
 features=("v1" "v2" "directory")
 
 for feature in "${features[@]}"; do
-  # Don't duplicate --all-targets clippy. Clilppy end-user code, not tests.
-  cargo clippy --no-default-features --features "$feature" -- -D warnings
+    # Don't duplicate --all-targets clippy. Clilppy end-user code, not tests.
+    cargo clippy --no-default-features --features "$feature" -- -D warnings
 done