diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d9f994a..a697f9e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,5 +1,6 @@
-name: 'Validate DevContainer'
-description: 'This workflow is checking that updates do not break stuff. If on main branch, publish to "latest" tag.'
+---
+name: Validate DevContainer
+description: This workflow is checking that updates do not break stuff. If on main branch, publish to "latest" tag.
 on:
   pull_request:
   push:
@@ -17,13 +18,13 @@ jobs:
         os: [arm64, amd64]
         include:
           - os: amd64
-            name: 'DevContainer (amd64)'
+            name: DevContainer (amd64)
             runner: ubuntu-24.04
           - os: arm64
-            name: 'DevContainer (arm64)'
+            name: DevContainer (arm64)
             runner: ubuntu-24.04-arm
 
-    name: '${{ matrix.name }}'
+    name: ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
@@ -47,7 +48,7 @@ jobs:
         with:
           # The .devcontainer is never published as pre-built container.
           # We want to only use it for building and testing the actual container, which resides in src/s-core-devcontainer.
-          push: "never"
+          push: never
           runCmd: |
             set -eux pipefail
 
@@ -73,8 +74,8 @@ jobs:
             fi
 
   merge:
-    name: 'Merge Labels (main only)'
-    needs: ["build"]
+    name: Merge Labels (main only)
+    needs: [build]
     runs-on: ubuntu-24.04
     if: github.ref == 'refs/heads/main'
     permissions:
@@ -99,7 +100,7 @@ jobs:
         with:
           # The .devcontainer is never published as pre-built container.
           # We want to only use it for building and testing the actual container, which resides in src/s-core-devcontainer.
-          push: "never"
+          push: never
           runCmd: |
             set -eux pipefail
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2669f73..6994092 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -1,9 +1,10 @@
-name: 'Validate & Publish DevContainer'
-description: 'This workflow is checking that for releases, updates do not break stuff and publishes the released container.'
+---
+name: Validate & Publish DevContainer
+description: This workflow is checking that for releases, updates do not break stuff and publishes the released container.
 on:
   push:
     tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - v[0-9]+.[0-9]+.[0-9]+
 jobs:
   build:
     strategy:
@@ -11,13 +12,13 @@ jobs:
         os: [arm64, amd64]
         include:
           - os: amd64
-            name: 'DevContainer (amd64)'
+            name: DevContainer (amd64)
             runner: ubuntu-24.04
           - os: arm64
-            name: 'DevContainer (arm64)'
+            name: DevContainer (arm64)
             runner: ubuntu-24.04-arm
 
-    name: '${{ matrix.name }}'
+    name: ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
@@ -41,7 +42,7 @@ jobs:
         with:
           # The .devcontainer is never published as pre-built container.
           # We want to only use it for building and testing the actual container, which resides in src/s-core-devcontainer.
-          push: "never"
+          push: never
           runCmd: |
             set -eux pipefail
 
@@ -65,8 +66,8 @@ jobs:
             ./scripts/publish.sh --${{ matrix.os }} "${{ github.ref_name }}" "latest"
 
   merge:
-    name: 'Merge Labels'
-    needs: ["build"]
+    name: Merge Labels
+    needs: [build]
     runs-on: ubuntu-24.04
     permissions:
       contents: read
@@ -90,7 +91,7 @@ jobs:
         with:
           # The .devcontainer is never published as pre-built container.
           # We want to only use it for building and testing the actual container, which resides in src/s-core-devcontainer.
-          push: "never"
+          push: never
           runCmd: |
             set -eux pipefail
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3933893..da7b5d9 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,10 +1,17 @@
+---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c   # v6.0.0
     hooks:
       - id: check-yaml
       - id: end-of-file-fixer
-        exclude: "devcontainer-lock.json"
+        exclude: devcontainer-lock.json
       - id: trailing-whitespace
       - id: check-shebang-scripts-are-executable
       - id: check-executables-have-shebangs
+
+  - repo: https://github.com/jumanjihouse/pre-commit-hook-yamlfmt
+    rev: 8d1b9cadaf854cb25bb0b0f5870e1cc66a083d6b # 0.2.3
+    hooks:
+      - id: yamlfmt
+        args: [--mapping, '2', --offset, '2', --sequence, '4']
diff --git a/src/s-core-devcontainer/.devcontainer/bazel-feature/versions.yaml b/src/s-core-devcontainer/.devcontainer/bazel-feature/versions.yaml
index a7af61e..f2de765 100644
--- a/src/s-core-devcontainer/.devcontainer/bazel-feature/versions.yaml
+++ b/src/s-core-devcontainer/.devcontainer/bazel-feature/versions.yaml
@@ -1,3 +1,4 @@
+---
 bazel:
   # https://github.com/bazelbuild/bazel/releases -- latest version as of 2025-09-24
   version: 8.4.1
diff --git a/src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml b/src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml
index 0b37f5d..7a916e0 100644
--- a/src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml
+++ b/src/s-core-devcontainer/.devcontainer/s-core-local/versions.yaml
@@ -1,3 +1,4 @@
+---
 graphviz:
   version: 2.42.2
 
@@ -11,22 +12,22 @@ sshpass:
   version: 1.09
 
 gdb:
-  version: "15.0.50"
+  version: 15.0.50
 
 git:
-  version: "2.43.0"
+  version: 2.43.0
 
 git_lfs:
-  version: "3.4.1"
+  version: 3.4.1
 
 python:
-  version: "3.12"
+  version: '3.12'
 
 gh:
-  version: "2.45.0"
+  version: 2.45.0
 
 openjdk_21:
-  version: "21.0.9"
+  version: 21.0.9
 
 valgrind:
-  version: "3.22.0"
+  version: 3.22.0