diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 00000000..edb53ee5
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,25 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+# Shell scripts
+[*.sh]
+# Language variant
+shell_variant = bash
+
+# Indentation (2 spaces)
+indent_style = space
+indent_size = 2
+
+# Binary operators at start of line
+binary_next_line = false
+
+# Switch case indentation
+switch_case_indent = true
+
+# Keep column alignment
+keep_padding = true
+
+# Function brace on same line
+function_next_line = false
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 5fd1ae74..150a2bab 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -19,6 +19,11 @@ jobs:
         run: >-
           docker run --rm -v "$PWD:/mnt" --workdir "/mnt" "koalaman/shellcheck:v0.8.0" --color=always \
               $(find . -type f -exec grep -m1 -l -E '^#!.*sh.*' {} \; | grep -v '/.git/')
+      - name: Check shell script formatting with shfmt
+        run: docker run --rm -v "$PWD:/mnt" --workdir "/mnt" mvdan/shfmt:v3 -d .
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.14'
       - name: Install uv
         uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
         with:
diff --git a/xtest/sdk/go/cli.sh b/xtest/sdk/go/cli.sh
index 9790a74c..aefa8749 100755
--- a/xtest/sdk/go/cli.sh
+++ b/xtest/sdk/go/cli.sh
@@ -18,7 +18,7 @@
 #  XT_WITH_ATTRIBUTES [string] - Attributes to be used for encryption
 #  XT_WITH_MIME_TYPE [string] - MIME type for the encrypted file
 #
-SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null  && pwd)
 
 cmd=("$SCRIPT_DIR"/otdfctl)
 if [ ! -f "$SCRIPT_DIR"/otdfctl ]; then
diff --git a/xtest/sdk/go/otdfctl.sh b/xtest/sdk/go/otdfctl.sh
index 1fbfbea7..82c6dd50 100755
--- a/xtest/sdk/go/otdfctl.sh
+++ b/xtest/sdk/go/otdfctl.sh
@@ -5,7 +5,7 @@
 #
 # Usage: ./otdfctl.sh [otdfctl options]
 #
-SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null  && pwd)
 
 XTEST_DIR="$SCRIPT_DIR"
 while [ ! -f "$XTEST_DIR/test.env" ] && [ "$(basename "$XTEST_DIR")" != "xtest" ]; do
diff --git a/xtest/sdk/java/cli.sh b/xtest/sdk/java/cli.sh
index 0153932a..44974444 100755
--- a/xtest/sdk/java/cli.sh
+++ b/xtest/sdk/java/cli.sh
@@ -19,7 +19,7 @@
 #  XT_WITH_MIME_TYPE [string] - MIME type for the encrypted file
 #  XT_WITH_TARGET_MODE [string] - Target spec mode for the encrypted file
 #
-SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null  && pwd)
 
 XTEST_DIR="$SCRIPT_DIR"
 while [ ! -f "$XTEST_DIR/test.env" ] && [ "$(basename "$XTEST_DIR")" != "xtest" ]; do
diff --git a/xtest/sdk/js/cli.sh b/xtest/sdk/js/cli.sh
index ffe6f915..175e0e15 100755
--- a/xtest/sdk/js/cli.sh
+++ b/xtest/sdk/js/cli.sh
@@ -19,7 +19,7 @@
 #  XT_WITH_MIME_TYPE [string] - MIME type for the encrypted file
 #  XT_WITH_TARGET_MODE [string] - Target spec mode for the encrypted file
 #
-SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null  && pwd)
 
 CTL=@opentdf/ctl
 if grep opentdf/cli "$SCRIPT_DIR/package.json"; then
@@ -123,7 +123,7 @@ if [ -n "$XT_WITH_ASSERTIONS" ]; then
     assertions=$(realpath "$assertions")
     echo "Assertions are a file: $assertions"
     args+=(--assertions "$assertions")
-  elif [ "$(echo "$assertions" | jq -e . >/dev/null 2>&1 && echo valid || echo invalid)" == "valid" ]; then
+  elif [ "$(echo "$assertions" | jq -e . >/dev/null  2>&1 && echo valid || echo invalid)" == "valid" ]; then
     # Assertions are plain json
     echo "Assertions are plain json: $assertions"
     args+=(--assertions "$assertions")
diff --git a/xtest/sdk/scripts/checkout-all.sh b/xtest/sdk/scripts/checkout-all.sh
index e8c69ffb..c9cbbea9 100755
--- a/xtest/sdk/scripts/checkout-all.sh
+++ b/xtest/sdk/scripts/checkout-all.sh
@@ -2,7 +2,7 @@
 # Checks out the latest `main` branch of each of the sdks under test
 # and builds them.
 
-SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null  && pwd)
 
 for sdk in go java js; do
   if ! "$SCRIPT_DIR/checkout-sdk-branch.sh" "$sdk" main; then
diff --git a/xtest/sdk/scripts/checkout-sdk-branch.sh b/xtest/sdk/scripts/checkout-sdk-branch.sh
index a941125d..55823145 100755
--- a/xtest/sdk/scripts/checkout-sdk-branch.sh
+++ b/xtest/sdk/scripts/checkout-sdk-branch.sh
@@ -5,8 +5,8 @@
 # Example: ./checkout-sdk-branch.sh js main
 
 # Resolve script directory
-SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
-XTEST_DIR=$(cd -- "$SCRIPT_DIR/../../" &>/dev/null && pwd)
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null  && pwd)
+XTEST_DIR=$(cd -- "$SCRIPT_DIR/../../" &>/dev/null  && pwd)
 
 # Parse arguments
 LANGUAGE=${1:-js}
diff --git a/xtest/sdk/scripts/cleanup-all.sh b/xtest/sdk/scripts/cleanup-all.sh
index 4027bcb9..4614676e 100755
--- a/xtest/sdk/scripts/cleanup-all.sh
+++ b/xtest/sdk/scripts/cleanup-all.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # Removes the checked out branches of each of the sdks under test
 
-SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null  && pwd)
 
 for sdk in go java js; do
   rm -rf "$SCRIPT_DIR/../$sdk/dist"
diff --git a/xtest/sdk/scripts/post-checkout-java.sh b/xtest/sdk/scripts/post-checkout-java.sh
index 0336602e..18a18d3b 100755
--- a/xtest/sdk/scripts/post-checkout-java.sh
+++ b/xtest/sdk/scripts/post-checkout-java.sh
@@ -5,7 +5,7 @@
 # on older branches that do not have it defined.
 
 # Base directory for the script
-SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null  && pwd)
 BASE_DIR="$SCRIPT_DIR/../java/src"
 
 # Detect the operating system to use the correct sed syntax
@@ -20,15 +20,15 @@ fi
 get_platform_branch() {
   local version="$1"
   case "$version" in
-    0.7.8|0.7.7) echo "protocol/go/v0.2.29" ;;
-    0.7.6)       echo "protocol/go/v0.2.25" ;;
-    0.7.5|0.7.4) echo "protocol/go/v0.2.18" ;;
-    0.7.3|0.7.2) echo "protocol/go/v0.2.17" ;;
-    0.6.1|0.6.0) echo "protocol/go/v0.2.14" ;;
-    0.5.0)       echo "protocol/go/v0.2.13" ;;
-    0.4.0|0.3.0|0.2.0) echo "protocol/go/v0.2.10" ;;
-    0.1.0)       echo "protocol/go/v0.2.3" ;;
-    *)           echo "main" ;;  # Default to main for unknown/newer versions
+    0.7.8 | 0.7.7) echo "protocol/go/v0.2.29" ;;
+    0.7.6) echo "protocol/go/v0.2.25" ;;
+    0.7.5 | 0.7.4) echo "protocol/go/v0.2.18" ;;
+    0.7.3 | 0.7.2) echo "protocol/go/v0.2.17" ;;
+    0.6.1 | 0.6.0) echo "protocol/go/v0.2.14" ;;
+    0.5.0) echo "protocol/go/v0.2.13" ;;
+    0.4.0 | 0.3.0 | 0.2.0) echo "protocol/go/v0.2.10" ;;
+    0.1.0) echo "protocol/go/v0.2.3" ;;
+    *) echo "main" ;; # Default to main for unknown/newer versions
   esac
   return 0
 }
@@ -45,7 +45,7 @@ find "$BASE_DIR" -mindepth 1 -maxdepth 1 -type d -not -name "*.git" | while read
 
   # Extract version from directory name (e.g., "v0.7.5" -> "0.7.5", "main" -> "main")
   DIR_NAME=$(basename "$SRC_DIR")
-  VERSION="${DIR_NAME#v}"  # Remove leading 'v' if present
+  VERSION="${DIR_NAME#v}" # Remove leading 'v' if present
   PLATFORM_BRANCH=$(get_platform_branch "$VERSION")
 
   # Check if the correct platform.branch is already set