diff --git a/.envrc b/.envrc
index 3217eb2c..5caf4bb6 100644
--- a/.envrc
+++ b/.envrc
@@ -2,11 +2,11 @@ export NF_CONFIG_ROOT=$PWD
 export HOME_HOSTNAME=$(hostname -s)
 FLAKE_ARGS=()
 
-if [[ $(id -un) = kat ]]; then
-	git pull
-fi
+source_env_if_exists ".envrc.${USER-$(id -un)}"
 
 source_env_if_exists .envrc.conf
 
 use flake "${FLAKE_ARGS[@]}"
 export FLAKE_OPTS=${FLAKE_OPTS:-"${FLAKE_ARGS[*]}"}
+
+watch_file devShell.nix
diff --git a/.envrc.kat b/.envrc.kat
new file mode 100644
index 00000000..d0aed616
--- /dev/null
+++ b/.envrc.kat
@@ -0,0 +1 @@
+git pull
diff --git a/.gitignore b/.gitignore
index 2658f984..0643002d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,5 +2,7 @@
 /result*
 /.direnv/
 /wiki
-.DS_Store
+/tf/terraform.tfvars
 .terraform
+.DS_Store
+.envrc.conf
diff --git a/devShell.nix b/devShell.nix
index 83c37330..a8f888f7 100644
--- a/devShell.nix
+++ b/devShell.nix
@@ -19,7 +19,15 @@ let
     exec nix flake update "$@"
   '';
   nf-deploy = pkgs.writeShellScriptBin "nf-deploy" ''
-    exec nix run ''${FLAKE_OPTS-} ''$NF_CONFIG_ROOT#nf-deploy -- "$@"
+    exec nix run ''${FLAKE_OPTS-} "$NF_CONFIG_ROOT#nf-deploy" -- "$@"
+  '';
+  nf-tf = pkgs.writeShellScriptBin "nf-tf" ''
+    cd "$NF_CONFIG_ROOT/tf"
+    exec nix run ''${FLAKE_OPTS-} "$NF_CONFIG_ROOT#terraform" -- "$@"
+  '';
+  nf-lint-tf = pkgs.writeShellScriptBin "nf-lint-tf" ''
+    cd "$NF_CONFIG_ROOT/tf"
+    exec nix run ''${FLAKE_OPTS-} "$NF_CONFIG_ROOT#nf-lint-tf" -- "$@"
   '';
 in
 pkgs.mkShell {
@@ -30,6 +38,8 @@ pkgs.mkShell {
     nf-actions-test
     nf-update
     nf-deploy
+    nf-tf
+    nf-lint-tf
   ];
   shellHook = ''
     export NIX_BIN_DIR=$(dirname $(readlink -f $(type -P nix)))
diff --git a/modules/meta/packages.nix b/modules/meta/packages.nix
index b6ba312d..d5835e2f 100644
--- a/modules/meta/packages.nix
+++ b/modules/meta/packages.nix
@@ -1,10 +1,13 @@
 {
+  config,
   lib,
   pkgs,
   ...
 }: let
   inherit (lib.options) mkOption;
   inherit (lib.types) attrsOf package;
+  inherit (lib.meta) getExe;
+  cfg = config.outputs.packages;
 in {
   options.outputs.packages = mkOption {
     type = attrsOf package;
@@ -12,8 +15,13 @@ in {
   };
 
   config.outputs.packages = {
+    inherit (pkgs.buildPackages) terraform tflint;
     nf-deploy = pkgs.writeShellScriptBin "nf-deploy" ''
       exec ${pkgs.runtimeShell} ${../../ci/deploy.sh} "$@"
     '';
+    nf-lint-tf = pkgs.writeShellScriptBin "nf-lint-tf" ''
+      ${getExe cfg.terraform} fmt "$@" &&
+      ${cfg.tflint}/bin/tflint
+    '';
   };
 }