diff --git a/.github/workflows/pr_pre-commit.yaml b/.github/workflows/pr_pre-commit.yaml
index ec55fe78..bdc3ddfd 100644
--- a/.github/workflows/pr_pre-commit.yaml
+++ b/.github/workflows/pr_pre-commit.yaml
@@ -6,7 +6,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
-  RUST_TOOLCHAIN_VERSION: "1.82.0"
+  RUST_TOOLCHAIN_VERSION: "nightly-2025-01-15"
   HADOLINT_VERSION: "v2.12.0"
   PYTHON_VERSION: "3.12"
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index a36fdcb7..c5bd8ad1 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -17,10 +17,6 @@ repos:
   - repo: https://github.com/doublify/pre-commit-rust
     rev: eeee35a89e69d5772bdee97db1a6a898467b686e # 1.0
     hooks:
-      - id: fmt
-        # Pinning to a specific rustc version, so that we get consistent formatting
-        entry: RUSTUP_TOOLCHAIN=nightly-2025-01-15 cargo fmt
-        args: ["--all", "--", "--check"]
       - id: clippy
         args: ["--all-targets", "--", "-D", "warnings"]
 
@@ -78,3 +74,10 @@ repos:
         entry: cargo test
         stages: [pre-commit, pre-merge-commit, manual]
         pass_filenames: false
+
+      - id: cargo-rustfmt
+        name: cargo-rustfmt
+        language: system
+        entry: cargo +nightly-2025-01-15 fmt --all -- --check
+        stages: [pre-commit]
+        pass_filenames: false
diff --git a/rust/crd/src/affinity.rs b/rust/crd/src/affinity.rs
index e600fdf7..becd5de2 100644
--- a/rust/crd/src/affinity.rs
+++ b/rust/crd/src/affinity.rs
@@ -21,12 +21,9 @@ pub fn get_affinity(cluster_name: &str, role: &KafkaRole) -> StackableAffinityFr
 
 #[cfg(test)]
 mod tests {
-    use super::*;
-
-    use rstest::rstest;
     use std::collections::BTreeMap;
 
-    use crate::KafkaCluster;
+    use rstest::rstest;
     use stackable_operator::{
         commons::affinity::StackableAffinity,
         k8s_openapi::{
@@ -35,6 +32,9 @@ mod tests {
         },
     };
 
+    use super::*;
+    use crate::KafkaCluster;
+
     #[rstest]
     #[case(KafkaRole::Broker)]
     fn test_affinity_defaults(#[case] role: KafkaRole) {
diff --git a/rust/crd/src/authentication.rs b/rust/crd/src/authentication.rs
index 47462883..ebe57271 100644
--- a/rust/crd/src/authentication.rs
+++ b/rust/crd/src/authentication.rs
@@ -1,14 +1,13 @@
-use crate::ObjectRef;
-
 use serde::{Deserialize, Serialize};
 use snafu::{ResultExt, Snafu};
-use stackable_operator::commons::authentication::AuthenticationClassProvider;
 use stackable_operator::{
     client::Client,
-    commons::authentication::AuthenticationClass,
+    commons::authentication::{AuthenticationClass, AuthenticationClassProvider},
     schemars::{self, JsonSchema},
 };
 
+use crate::ObjectRef;
+
 pub const SUPPORTED_AUTHENTICATION_CLASS_PROVIDERS: [&str; 2] = ["TLS", "Kerberos"];
 
 #[derive(Snafu, Debug)]
diff --git a/rust/crd/src/lib.rs b/rust/crd/src/lib.rs
index a8d6609b..14cb8d03 100644
--- a/rust/crd/src/lib.rs
+++ b/rust/crd/src/lib.rs
@@ -5,8 +5,7 @@ pub mod listener;
 pub mod security;
 pub mod tls;
 
-use crate::authorization::KafkaAuthorization;
-use crate::tls::KafkaTls;
+use std::{collections::BTreeMap, str::FromStr};
 
 use affinity::get_affinity;
 use authentication::KafkaAuthentication;
@@ -38,9 +37,10 @@ use stackable_operator::{
     time::Duration,
     utils::cluster_info::KubernetesClusterInfo,
 };
-use std::{collections::BTreeMap, str::FromStr};
 use strum::{Display, EnumIter, EnumString, IntoEnumIterator};
 
+use crate::{authorization::KafkaAuthorization, tls::KafkaTls};
+
 pub const DOCKER_IMAGE_BASE_NAME: &str = "kafka";
 pub const APP_NAME: &str = "kafka";
 pub const OPERATOR_NAME: &str = "kafka.stackable.tech";
diff --git a/rust/crd/src/listener.rs b/rust/crd/src/listener.rs
index acbf1216..299cb915 100644
--- a/rust/crd/src/listener.rs
+++ b/rust/crd/src/listener.rs
@@ -1,13 +1,13 @@
-use std::collections::BTreeMap;
-use std::fmt::{Display, Formatter};
+use std::{
+    collections::BTreeMap,
+    fmt::{Display, Formatter},
+};
 
 use snafu::{OptionExt, Snafu};
-use stackable_operator::kube::ResourceExt;
-use stackable_operator::utils::cluster_info::KubernetesClusterInfo;
+use stackable_operator::{kube::ResourceExt, utils::cluster_info::KubernetesClusterInfo};
 use strum::{EnumDiscriminants, EnumString};
 
-use crate::security::KafkaTlsSecurity;
-use crate::{KafkaCluster, STACKABLE_LISTENER_BROKER_DIR};
+use crate::{security::KafkaTlsSecurity, KafkaCluster, STACKABLE_LISTENER_BROKER_DIR};
 
 const LISTENER_LOCAL_ADDRESS: &str = "0.0.0.0";
 
@@ -260,9 +260,6 @@ pub fn pod_fqdn(
 
 #[cfg(test)]
 mod tests {
-    use super::*;
-    use crate::authentication::ResolvedAuthenticationClasses;
-
     use stackable_operator::{
         builder::meta::ObjectMetaBuilder,
         commons::{
@@ -275,6 +272,9 @@ mod tests {
         },
     };
 
+    use super::*;
+    use crate::authentication::ResolvedAuthenticationClasses;
+
     fn default_cluster_info() -> KubernetesClusterInfo {
         KubernetesClusterInfo {
             cluster_domain: DomainName::try_from("cluster.local").unwrap(),
diff --git a/rust/crd/src/security.rs b/rust/crd/src/security.rs
index 2d27b695..abb2eb24 100644
--- a/rust/crd/src/security.rs
+++ b/rust/crd/src/security.rs
@@ -6,20 +6,8 @@
 //! This is required due to overlaps between TLS encryption and e.g. mTLS authentication or Kerberos
 use std::collections::BTreeMap;
 
-use crate::{
-    authentication::{self, ResolvedAuthenticationClasses},
-    listener::{self, KafkaListenerConfig},
-    tls, KafkaCluster, LISTENER_BOOTSTRAP_VOLUME_NAME, SERVER_PROPERTIES_FILE,
-    STACKABLE_CONFIG_DIR,
-};
-use crate::{
-    listener::node_address_cmd, STACKABLE_KERBEROS_KRB5_PATH, STACKABLE_LISTENER_BOOTSTRAP_DIR,
-    STACKABLE_LISTENER_BROKER_DIR,
-};
-use crate::{KafkaRole, LISTENER_BROKER_VOLUME_NAME, STACKABLE_LOG_DIR};
 use indoc::formatdoc;
 use snafu::{ensure, ResultExt, Snafu};
-use stackable_operator::time::Duration;
 use stackable_operator::{
     builder::{
         self,
@@ -35,9 +23,18 @@ use stackable_operator::{
     product_logging::framework::{
         create_vector_shutdown_file_command, remove_vector_shutdown_file_command,
     },
+    time::Duration,
     utils::COMMON_BASH_TRAP_FUNCTIONS,
 };
 
+use crate::{
+    authentication::{self, ResolvedAuthenticationClasses},
+    listener::{self, node_address_cmd, KafkaListenerConfig},
+    tls, KafkaCluster, KafkaRole, LISTENER_BOOTSTRAP_VOLUME_NAME, LISTENER_BROKER_VOLUME_NAME,
+    SERVER_PROPERTIES_FILE, STACKABLE_CONFIG_DIR, STACKABLE_KERBEROS_KRB5_PATH,
+    STACKABLE_LISTENER_BOOTSTRAP_DIR, STACKABLE_LISTENER_BROKER_DIR, STACKABLE_LOG_DIR,
+};
+
 #[derive(Snafu, Debug)]
 pub enum Error {
     #[snafu(display("failed to process authentication class"))]
diff --git a/rust/operator-binary/src/kerberos.rs b/rust/operator-binary/src/kerberos.rs
index 7558bd91..238fb6fb 100644
--- a/rust/operator-binary/src/kerberos.rs
+++ b/rust/operator-binary/src/kerberos.rs
@@ -1,8 +1,7 @@
 use snafu::{ResultExt, Snafu};
-use stackable_kafka_crd::{security::KafkaTlsSecurity, KafkaRole};
 use stackable_kafka_crd::{
-    LISTENER_BOOTSTRAP_VOLUME_NAME, LISTENER_BROKER_VOLUME_NAME, STACKABLE_KERBEROS_DIR,
-    STACKABLE_KERBEROS_KRB5_PATH,
+    security::KafkaTlsSecurity, KafkaRole, LISTENER_BOOTSTRAP_VOLUME_NAME,
+    LISTENER_BROKER_VOLUME_NAME, STACKABLE_KERBEROS_DIR, STACKABLE_KERBEROS_KRB5_PATH,
 };
 use stackable_operator::builder::{
     self,