diff --git a/internal/ci/base/helpers.cue b/internal/ci/base/helpers.cue
index 31321a7485c..027b461a59e 100644
--- a/internal/ci/base/helpers.cue
+++ b/internal/ci/base/helpers.cue
@@ -14,8 +14,8 @@ import (
 _matchPattern: {
 	variable: string
 	pattern:  string
-	expr:     [
-			if strings.HasSuffix(pattern, "*") {
+	expr: [
+		if strings.HasSuffix(pattern, "*") {
 			let prefix = strings.TrimSuffix(pattern, "*")
 			"startsWith(\(variable), '\(prefix)')"
 		},
diff --git a/internal/ci/github/release.cue b/internal/ci/github/release.cue
index d2311c23f59..82ac7b136d9 100644
--- a/internal/ci/github/release.cue
+++ b/internal/ci/github/release.cue
@@ -84,7 +84,7 @@ workflows: release: _repo.bashWorkflow & {
 				// is defined with the release command in CUE.
 				name: "Run GoReleaser with CUE"
 				env: GITHUB_TOKEN: "${{ secrets.CUECKOO_GITHUB_PAT }}"
-				_run:                 "cue cmd release"
+				_run:                "cue cmd release"
 				"working-directory": "./internal/ci/goreleaser"
 			},
 			_repo.repositoryDispatch & {
diff --git a/internal/ci/github/trybot.cue b/internal/ci/github/trybot.cue
index d987f206331..2f302eac24c 100644
--- a/internal/ci/github/trybot.cue
+++ b/internal/ci/github/trybot.cue
@@ -110,7 +110,7 @@ workflows: trybot: _repo.bashWorkflow & {
 
 	_goGenerate: _registryReadOnlyAccessStep & {
 		name: "Generate"
-		_run:  "go generate ./..."
+		_run: "go generate ./..."
 		// The Go version corresponds to the precise version specified in
 		// the matrix. Skip windows for now until we work out why re-gen is flaky
 		if: _isLatestLinux
diff --git a/internal/ci/goreleaser/goreleaser.cue b/internal/ci/goreleaser/goreleaser.cue
index 208751c7374..a805ac66923 100644
--- a/internal/ci/goreleaser/goreleaser.cue
+++ b/internal/ci/goreleaser/goreleaser.cue
@@ -3,7 +3,7 @@ package goreleaser
 config: {
 	#latest: bool @tag(latest, type=bool)
 
-	version: 2
+	version:      2
 	project_name: "cue"
 	// Note that gomod.proxy is ignored by `goreleaser release --snapshot`,
 	// which we use in CI to test the goreleaser config and build,
@@ -68,7 +68,7 @@ config: {
 		// For those reasons, let goreleaser create the release, but leaving it as a draft.
 		draft: true
 	}
-	checksum: name_template: "checksums.txt"
+	checksum: name_template:    "checksums.txt"
 	snapshot: version_template: "{{ .Tag }}-next"
 	// As explained above, we write our own release notes.
 	changelog: disable: true