diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index d47dfb7f..343b2b41 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -10,6 +10,10 @@ inputs:
   components:
     description: Cargo components to install. Comma-separated string of [`audit`, `hack``, `release`, `semver-checks].
     required: false
+  tombi:
+    description: >
+      Install `tombi` - TOML formatter/linter, if `true`.  Defaults to `false.
+    required: false
   solana:
     description: Install Solana if `true`. Defaults to `false`.
     required: false
@@ -47,6 +51,10 @@ runs:
         toolchain: ${{ env.TOOLCHAIN_FORMAT }}
         components: rustfmt
 
+    - name: Install Toml formatter and linter tombi
+      if: ${{ inputs.tombi == 'true' }}
+      uses: tombi-toml/setup-tombi@v1
+
     - name: Install Rust 'lint' Toolchain
       if: ${{ contains(inputs.toolchain, 'lint') }}
       uses: dtolnay/rust-toolchain@master
diff --git a/.github/cliff.toml b/.github/cliff.toml
index 6d57ac2b..48822400 100644
--- a/.github/cliff.toml
+++ b/.github/cliff.toml
@@ -23,7 +23,8 @@ body = """
 trim = true
 footer = """
 """
-postprocessors = [ ]
+postprocessors = []
+
 [git]
 # parse the commits based on https://www.conventionalcommits.org
 conventional_commits = true
@@ -35,10 +36,10 @@ split_commits = false
 commit_preprocessors = []
 # regex for parsing and grouping commits
 commit_parsers = [
-    { message = "^build\\(deps\\)", skip = true },
-    { message = "^build\\(deps-dev\\)", skip = true },
-    { message = "^ci", skip = true },
-    { body = ".*", group = "Changes" },
+  { message = "^build\\(deps\\)", skip = true },
+  { message = "^build\\(deps-dev\\)", skip = true },
+  { message = "^ci", skip = true },
+  { body = ".*", group = "Changes" },
 ]
 # protect breaking changes from being skipped due to matching a skipping commit_parser
 protect_breaking_commits = false
@@ -55,4 +56,4 @@ topo_order = false
 # sort the commits inside sections by oldest/newest order
 sort_commits = "newest"
 # limit the number of commits included in the changelog.
-# limit_commits = 42
\ No newline at end of file
+# limit_commits = 42
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index cfe96fcc..8b015af3 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -68,6 +68,7 @@ jobs:
           cargo-cache-key: cargo-${{ matrix.member }}
           toolchain: build, format, lint, test
           components: hack
+          tombi: true
           solana: true
 
       - name: fmt
diff --git a/Cargo.toml b/Cargo.toml
index 06e87351..61dbba49 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,28 +1,28 @@
 [workspace]
 resolver = "2"
 members = [
-    "programs/associated-token-account",
-    "programs/memo",
-    "programs/system",
-    "programs/token",
-    "programs/token-2022",
-    "sdk/log/crate",
-    "sdk/log/macro",
-    "sdk/pinocchio",
-    "sdk/pubkey",
+  "programs/associated-token-account",
+  "programs/memo",
+  "programs/system",
+  "programs/token",
+  "programs/token-2022",
+  "sdk/log/crate",
+  "sdk/log/macro",
+  "sdk/pinocchio",
+  "sdk/pubkey",
 ]
 
 [workspace.package]
 edition = "2021"
-license = "Apache-2.0"
-repository = "https://github.com/anza-xyz/pinocchio"
 rust-version = "1.79"
+repository = "https://github.com/anza-xyz/pinocchio"
+license = "Apache-2.0"
 
 [workspace.dependencies]
 five8_const = "0.1.4"
-pinocchio = { version = "0.9", path = "sdk/pinocchio" }
-pinocchio-log-macro = { version = "0.5", path = "sdk/log/macro" }
-pinocchio-pubkey = { version = "0.3", path = "sdk/pubkey" }
+pinocchio = { path = "sdk/pinocchio", version = "0.9" }
+pinocchio-log-macro = { path = "sdk/log/macro", version = "0.5" }
+pinocchio-pubkey = { path = "sdk/pubkey", version = "0.3" }
 quote = "1.0"
 regex = "1"
 syn = "1.0"
diff --git a/programs/associated-token-account/Cargo.toml b/programs/associated-token-account/Cargo.toml
index 0da0f17a..83823d85 100644
--- a/programs/associated-token-account/Cargo.toml
+++ b/programs/associated-token-account/Cargo.toml
@@ -1,12 +1,12 @@
 [package]
 name = "pinocchio-associated-token-account"
-description = "Pinocchio helpers to invoke Associated Token Account program instructions"
 version = "0.2.0"
 edition = { workspace = true }
-license = { workspace = true }
+rust-version = { workspace = true }
+description = "Pinocchio helpers to invoke Associated Token Account program instructions"
 readme = "./README.md"
 repository = { workspace = true }
-rust-version = { workspace = true }
+license = { workspace = true }
 
 [lib]
 crate-type = ["rlib"]
diff --git a/programs/memo/Cargo.toml b/programs/memo/Cargo.toml
index 1ee04bc9..e19b74c8 100644
--- a/programs/memo/Cargo.toml
+++ b/programs/memo/Cargo.toml
@@ -1,12 +1,12 @@
 [package]
 name = "pinocchio-memo"
-description = "Pinocchio helpers to invoke Memo program instructions"
 version = "0.2.0"
 edition = { workspace = true }
-license = { workspace = true }
+rust-version = { workspace = true }
+description = "Pinocchio helpers to invoke Memo program instructions"
 readme = "./README.md"
 repository = { workspace = true }
-rust-version = { workspace = true }
+license = { workspace = true }
 
 [lib]
 crate-type = ["rlib"]
diff --git a/programs/system/Cargo.toml b/programs/system/Cargo.toml
index 19030866..839890c1 100644
--- a/programs/system/Cargo.toml
+++ b/programs/system/Cargo.toml
@@ -1,12 +1,12 @@
 [package]
 name = "pinocchio-system"
-description = "Pinocchio helpers to invoke System program instructions"
 version = "0.3.0"
 edition = { workspace = true }
-license = { workspace = true }
+rust-version = { workspace = true }
+description = "Pinocchio helpers to invoke System program instructions"
 readme = "./README.md"
 repository = { workspace = true }
-rust-version = { workspace = true }
+license = { workspace = true }
 
 [lib]
 crate-type = ["rlib"]
diff --git a/programs/token-2022/Cargo.toml b/programs/token-2022/Cargo.toml
index b24c529b..415e4381 100644
--- a/programs/token-2022/Cargo.toml
+++ b/programs/token-2022/Cargo.toml
@@ -1,11 +1,11 @@
 [package]
 name = "pinocchio-token-2022"
-description = "Pinocchio helpers to invoke Token-2022 program instructions"
 version = "0.1.0"
 edition = { workspace = true }
-license = { workspace = true }
+description = "Pinocchio helpers to invoke Token-2022 program instructions"
 readme = "./README.md"
 repository = { workspace = true }
+license = { workspace = true }
 
 [lib]
 crate-type = ["rlib"]
diff --git a/programs/token/Cargo.toml b/programs/token/Cargo.toml
index 0424f922..55dbabc6 100644
--- a/programs/token/Cargo.toml
+++ b/programs/token/Cargo.toml
@@ -1,12 +1,12 @@
 [package]
 name = "pinocchio-token"
-description = "Pinocchio helpers to invoke Token program instructions"
 version = "0.4.0"
 edition = { workspace = true }
-license = { workspace = true }
+rust-version = { workspace = true }
+description = "Pinocchio helpers to invoke Token program instructions"
 readme = "./README.md"
 repository = { workspace = true }
-rust-version = { workspace = true }
+license = { workspace = true }
 
 [lib]
 crate-type = ["rlib"]
diff --git a/scripts/format.mts b/scripts/format.mts
index fb93aac0..704a2f52 100644
--- a/scripts/format.mts
+++ b/scripts/format.mts
@@ -14,11 +14,14 @@ const toolchain = getToolchainArgument('format');
 const fix = popArgument(formatArgs, '--fix');
 
 const [cargoArgs, fmtArgs] = partitionArguments(formatArgs, '--');
-const manifestPath = path.join(workingDirectory, folder, 'Cargo.toml');
+const targetDir = path.join(workingDirectory, folder);
+const manifestPath = path.join(targetDir, 'Cargo.toml');
 
 // Format the client.
 if (fix) {
+  await $`tombi format -- ${targetDir}`
   await $`cargo ${toolchain} fmt --manifest-path ${manifestPath} ${cargoArgs} -- ${fmtArgs}`;
 } else {
+  await $`tombi format --check -- ${targetDir}`
   await $`cargo ${toolchain} fmt --manifest-path ${manifestPath} ${cargoArgs} -- --check ${fmtArgs}`;
 }
diff --git a/scripts/lint-toml.mts b/scripts/lint-toml.mts
new file mode 100644
index 00000000..ff240bc8
--- /dev/null
+++ b/scripts/lint-toml.mts
@@ -0,0 +1,12 @@
+#!/usr/bin/env zx
+import 'zx/globals';
+import {
+  cliArguments,
+  workingDirectory,
+} from './setup/shared.mts';
+
+const [folder, ...args] = cliArguments();
+
+const targetDir = path.join(workingDirectory, folder);
+
+await $`tombi lint -- ${targetDir}`;
diff --git a/scripts/lint.mts b/scripts/lint.mts
index 3a6b7e5e..49947576 100644
--- a/scripts/lint.mts
+++ b/scripts/lint.mts
@@ -6,4 +6,5 @@ await Promise.all([
   $`tsx ./scripts/clippy.mts ${args}`,
   $`tsx ./scripts/doc.mts ${args}`,
   $`tsx ./scripts/hack.mts ${args}`,
+  $`tsx ./scripts/lint-toml.mts ${args}`,
 ]);
diff --git a/sdk/log/crate/Cargo.toml b/sdk/log/crate/Cargo.toml
index 92c54e7e..a5dbdad6 100644
--- a/sdk/log/crate/Cargo.toml
+++ b/sdk/log/crate/Cargo.toml
@@ -1,12 +1,12 @@
 [package]
 name = "pinocchio-log"
-description = "Lightweight log utility for Solana programs"
 version = "0.5.1"
 edition = { workspace = true }
-license = { workspace = true }
+rust-version = { workspace = true }
+description = "Lightweight log utility for Solana programs"
 readme = "./README.md"
 repository = { workspace = true }
-rust-version = { workspace = true }
+license = { workspace = true }
 
 [lib]
 crate-type = ["rlib"]
@@ -14,12 +14,12 @@ crate-type = ["rlib"]
 [dependencies]
 pinocchio-log-macro = { workspace = true, optional = true }
 
-[lints.rust]
-unexpected_cfgs = { level = "warn", check-cfg = [
-    'cfg(target_os, values("solana"))',
-    'cfg(target_feature, values("static-syscalls"))',
-] }
-
 [features]
 default = ["macro"]
 macro = ["dep:pinocchio-log-macro"]
+
+[lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = [
+  'cfg(target_os, values("solana"))',
+  'cfg(target_feature, values("static-syscalls"))',
+] }
diff --git a/sdk/log/macro/Cargo.toml b/sdk/log/macro/Cargo.toml
index 4f7ffca8..d25a498e 100644
--- a/sdk/log/macro/Cargo.toml
+++ b/sdk/log/macro/Cargo.toml
@@ -1,12 +1,12 @@
 [package]
 name = "pinocchio-log-macro"
-description = "Macro for pinocchio log utility"
 version = "0.5.0"
 edition = { workspace = true }
-license = { workspace = true }
+rust-version = { workspace = true }
+description = "Macro for pinocchio log utility"
 readme = "./README.md"
 repository = { workspace = true }
-rust-version = { workspace = true }
+license = { workspace = true }
 
 [lib]
 proc-macro = true
diff --git a/sdk/pinocchio/Cargo.toml b/sdk/pinocchio/Cargo.toml
index f327b4b0..c0b904df 100644
--- a/sdk/pinocchio/Cargo.toml
+++ b/sdk/pinocchio/Cargo.toml
@@ -1,24 +1,24 @@
 [package]
 name = "pinocchio"
-description = "Create Solana programs with no dependencies attached"
 version = "0.9.2"
 edition = { workspace = true }
-license = { workspace = true }
+rust-version = { workspace = true }
+description = "Create Solana programs with no dependencies attached"
 readme = "./README.md"
 repository = { workspace = true }
-rust-version = { workspace = true }
+license = { workspace = true }
 
 [lib]
 crate-type = ["rlib"]
 
-[lints.rust]
-unexpected_cfgs = { level = "warn", check-cfg = [
-    'cfg(target_os, values("solana"))',
-    'cfg(target_feature, values("static-syscalls"))',
-] }
+[dev-dependencies]
+five8_const = { workspace = true }
 
 [features]
 std = []
 
-[dev-dependencies]
-five8_const = { workspace = true }
+[lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = [
+  'cfg(target_os, values("solana"))',
+  'cfg(target_feature, values("static-syscalls"))',
+] }
diff --git a/sdk/pubkey/Cargo.toml b/sdk/pubkey/Cargo.toml
index e1528b86..f4fed292 100644
--- a/sdk/pubkey/Cargo.toml
+++ b/sdk/pubkey/Cargo.toml
@@ -1,26 +1,26 @@
 [package]
 name = "pinocchio-pubkey"
-description = "Companion pubkey helpers for Pinocchio"
 version = "0.3.0"
 edition = { workspace = true }
-license = { workspace = true }
+rust-version = { workspace = true }
+description = "Companion pubkey helpers for Pinocchio"
 readme = "./README.md"
 repository = { workspace = true }
-rust-version = { workspace = true }
+license = { workspace = true }
 
 [lib]
 crate-type = ["rlib"]
 
-[lints.rust]
-unexpected_cfgs = { level = "warn", check-cfg = [
-    'cfg(target_os, values("solana"))',
-] }
+[dependencies]
+five8_const = { workspace = true, optional = true }
+pinocchio = { workspace = true }
+sha2-const-stable = { version = "0.1.0", optional = true }
 
 [features]
 default = ["const"]
 const = ["dep:five8_const", "dep:sha2-const-stable"]
 
-[dependencies]
-five8_const = { workspace = true, optional = true }
-sha2-const-stable = { version = "0.1.0", optional = true }
-pinocchio = { workspace = true }
+[lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = [
+  'cfg(target_os, values("solana"))',
+] }