diff --git a/Makefile b/Makefile
index 0aecfa2d..077bc3e9 100644
--- a/Makefile
+++ b/Makefile
@@ -47,7 +47,7 @@ test: install-test
 	$(POETRY) run pytest -k "not kms"
 
 test-coverage: install-test
-	$(POETRY) run pytest -k "not kms" --cov=gardenlinux --cov-report=xml tests/
+	$(POETRY) run pytest -k "not kms" --cov=gardenlinux --cov-report=html tests/
 
 test-coverage-ci: install-test
 	$(POETRY) run pytest -k "not kms" --cov=gardenlinux --cov-report=xml --cov-fail-under=85 tests/
@@ -62,13 +62,13 @@ format: install-dev
 	$(POETRY) run black --extend-exclude test-data/gardenlinux .
 
 lint: install-dev
-	$(POETRY) run black --check --extend-exclude test-data/gardenlinux .
+	$(POETRY) run black --diff --extend-exclude test-data/gardenlinux .
 
 security: install-dev
 	@if [ "$(CI)" = "true" ]; then \
-		$(POETRY) run bandit -ll -ii -r . -f json -o bandit-report.json ; \
+		$(POETRY) run bandit -c pyproject.toml -ll -ii -r . -f json -o bandit-report.json ; \
 	else \
-		$(POETRY) run bandit -r . ; \
+		$(POETRY) run bandit -c pyproject.toml -r . ; \
 	fi
 
 docs: install-docs
diff --git a/poetry.lock b/poetry.lock
index fae0176b..d3c67034 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -607,6 +607,22 @@ files = [
     {file = "iniconfig-2.1.0.tar.gz", hash = "sha256:3abbd2e30b36733fee78f9c7f7308f2d0050e88f0087fd25c2645f63c773e1c7"},
 ]
 
+[[package]]
+name = "isort"
+version = "6.0.1"
+description = "A Python utility / library to sort Python imports."
+optional = false
+python-versions = ">=3.9.0"
+groups = ["dev"]
+files = [
+    {file = "isort-6.0.1-py3-none-any.whl", hash = "sha256:2dc5d7f65c9678d94c88dfc29161a320eec67328bc97aad576874cb4be1e9615"},
+    {file = "isort-6.0.1.tar.gz", hash = "sha256:1cb5df28dfbc742e490c5e41bad6da41b805b0a8be7bc93cd0fb2a8a890ac450"},
+]
+
+[package.extras]
+colors = ["colorama"]
+plugins = ["setuptools"]
+
 [[package]]
 name = "jinja2"
 version = "3.1.6"
@@ -1041,23 +1057,23 @@ dev = ["argcomplete", "attrs (>=19.2)", "hypothesis (>=3.56)", "mock", "requests
 
 [[package]]
 name = "pytest-cov"
-version = "7.0.0"
+version = "6.3.0"
 description = "Pytest plugin for measuring coverage."
 optional = false
 python-versions = ">=3.9"
 groups = ["dev"]
 files = [
-    {file = "pytest_cov-7.0.0-py3-none-any.whl", hash = "sha256:3b8e9558b16cc1479da72058bdecf8073661c7f57f7d3c5f22a1c23507f2d861"},
-    {file = "pytest_cov-7.0.0.tar.gz", hash = "sha256:33c97eda2e049a0c5298e91f519302a1334c26ac65c1a483d6206fd458361af1"},
+    {file = "pytest_cov-6.3.0-py3-none-any.whl", hash = "sha256:440db28156d2468cafc0415b4f8e50856a0d11faefa38f30906048fe490f1749"},
+    {file = "pytest_cov-6.3.0.tar.gz", hash = "sha256:35c580e7800f87ce892e687461166e1ac2bcb8fb9e13aea79032518d6e503ff2"},
 ]
 
 [package.dependencies]
-coverage = {version = ">=7.10.6", extras = ["toml"]}
+coverage = {version = ">=7.5", extras = ["toml"]}
 pluggy = ">=1.2"
-pytest = ">=7"
+pytest = ">=6.2.5"
 
 [package.extras]
-testing = ["process-tests", "pytest-xdist", "virtualenv"]
+testing = ["fields", "hunter", "process-tests", "pytest-xdist", "virtualenv"]
 
 [[package]]
 name = "python-dateutil"
@@ -1686,4 +1702,4 @@ files = [
 [metadata]
 lock-version = "2.1"
 python-versions = "^3.13"
-content-hash = "e0ba1c787037e63909b23155323b9470ebef15ba56ccc84d78c30039ffd27ed7"
+content-hash = "7427654efae79db97f84e8ddc18b0568ee48c4d0d30293e69ef3430318c9c6c2"
diff --git a/pyproject.toml b/pyproject.toml
index 159e41fb..7e46baeb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -26,7 +26,8 @@ black = "^25.1.0"
 moto = "^5.1.12"
 python-dotenv = "^1.1.1"
 pytest = "^8.4.1"
-pytest-cov = "^7.0.0"
+pytest-cov = "^6.2.1"
+isort = "^6.0.1"
 
 [tool.poetry.group.docs.dependencies]
 sphinx-rtd-theme = "^3.0.2"
@@ -42,6 +43,13 @@ gl-s3 = "gardenlinux.s3.__main__:main"
 pythonpath = ["src"]
 norecursedirs = "test-data"
 
+[tool.bandit]
+skips = ["B101", "B404"] # allow asserts, subprocesses
+exclude_dirs = ["tests"]
+
+[tool.isort]
+known_first_party = "gardenlinux"
+
 [build-system]
 requires = ["poetry-core"]
 build-backend = "poetry.core.masonry.api"