diff --git a/third_party/BUILD.bazel b/third_party/BUILD.bazel
index 6920dfa..80b8cfb 100644
--- a/third_party/BUILD.bazel
+++ b/third_party/BUILD.bazel
@@ -1,4 +1,5 @@
 load("//osbase/build/fwprune:def.bzl", "fsspec_linux_firmware")
+load("//osbase/build/mkucode:def.bzl", "cpio_ucode")
 
 fsspec_linux_firmware(
     name = "firmware",
@@ -8,8 +9,6 @@
     visibility = ["//visibility:public"],
 )
 
-load("//osbase/build/mkucode:def.bzl", "cpio_ucode")
-
 cpio_ucode(
     name = "ucode",
     ucode = {
diff --git a/third_party/cap/cap.bzl b/third_party/cap/cap.bzl
index 459c89b..5d93890 100644
--- a/third_party/cap/cap.bzl
+++ b/third_party/cap/cap.bzl
@@ -14,8 +14,8 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
-load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
+load("@rules_cc//cc:defs.bzl", "cc_library")
 
 cc_library(
     name = "cap",
diff --git a/third_party/chrony/chrony.bzl b/third_party/chrony/chrony.bzl
index bb1477c..afecf26 100644
--- a/third_party/chrony/chrony.bzl
+++ b/third_party/chrony/chrony.bzl
@@ -1,5 +1,5 @@
-load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 load("@@//build/utils:template_file.bzl", "template_file")
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 
 template_file(
     name = "config.h",
diff --git a/third_party/dosfstools/dosfstools.bzl b/third_party/dosfstools/dosfstools.bzl
index cfe4b28..e8d966d 100644
--- a/third_party/dosfstools/dosfstools.bzl
+++ b/third_party/dosfstools/dosfstools.bzl
@@ -1,5 +1,5 @@
-load("@rules_cc//cc:defs.bzl", "cc_binary")
 load("@@//build/utils:template_file.bzl", "template_file")
+load("@rules_cc//cc:defs.bzl", "cc_binary")
 
 cc_binary(
     name = "fsck",
diff --git a/third_party/linux/def.bzl b/third_party/linux/def.bzl
index 0efbb64..4c6798c 100644
--- a/third_party/linux/def.bzl
+++ b/third_party/linux/def.bzl
@@ -25,7 +25,6 @@
 
 load("//build/utils:detect_root.bzl", "detect_root")
 
-
 _new_settings = {
     # This list should be expanded with any configuration options that end
     # up reaching this rule with different values across different build
@@ -40,8 +39,7 @@
     "//command_line_option:platforms": "//build/platforms:linux_amd64_static",
 }
 
-
-def _ignore_unused_configuration_impl(settings, attr):
+def _ignore_unused_configuration_impl(_settings, _attr):
     return _new_settings
 
 # Transition to flip all known-unimportant but varying configuration options to
@@ -66,15 +64,17 @@
 
     See `resource_set` documentation in builtins.actions Bazel docs.
     """
+
     # 16 threads seems about right - this fits well in both our build machines and
     # development machines.
     cpu = 16
+
     # In MB. Picked based on observing build in htop.
     mb_per_cpu = 256
     return {
-        'cpu': cpu,
-        'memory': cpu * mb_per_cpu,
-        'local_test': 0,
+        "cpu": cpu,
+        "memory": cpu * mb_per_cpu,
+        "local_test": 0,
     }
 
 def _linux_image_impl(ctx):
@@ -89,8 +89,8 @@
     # (image_name) is the name of the image that will be generated by this
     # rule.
     (target, image_source, image_name) = {
-        'vmlinux': ('vmlinux modules', 'vmlinux', 'vmlinux'),
-        'bzImage': ('all modules', 'arch/x86/boot/bzImage', 'bzImage'),
+        "vmlinux": ("vmlinux modules", "vmlinux", "vmlinux"),
+        "bzImage": ("all modules", "arch/x86/boot/bzImage", "bzImage"),
     }[image_format]
 
     # Root of the given Linux sources.
@@ -100,8 +100,8 @@
     modinfo = ctx.actions.declare_file("modules.builtin.modinfo")
     modules = ctx.actions.declare_directory("modules")
     ctx.actions.run_shell(
-        outputs = [ image, modinfo, modules ],
-        inputs = [ kernel_config ] + kernel_src,
+        outputs = [image, modinfo, modules],
+        inputs = [kernel_config] + kernel_src,
         resource_set = _linux_image_impl_resources,
         command = '''
             kconfig=$1
@@ -138,47 +138,48 @@
     )
 
     return [
-      DefaultInfo(
-        files=depset([image]),
-        runfiles=ctx.runfiles(files=[image])
-      ),
-      OutputGroupInfo(
-        modinfo = depset([modinfo]),
-        modules = depset([modules])
-      )
+        DefaultInfo(
+            files = depset([image]),
+            runfiles = ctx.runfiles(files = [image]),
+        ),
+        OutputGroupInfo(
+            modinfo = depset([modinfo]),
+            modules = depset([modules]),
+        ),
     ]
 
 linux_image = rule(
-    doc = '''
+    doc = """
         Build Linux kernel image unhermetically in a given format.
-    ''',
+    """,
     implementation = _linux_image_impl,
     cfg = ignore_unused_configuration,
     attrs = {
         "kernel_config": attr.label(
-            doc = '''
+            doc = """
                 Linux kernel configuration file to build this kernel image with.
-            ''',
+            """,
             allow_single_file = True,
             default = ":linux-metropolis.config",
         ),
         "kernel_src": attr.label(
-            doc = '''
+            doc = """
                 Filegroup containing Linux kernel sources.
-            ''',
+            """,
             default = "@linux//:all",
         ),
         "image_format": attr.string(
-            doc = '''
+            doc = """
                 Format of generated Linux image, one of 'vmlinux' or 'bzImage',
-            ''',
+            """,
             values = [
-                'vmlinux', 'bzImage',
+                "vmlinux",
+                "bzImage",
             ],
-            default = 'bzImage',
+            default = "bzImage",
         ),
         "_allowlist_function_transition": attr.label(
-            default = "@bazel_tools//tools/allowlists/function_transition_allowlist"
+            default = "@bazel_tools//tools/allowlists/function_transition_allowlist",
         ),
     },
 )
diff --git a/third_party/sandboxroot/BUILD.bazel b/third_party/sandboxroot/BUILD.bazel
index 9162616..ed4c773 100644
--- a/third_party/sandboxroot/BUILD.bazel
+++ b/third_party/sandboxroot/BUILD.bazel
@@ -1,5 +1,5 @@
-load("@bazeldnf//:deps.bzl", "rpmtree")
 load("@bazeldnf//:def.bzl", "bazeldnf")
+load("@bazeldnf//:deps.bzl", "rpmtree")
 
 bazeldnf(
     name = "sandboxroot",
diff --git a/third_party/seccomp/seccomp.bzl b/third_party/seccomp/seccomp.bzl
index 4f94aa6..9a010af 100644
--- a/third_party/seccomp/seccomp.bzl
+++ b/third_party/seccomp/seccomp.bzl
@@ -14,8 +14,8 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
-load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@@//build/utils:template_file.bzl", "template_file")
+load("@rules_cc//cc:defs.bzl", "cc_library")
 
 genrule(
     name = "config-h",
diff --git a/third_party/urcu/urcu.bzl b/third_party/urcu/urcu.bzl
index 3dfb0f8..57307f1 100644
--- a/third_party/urcu/urcu.bzl
+++ b/third_party/urcu/urcu.bzl
@@ -1,10 +1,10 @@
-load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@@//build/utils:template_file.bzl", "template_file")
+load("@rules_cc//cc:defs.bzl", "cc_library")
 
 template_file(
     name = "config.h",
     src = "@@//third_party/urcu:config.h.in",
-    substitutions = { },
+    substitutions = {},
 )
 
 cc_library(
diff --git a/third_party/util-linux/util-linux.bzl b/third_party/util-linux/util-linux.bzl
index b0ebca6..36e5886 100644
--- a/third_party/util-linux/util-linux.bzl
+++ b/third_party/util-linux/util-linux.bzl
@@ -14,8 +14,8 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 
-load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@@//build/utils:template_file.bzl", "template_file")
+load("@rules_cc//cc:defs.bzl", "cc_library")
 
 # These are only for the headers of libcommon, which is a private dependency of libblkid and
 # libuuid. Bazel doesn't support private dependencies and we want to avoid propagating these up
diff --git a/third_party/xfsprogs/xfsprogs.bzl b/third_party/xfsprogs/xfsprogs.bzl
index 6a2b56f..07f3da7 100644
--- a/third_party/xfsprogs/xfsprogs.bzl
+++ b/third_party/xfsprogs/xfsprogs.bzl
@@ -15,7 +15,6 @@
 #  limitations under the License.
 
 load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
-load("@@//build/utils:template_file.bzl", "template_file")
 
 defs = [
     "NDEBUG",  # Doesn't compile without it because their assertions reference non-existent fields