diff --git a/pyproject.toml b/pyproject.toml
index 72280c92ba5d9213a24c71a6777a1d0a1b1f6d34..acfa20be05d68ee4c95e101446cb70b8dcf16ca6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -27,3 +27,15 @@
         directory = "misc"
         name = "Misc"
         showcontent = false
+
+[tool.black]
+target-version = ['py27']
+extend-exclude = '''
+# A regex preceded with ^/ will apply only to files and directories
+# in the root of the project.
+^/src/_zkapauthorizer/_version.py
+'''
+
+[tool.isort]
+profile = "black"
+skip = ["src/_zkapauthorizer/_version.py"]
diff --git a/tests.nix b/tests.nix
index 961d29d3399ff0bec7f9e0af63fae3cef12a86c8..b8b5b39b0d656f43d07cd5c66938c7f52a28bdd2 100644
--- a/tests.nix
+++ b/tests.nix
@@ -32,6 +32,14 @@ in
       packagesExtra = [ zkapauthorizer ];
       _.hypothesis.postUnpack = "";
     };
+
+    lint-python = mach-nix.mkPython {
+      python = "python39";
+      requirements = ''
+        isort
+        black
+      '';
+    };
   in
     pkgs.runCommand "zkapauthorizer-tests" {
       passthru = {
@@ -42,6 +50,8 @@ in
 
       pushd ${zkapauthorizer.src}
       ${python}/bin/pyflakes
+      ${lint-python}/bin/black --check src
+      ${lint-python}/bin/isort --check src
       popd
 
       ZKAPAUTHORIZER_HYPOTHESIS_PROFILE=${hypothesisProfile'} ${python}/bin/python -m ${if collectCoverage