diff --git a/Makefile b/Makefile
index 6f91f234..32bb1c0d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
 # Include ODC common make targets
-DEV_KIT_VERSION := v1.0.15
+DEV_KIT_VERSION := v2.0.0
 -include common.mk
 common.mk:
 	@[ -f .common.mk-download ] || \
@@ -71,12 +71,15 @@ codegen: $(OPENAPI_GEN) manifests ## Run code generation, e.g. openapi
 .PHONY: fmt
 fmt: $(ADDLICENSE) $(GOLANGCI_LINT) ## Add license headers and format code
 	git ls-files | grep '.*\.go$$' | xargs $(ADDLICENSE) -c 'BWI GmbH and Solution Arsenal contributors' -l apache -s=only
-	$(GO) fmt ./...
-	$(GOLANGCI_LINT) run --fix
+	$(GOLANGCI_LINT) fmt
 
 .PHONY: lint
 lint: lint-no-golangci golangci-lint ## Run linters
 
+.PHONY: lint-fix
+lint-fix: lint-no-golangci $(GOLANGCI_LINT) ## Run linters, auto-fixing what golangci-lint can fix (used by the pre-commit hook)
+	$(GOLANGCI_LINT) run --fix
+
 .PHONY: lint-no-golangci
 lint-no-golangci: $(ADDLICENSE) shellcheck  ## Run linters but not golangci-lint to exit early in CI/CD pipeline
 	git ls-files | grep '.*\.go$$' | xargs $(ADDLICENSE) -check -l apache -s=only -check
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index a9d30f33..2efee962 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -71,8 +71,9 @@ The SolAr build system uses a Makefile to orchestrate various tools, designed fo
 | ---------------- | -------------------------------------- | ------------------------------------------- |
 | `make codegen`   | Generate client-go libraries & OpenAPI | `openapi-gen`, `kube_codegen.sh`            |
 | `make manifests` | Generate RBAC manifests                | `controller-gen`                            |
-| `make fmt`       | Format code, add license headers       | `addlicense`, `go fmt`                      |
+| `make fmt`       | Format code, add license headers       | `addlicense`, `golangci-lint`               |
 | `make lint`      | Run linters and checks                 | `golangci-lint`, `shellcheck`, `addlicense` |
+| `make lint-fix`  | As `make lint`, but auto-fixing        | `golangci-lint`, `shellcheck`, `addlicense` |
 | `make test`      | Run all tests with coverage            | `ginkgo`, `setup-envtest`                   |
 | `make clean`     | Remove generated binaries              | -                                           |
 | `make help`      | Show help for all make targets         | -                                           |
@@ -247,7 +248,10 @@ Fix issues with:
 
 ```sh
 make fmt
-make lint
+make lint-fix
 ```
 
+`make lint` reports findings without rewriting files; `make lint-fix` applies what
+`golangci-lint` can fix automatically.
+
 ***
diff --git a/flake.lock b/flake.lock
index d574f8a2..c770b8bb 100644
--- a/flake.lock
+++ b/flake.lock
@@ -15,15 +15,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1785400422,
-        "narHash": "sha256-qi6ILiU/33rVMiVZw6FyJ6f2QHLUKq5bZpEeWAkHJ2k=",
+        "lastModified": 1787317769,
+        "narHash": "sha256-6/17PlPD1wg2zEr+Th4ML28gVoZTNQerAd5/d0Bqmfk=",
         "owner": "opendefensecloud",
         "repo": "dev-kit",
-        "rev": "d7e77446d71c48f01ef471f4ed3e8ac91c829247",
+        "rev": "ee5da7d94ff38d2e9fa54013be970a417ccb1340",
         "type": "github"
       },
       "original": {
         "owner": "opendefensecloud",
+        "ref": "v2.0.0",
         "repo": "dev-kit",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 4affed7a..544bbf52 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,7 +12,7 @@
     };
 
     dev-kit = {
-      url = "github:opendefensecloud/dev-kit";
+      url = "github:opendefensecloud/dev-kit/v2.0.0";
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.go-overlay.follows = "go-overlay";
       inputs.flake-utils.follows = "flake-utils";
@@ -41,6 +41,16 @@
 
           preCommitHooks = {
             commitlint.enable = true;
+
+            # `make lint-fix` is `make lint` with `golangci-lint run --fix`.
+            # Linters that can repair their own findings rewrite the file, so
+            # pre-commit aborts the first attempt with "files were modified by
+            # this hook" and the fix costs a `git add` plus a second `git
+            # commit` rather than a hand edit. Unfixable findings fail
+            # outright. `pass_filenames = false` is inherited from dev-kit's
+            # default, so this lints the whole repo, not just staged files.
+            # CI runs plain `make lint`, which reports rather than rewrites.
+            lint.entry = "make lint-fix";
           };
         };
       }