diff --git a/.circleci/config.yml b/.circleci/config.yml
index d885e6f79a..f0ced96bae 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -146,6 +146,7 @@ jobs:
     - CIRCLECI_CLI_VERSION: 0.1.5546
     - GO_TAGS: ''
     - GO_VERSION: 1.17.5
+    - GOFUMPT_VERSION: 0.2.1
     - GOTESTSUM_VERSION: 0.5.2
   algolia-index:
     docker:
@@ -360,6 +361,46 @@ jobs:
     environment:
     - CIRCLECI_CLI_VERSION: 0.1.5546
     - GO_TAGS: ''
+  fmt:
+    machine: true
+    shell: /usr/bin/env bash -euo pipefail -c
+    working_directory: /home/circleci/go/src/github.com/hashicorp/vault
+    steps:
+    - run:
+        command: |
+          [ -n "$GO_VERSION" ] || { echo "You must set GO_VERSION"; exit 1; }
+          # Install Go
+          curl -sSLO "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz"
+          sudo rm -rf /usr/local/go
+          sudo tar -C /usr/local -xzf "go${GO_VERSION}.linux-amd64.tar.gz"
+          rm -f "go${GO_VERSION}.linux-amd64.tar.gz"
+          GOPATH="/home/circleci/go"
+          mkdir $GOPATH 2>/dev/null || { sudo mkdir $GOPATH && sudo chmod 777 $GOPATH; }
+          echo "export GOPATH='$GOPATH'" >> "$BASH_ENV"
+          echo "export PATH='$PATH:$GOPATH/bin:/usr/local/go/bin'" >> "$BASH_ENV"
+          echo "export GOPROXY=https://proxy.golang.org,direct" >> "$BASH_ENV"
+          echo "export GOPRIVATE=github.com/hashicorp/*" >> "$BASH_ENV"
+
+          echo "$ go version"
+          go version
+        name: Setup Go
+        working_directory: ~/
+    - checkout
+    - run:
+        command: |
+          go install "mvdan.cc/gofumpt@v${GOFUMPT_VERSION}"
+          make fmt
+          if ! git diff --exit-code; then
+            echo "Code has formatting errors. Run 'make fmt' to fix"
+            exit 1
+          fi
+        name: make fmt
+    environment:
+    - CIRCLECI_CLI_VERSION: 0.1.5546
+    - GO_TAGS: ''
+    - GO_VERSION: 1.17.5
+    - GOFUMPT_VERSION: 0.2.1
+    - GOTESTSUM_VERSION: 0.5.2
   test-go-race:
     docker:
     - image: docker.mirror.hashicorp.services/cimg/go:1.17.5
@@ -841,6 +882,7 @@ jobs:
     - CIRCLECI_CLI_VERSION: 0.1.5546
     - GO_TAGS: ''
     - GO_VERSION: 1.17.5
+    - GOFUMPT_VERSION: 0.2.1
     - GOTESTSUM_VERSION: 0.5.2
   test-go-race-remote-docker:
     docker:
@@ -1043,6 +1085,7 @@ workflows:
   ci:
     jobs:
     - pre-flight-checks
+    - fmt
     - install-ui-dependencies:
         requires:
         - pre-flight-checks
diff --git a/.circleci/config/executors/@executors.yml b/.circleci/config/executors/@executors.yml
index 092349046d..a97895c42d 100644
--- a/.circleci/config/executors/@executors.yml
+++ b/.circleci/config/executors/@executors.yml
@@ -5,6 +5,7 @@ go-machine:
     CIRCLECI_CLI_VERSION: 0.1.5546  # Pin CircleCI CLI to patch version (ex: 1.2.3)
     GO_VERSION: 1.17.5  # Pin Go to patch version (ex: 1.2.3)
     GOTESTSUM_VERSION: 0.5.2  # Pin gotestsum to patch version (ex: 1.2.3)
+    GOFUMPT_VERSION: 0.2.1  # Pin gofumpt to patch version (ex: 1.2.3)
     GO_TAGS: ""
   working_directory: /home/circleci/go/src/github.com/hashicorp/vault
 node:
diff --git a/.circleci/config/jobs/fmt.yml b/.circleci/config/jobs/fmt.yml
new file mode 100644
index 0000000000..29a8a70d76
--- /dev/null
+++ b/.circleci/config/jobs/fmt.yml
@@ -0,0 +1,16 @@
+description: Ensure go formatting is correct.
+executor: go-machine
+steps:
+  # Setup Go enabling the proxy for downloading modules.
+  - setup-go:
+      GOPROXY: https://proxy.golang.org,direct
+  - checkout
+  - run:
+      name: make fmt
+      command: |
+        go install "mvdan.cc/gofumpt@v${GOFUMPT_VERSION}"
+        make fmt
+        if ! git diff --exit-code; then
+          echo "Code has formatting errors. Run 'make fmt' to fix"
+          exit 1
+        fi
diff --git a/.circleci/config/workflows/ci.yml b/.circleci/config/workflows/ci.yml
index 15c6b7f405..5a7aa75200 100644
--- a/.circleci/config/workflows/ci.yml
+++ b/.circleci/config/workflows/ci.yml
@@ -1,5 +1,6 @@
 jobs:
   - pre-flight-checks
+  - fmt
   - install-ui-dependencies:
       requires:
         - pre-flight-checks
diff --git a/builtin/logical/pki/backend_test.go b/builtin/logical/pki/backend_test.go
index 1cb5dd1cbe..61c1324f88 100644
--- a/builtin/logical/pki/backend_test.go
+++ b/builtin/logical/pki/backend_test.go
@@ -46,9 +46,7 @@ import (
 	"golang.org/x/net/idna"
 )
 
-var (
-	stepCount = 0
-)
+var stepCount = 0
 
 func TestPKI_RequireCN(t *testing.T) {
 	coreConfig := &vault.CoreConfig{
diff --git a/builtin/logical/pki/managed_key_util.go b/builtin/logical/pki/managed_key_util.go
index 85395f50c8..8efcaefb63 100644
--- a/builtin/logical/pki/managed_key_util.go
+++ b/builtin/logical/pki/managed_key_util.go
@@ -5,9 +5,10 @@ package pki
 import (
 	"context"
 	"errors"
+	"io"
+
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/logical"
-	"io"
 )
 
 var errEntOnly = errors.New("managed keys are supported within enterprise edition only")
diff --git a/builtin/logical/pki/path_intermediate.go b/builtin/logical/pki/path_intermediate.go
index 84ae0449c1..318f9afbef 100644
--- a/builtin/logical/pki/path_intermediate.go
+++ b/builtin/logical/pki/path_intermediate.go
@@ -181,7 +181,6 @@ func (b *backend) pathSetSignedIntermediate(ctx context.Context, req *logical.Re
 	}
 
 	parsedCB, err := parseCABundle(ctx, b, req, cb)
-
 	if err != nil {
 		return nil, err
 	}
diff --git a/builtin/logical/pki/util.go b/builtin/logical/pki/util.go
index 8436716361..566c49e223 100644
--- a/builtin/logical/pki/util.go
+++ b/builtin/logical/pki/util.go
@@ -2,13 +2,14 @@ package pki
 
 import (
 	"fmt"
-	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"strings"
+
+	"github.com/hashicorp/vault/sdk/helper/errutil"
 )
 
 const (
 	managedKeyNameArg = "managed_key_name"
-	managedKeyIdArg = "managed_key_id"
+	managedKeyIdArg   = "managed_key_id"
 )
 
 func normalizeSerial(serial string) string {
diff --git a/plugins/database/mssql/mssql.go b/plugins/database/mssql/mssql.go
index ef627fb04e..00f1773a1e 100644
--- a/plugins/database/mssql/mssql.go
+++ b/plugins/database/mssql/mssql.go
@@ -216,8 +216,7 @@ func (m *MSSQL) revokeUserDefault(ctx context.Context, username string) error {
 
 	// Check if DB is contained
 	if m.containedDB {
-		revokeQuery :=
-			`DECLARE @stmt nvarchar(max);
+		revokeQuery := `DECLARE @stmt nvarchar(max);
 			SET @stmt = 'DROP USER IF EXISTS ' + QuoteName(@username);
 			EXEC(@stmt);`
 		revokeStmt, err := db.PrepareContext(ctx, revokeQuery)
@@ -232,12 +231,11 @@ func (m *MSSQL) revokeUserDefault(ctx context.Context, username string) error {
 	}
 
 	// First disable server login
-	disableQuery :=
-		`DECLARE @stmt nvarchar(max);
+	disableQuery := `DECLARE @stmt nvarchar(max);
 		SET @stmt = 'ALTER LOGIN ' + QuoteName(@username) + ' DISABLE';
 		EXEC(@stmt);`
 	disableStmt, err := db.PrepareContext(ctx, disableQuery)
-	if err != nil{
+	if err != nil {
 		return err
 	}
 	defer disableStmt.Close()
diff --git a/sdk/helper/certutil/types.go b/sdk/helper/certutil/types.go
index c0c3769f99..f384fa5009 100644
--- a/sdk/helper/certutil/types.go
+++ b/sdk/helper/certutil/types.go
@@ -169,7 +169,7 @@ type PrivateKeyExtractor func(c *CertBundle, parsedBundle *ParsedCertBundle) err
 func (c *CertBundle) ToParsedCertBundleWithExtractor(privateKeyExtractor PrivateKeyExtractor) (*ParsedCertBundle, error) {
 	var err error
 	var pemBlock *pem.Block
-	var result = &ParsedCertBundle{}
+	result := &ParsedCertBundle{}
 
 	err = privateKeyExtractor(c, result)
 	if err != nil {