diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1d8f643..88d9ed2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -40,16 +40,16 @@ make tests
 If you don't use Nix, install the tools yourself:
 
 ```shell
-uv tool install prek            # pre-commit hook runner
-uv tool install ruff            # Python linter and formatter
-uv tool install ty              # Python type checker
-uv tool install codespell       # spell checker
-uv tool install detect-secrets  # secret scanner
-uv tool install tombi           # TOML formatter
-uv tool install zizmor          # GitHub Actions auditor
-brew install actionlint         # GitHub Actions linter
-brew install shellcheck         # shell script linter
-brew install yamlfmt            # YAML formatter
+uv tool install prek                         # pre-commit hook runner
+uv tool install ruff                         # Python linter and formatter
+uv tool install ty                           # Python type checker
+uv tool install codespell                    # spell checker
+uv tool install 'detect-secrets[gibberish]'  # secret scanner
+uv tool install tombi                        # TOML formatter
+uv tool install zizmor                       # GitHub Actions auditor
+brew install actionlint                      # GitHub Actions linter
+brew install shellcheck                      # shell script linter
+brew install yamlfmt                         # YAML formatter
 ```
 
 (`brew` works on both macOS and Linux; your distro's package manager has these too.)
diff --git a/shell.nix b/shell.nix
index a26ab00..31468f8 100644
--- a/shell.nix
+++ b/shell.nix
@@ -20,6 +20,7 @@ pkgs.mkShell {
 
     # Linters and formatters used by the pre-commit hooks
     actionlint
+    cacert
     codespell
     deadnix
     detect-secrets