diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index d83dc1efe44f..fe5ae020247b 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -156,3 +156,6 @@ bdfde18037f8d9f9b641a4016c8ada4dc4cbf856
 
 # nixos/nvidia: apply nixfmt-rfc-style (#313440)
 fbdcdde04a7caa007e825a8b822c75fab9adb2d6
+
+# step-cli: format package.nix with nixfmt (#331629)
+fc7a83f8b62e90de5679e993d4d49ca014ea013d
diff --git a/pkgs/by-name/st/step-cli/package.nix b/pkgs/by-name/st/step-cli/package.nix
index d0d4aacce489..e901cf614f09 100644
--- a/pkgs/by-name/st/step-cli/package.nix
+++ b/pkgs/by-name/st/step-cli/package.nix
@@ -1,41 +1,53 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
-}: let
+  installShellFiles,
+}:
+let
   version = "0.27.2";
 in
-  buildGoModule {
-    pname = "step-cli";
-    inherit version;
+buildGoModule {
+  pname = "step-cli";
+  inherit version;
 
-    src = fetchFromGitHub {
-      owner = "smallstep";
-      repo = "cli";
-      rev = "refs/tags/v${version}";
-      hash = "sha256-9w7rUtlLa1kl9oVboWZWj4eoZh+pPdGsEEQDWYdEMns=";
-    };
+  src = fetchFromGitHub {
+    owner = "smallstep";
+    repo = "cli";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-9w7rUtlLa1kl9oVboWZWj4eoZh+pPdGsEEQDWYdEMns=";
+  };
 
-    ldflags = [
-      "-w"
-      "-s"
-      "-X=main.Version=${version}"
-    ];
+  ldflags = [
+    "-w"
+    "-s"
+    "-X=main.Version=${version}"
+  ];
 
-    preCheck = ''
-      # Tries to connect to smallstep.com
-      rm command/certificate/remote_test.go
-    '';
+  preCheck = ''
+    # Tries to connect to smallstep.com
+    rm command/certificate/remote_test.go
+  '';
 
-    vendorHash = "sha256-GD9TAvWqE3nvgVpoy/4CkkdVxliNMy+GNBXJtGSNVqo=";
+  vendorHash = "sha256-GD9TAvWqE3nvgVpoy/4CkkdVxliNMy+GNBXJtGSNVqo=";
 
-    meta = {
-      description = "Zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";
-      homepage = "https://smallstep.com/cli/";
-      changelog = "https://github.com/smallstep/cli/blob/v${version}/CHANGELOG.md";
-      license = lib.licenses.asl20;
-      maintainers = with lib.maintainers; [isabelroses];
-      platforms = lib.platforms.linux ++ lib.platforms.darwin;
-      mainProgram = "step";
-    };
-  }
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd step \
+      --bash <($out/bin/step completion bash) \
+      --zsh <($out/bin/step completion zsh) \
+      --fish <($out/bin/step completion fish)
+  '';
+
+  meta = {
+    description = "Zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc";
+    homepage = "https://smallstep.com/cli/";
+    changelog = "https://github.com/smallstep/cli/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ isabelroses ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    mainProgram = "step";
+  };
+}