diff --git a/.clang-format b/.clang-format
index 7bd90052ab..23cd9949ad 100644
--- a/.clang-format
+++ b/.clang-format
@@ -69,6 +69,7 @@ IncludeCategories:
   - Regex:           '.*'
     Priority:        0
 IndentExternBlock: NoIndent
+InsertBraces: true
 KeepEmptyLinesAtTheStartOfBlocks: false
 MaxEmptyLinesToKeep: 1
 PenaltyBreakAssignment: 30
@@ -81,3 +82,4 @@ ContinuationIndentWidth: 8
 ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]
 RemoveParentheses: ReturnStatement
 RemoveSemicolon: true
+SpaceBeforeParens: ControlStatementsExceptControlMacros
diff --git a/.clang-format.headers b/.clang-format.headers
index f5a5bae64e..106ad961d2 100644
--- a/.clang-format.headers
+++ b/.clang-format.headers
@@ -69,6 +69,7 @@ IncludeCategories:
   - Regex:           '.*'
     Priority:        0
 IndentExternBlock: NoIndent
+InsertBraces: true
 KeepEmptyLinesAtTheStartOfBlocks: false
 MaxEmptyLinesToKeep: 1
 PenaltyBreakAssignment: 30
@@ -80,3 +81,4 @@ Standard: Cpp11
 ContinuationIndentWidth: 8
 RemoveParentheses: ReturnStatement
 RemoveSemicolon: true
+SpaceBeforeParens: ControlStatementsExceptControlMacros
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 195aadd442..f76db62c66 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -1550,3 +1550,7 @@ c22176c0f9a71217be9bfab00573f8f0265499af
 58a15d38c2c321fac75abef389a48ff82deaccf0
 # Reformat sources with up-to-date clang-format-20
 53738b0e5e0037b7ac8d06e146832d972e2e46d5
+# Add and apply InsertBraces statement
+58791b5cfe8d6d17e05a450fb9cf72cc52472541
+# Use ControlStatementsExceptControlMacros for SpaceBeforeParens
+8f8fb10232eabcee1d78efb52623a07d6326cdb6
diff --git a/lib/dns/acl.c b/lib/dns/acl.c
index 244995c995..29b1212443 100644
--- a/lib/dns/acl.c
+++ b/lib/dns/acl.c
@@ -462,8 +462,7 @@ static void
 dns__acl_destroy_port_transports(dns_acl_t *acl) {
 	dns_acl_port_transports_t *port_proto = NULL;
 	dns_acl_port_transports_t *next = NULL;
-	ISC_LIST_FOREACH_SAFE (acl->ports_and_transports, port_proto, link,
-			       next)
+	ISC_LIST_FOREACH_SAFE(acl->ports_and_transports, port_proto, link, next)
 	{
 		ISC_LIST_DEQUEUE(acl->ports_and_transports, port_proto, link);
 		isc_mem_put(acl->mctx, port_proto, sizeof(*port_proto));
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 56b9578810..8b9fd19bd7 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -472,7 +472,7 @@ static void
 msgresetname(dns_message_t *msg, dns_name_t *name) {
 	dns_rdataset_t *rds = NULL, *next_rds = NULL;
 
-	ISC_LIST_FOREACH_SAFE (name->list, rds, link, next_rds) {
+	ISC_LIST_FOREACH_SAFE(name->list, rds, link, next_rds) {
 		ISC_LIST_UNLINK(name->list, rds, link);
 
 		dns__message_putassociatedrdataset(msg, &rds);
@@ -485,8 +485,7 @@ msgresetnames(dns_message_t *msg, unsigned int first_section) {
 	for (size_t i = first_section; i < DNS_SECTION_MAX; i++) {
 		dns_name_t *name = NULL, *next_name = NULL;
 
-		ISC_LIST_FOREACH_SAFE (msg->sections[i], name, link, next_name)
-		{
+		ISC_LIST_FOREACH_SAFE(msg->sections[i], name, link, next_name) {
 			ISC_LIST_UNLINK(msg->sections[i], name, link);
 
 			msgresetname(msg, name);
@@ -814,7 +813,7 @@ findname(dns_name_t **foundname, const dns_name_t *target,
 	 dns_namelist_t *section) {
 	dns_name_t *name = NULL;
 
-	ISC_LIST_FOREACH_REV (*section, name, link) {
+	ISC_LIST_FOREACH_REV(*section, name, link) {
 		if (dns_name_equal(name, target)) {
 			if (foundname != NULL) {
 				*foundname = name;
@@ -855,7 +854,7 @@ dns_message_findtype(const dns_name_t *name, dns_rdatatype_t type,
 	REQUIRE(name != NULL);
 	REQUIRE(rdatasetp == NULL || *rdatasetp == NULL);
 
-	ISC_LIST_FOREACH_REV (name->list, rds, link) {
+	ISC_LIST_FOREACH_REV(name->list, rds, link) {
 		if (rds->type == type && rds->covers == covers) {
 			SET_IF_NOT_NULL(rdatasetp, rds);
 
@@ -971,7 +970,7 @@ getrdata(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 static void
 cleanup_name_hashmaps(dns_namelist_t *section) {
 	dns_name_t *name = NULL;
-	ISC_LIST_FOREACH (*section, name, link) {
+	ISC_LIST_FOREACH(*section, name, link) {
 		if (name->hashmap != NULL) {
 			isc_hashmap_destroy(&name->hashmap);
 		}
@@ -2415,9 +2414,9 @@ dns_message_renderreset(dns_message_t *msg) {
 
 		msg->cursors[i] = NULL;
 		msg->counts[i] = 0;
-		ISC_LIST_FOREACH (msg->sections[i], name, link) {
+		ISC_LIST_FOREACH(msg->sections[i], name, link) {
 			dns_rdataset_t *rds = NULL;
-			ISC_LIST_FOREACH (name->list, rds, link) {
+			ISC_LIST_FOREACH(name->list, rds, link) {
 				rds->attributes &= ~DNS_RDATASETATTR_RENDERED;
 			}
 		}
@@ -3417,7 +3416,7 @@ dns_message_sectiontotext(dns_message_t *msg, dns_section_t section,
 		dns_message_currentname(msg, section, &name);
 
 		dns_rdataset_t *rds = NULL;
-		ISC_LIST_FOREACH (name->list, rds, link) {
+		ISC_LIST_FOREACH(name->list, rds, link) {
 			if (section == DNS_SECTION_ANSWER &&
 			    rds->type == dns_rdatatype_soa)
 			{
@@ -5072,7 +5071,7 @@ message_authority_soa_min(dns_message_t *msg, dns_ttl_t *ttlp) {
 		dns_message_currentname(msg, DNS_SECTION_AUTHORITY, &name);
 
 		dns_rdataset_t *rds = NULL;
-		ISC_LIST_FOREACH (name->list, rds, link) {
+		ISC_LIST_FOREACH(name->list, rds, link) {
 			if ((rds->attributes & DNS_RDATASETATTR_RENDERED) == 0)
 			{
 				continue;
diff --git a/lib/dns/request.c b/lib/dns/request.c
index 38130e80bf..052c9f1081 100644
--- a/lib/dns/request.c
+++ b/lib/dns/request.c
@@ -174,7 +174,7 @@ requests_cancel(void *arg) {
 	dns_request_t *request = NULL, *next = NULL;
 	uint32_t tid = isc_tid();
 
-	ISC_LIST_FOREACH_SAFE (requestmgr->requests[tid], request, link, next) {
+	ISC_LIST_FOREACH_SAFE(requestmgr->requests[tid], request, link, next) {
 		req_log(ISC_LOG_DEBUG(3), "%s(%" PRIu32 ": request %p",
 			__func__, tid, request);
 		if (DNS_REQUEST_COMPLETE(request)) {
diff --git a/lib/isc/httpd.c b/lib/isc/httpd.c
index 2d67ecc28d..a64b913d94 100644
--- a/lib/isc/httpd.c
+++ b/lib/isc/httpd.c
@@ -291,7 +291,7 @@ destroy_httpdmgr(isc_httpdmgr_t *httpdmgr) {
 	 * memory.
 	 */
 	isc_httpdurl_t *url, *next;
-	ISC_LIST_FOREACH_SAFE (httpdmgr->urls, url, link, next) {
+	ISC_LIST_FOREACH_SAFE(httpdmgr->urls, url, link, next) {
 		isc_mem_free(httpdmgr->mctx, url->url);
 		ISC_LIST_UNLINK(httpdmgr->urls, url, link);
 		isc_mem_put(httpdmgr->mctx, url, sizeof(isc_httpdurl_t));
@@ -781,7 +781,7 @@ prepare_response(void *arg) {
 	}
 
 	LOCK(&mgr->lock);
-	ISC_LIST_FOREACH (mgr->urls, url, link) {
+	ISC_LIST_FOREACH(mgr->urls, url, link) {
 		if (strncmp(path, url->url, path_len) == 0) {
 			break;
 		}
@@ -980,7 +980,7 @@ isc_httpdmgr_shutdown(isc_httpdmgr_t **httpdmgrp) {
 	LOCK(&httpdmgr->lock);
 
 	isc_httpd_t *httpd = NULL, *next = NULL;
-	ISC_LIST_FOREACH_SAFE (httpdmgr->running, httpd, link, next) {
+	ISC_LIST_FOREACH_SAFE(httpdmgr->running, httpd, link, next) {
 		if (httpd->handle != NULL) {
 			httpd_request(httpd->handle, ISC_R_SUCCESS, NULL,
 				      httpd);
diff --git a/lib/isc/os.c b/lib/isc/os.c
index 9465234f96..aa48c31791 100644
--- a/lib/isc/os.c
+++ b/lib/isc/os.c
@@ -87,8 +87,9 @@ sched_affinity_ncpus(void) {
 		int i, n = 0;
 
 		for (i = 0; i < CPU_SETSIZE; ++i) {
-			if (CPU_ISSET(i, &cpus))
+			if (CPU_ISSET(i, &cpus)) {
 				++n;
+			}
 		}
 		return n;
 #endif
@@ -115,8 +116,9 @@ cpuset_affinity_ncpus(void) {
 	if (result != -1) {
 		int i, n = 0;
 		for (i = 0; i < CPU_SETSIZE; ++i) {
-			if (CPU_ISSET(i, &cpus))
+			if (CPU_ISSET(i, &cpus)) {
 				++n;
+			}
 		}
 		return n;
 	}
diff --git a/lib/isc/picohttpparser.c b/lib/isc/picohttpparser.c
index 708265f60e..933137714b 100644
--- a/lib/isc/picohttpparser.c
+++ b/lib/isc/picohttpparser.c
@@ -752,7 +752,9 @@ Exit:
 		if (decoder->_total_overhead >= 100 * 1024 &&
 		    decoder->_total_read - decoder->_total_overhead <
 			    decoder->_total_read / 4)
+		{
 			ret = -1;
+		}
 	}
 	return ret;
 }