diff --git a/ci_scripts/dump-typedefs.sh b/ci_scripts/dump-typedefs.sh
index a656e26..64b2585 100755
--- a/ci_scripts/dump-typedefs.sh
+++ b/ci_scripts/dump-typedefs.sh
@@ -19,4 +19,8 @@ fi
   ../postgres/src/tools/find_typedef .
   wget -q -O - "https://buildfarm.postgresql.org/cgi-bin/typedefs.pl?branch=REL_17_STABLE"
   wget -q -O - "https://buildfarm.postgresql.org/cgi-bin/typedefs.pl?branch=REL_18_STABLE"
+  # find_typedef does not reliably emit this project's local typedefs (its
+  # output depends on the debug info of the build it scans), which makes the
+  # pgindent check flap. Always include them so the result is deterministic.
+  cat "$SCRIPT_DIR/tde_typedefs.list"
 ) | sort -u > ../src/typedefs.list
diff --git a/ci_scripts/run-pgindent.sh b/ci_scripts/run-pgindent.sh
index f66d880..4eeebf0 100755
--- a/ci_scripts/run-pgindent.sh
+++ b/ci_scripts/run-pgindent.sh
@@ -18,5 +18,9 @@ cd "$SCRIPT_DIR/.."
 
 export PATH=$SCRIPT_DIR/../../postgres/src/tools/pgindent/:$INSTALL_DIR/bin/:$PATH
 
-# Check open_pg_tde with the fresh list extraxted from the object file
-pgindent --typedefs=typedefs.list --excludes=<(echo "src/libkmip") "$@" .
+# Check open_pg_tde with the fresh list extraxted from the object file.
+# src/libkmip and fetools/ are vendored copies of third-party / upstream
+# PostgreSQL code; keeping them close to their source matters more than
+# pgindent conformance, so they are excluded.
+pgindent --typedefs=typedefs.list \
+	--excludes=<(printf 'src/libkmip\nfetools\n') "$@" .
diff --git a/ci_scripts/tde_typedefs.list b/ci_scripts/tde_typedefs.list
new file mode 100644
index 0000000..7358628
--- /dev/null
+++ b/ci_scripts/tde_typedefs.list
@@ -0,0 +1,62 @@
+AesCtxCache
+CipherType
+CurlString
+EncryptionMix
+EncryptionStateData
+FileKeyring
+GenericKeyring
+InternalKey
+JsonKeyringField
+JsonKeyringSemState
+JsonKeyringState
+JsonOpenBaoMountInfoState
+JsonOpenBaoRespField
+JsonOpenBaoRespMountInfoSemState
+JsonOpenBaoRespSemState
+JsonOpenBaoRespState
+KeyData
+KeyInfo
+KeyProviderSharedState
+KeyringProviderRecord
+KeyringProviderRecordInFile
+KeyringReturnCode
+keys_version_info
+KmipCtx
+KmipKeyring
+MapFromDiskEntry
+OpenBaoKeyring
+ProviderScanType
+ProviderType
+RegisteredKeyProviderType
+TdeBlockCryptFn
+TdeCipher
+TdeDdlEvent
+TDEEncryptMode
+TDEFileHeader
+TDEKeyringRoutine
+TdeKeystreamFn
+TDEMapEntry
+TDEMapEntryType
+TDEMapEntryV3
+TDEMapEntryV4
+TDEMapEntryV5
+TDEMgrRelationEncryptionStatus
+TDEPrincipalKey
+TDEPrincipalKeyInfo
+TdePrincipalKeylocalState
+TdePrincipalKeySharedState
+TDESignedPrincipalKeyInfo
+TDESMgrRelation
+TempRelKeyEntry
+WalEncryptionRange
+WalEncryptionRangeType
+WalEntryFromDiskEntry
+WALKeyCacheRec
+WalKeyFileEntry
+WalKeyFileEntryV1
+WalKeyFileEntryV2
+WalKeyFileHeader
+WalLocation
+XLogExtensionInstall
+XLogPrincipalKeyRotate
+XLogRelKey
diff --git a/src/access/open_pg_tde_tdemap.c b/src/access/open_pg_tde_tdemap.c
index 97bc9fd..4995e86 100644
--- a/src/access/open_pg_tde_tdemap.c
+++ b/src/access/open_pg_tde_tdemap.c
@@ -47,7 +47,7 @@ typedef enum
 {
 	MAP_ENTRY_TYPE_EMPTY = 0,
 	MAP_ENTRY_TYPE_KEY = 1,
-}			TDEMapEntryType;
+} TDEMapEntryType;
 
 typedef struct TDEFileHeader
 {
@@ -1021,10 +1021,10 @@ typedef struct TDEMapEntryV4
 	unsigned char aead_tag[MAP_ENTRY_AEAD_TAG_SIZE];
 	uint8		key_base_iv[INTERNAL_KEY_IV_LEN];
 	uint8		encrypted_key_data[32];
-}			TDEMapEntryV4;
+} TDEMapEntryV4;
 
 static bool
-read_one_map_entry_v4(int fd, TDEMapEntryV4 * entry, off_t *offset)
+read_one_map_entry_v4(int fd, TDEMapEntryV4 *entry, off_t *offset)
 {
 	int			bytes_read = pg_pread(fd, entry, sizeof(TDEMapEntryV4), *offset);
 
@@ -1038,7 +1038,7 @@ read_one_map_entry_v4(int fd, TDEMapEntryV4 * entry, off_t *offset)
 }
 
 static void
-ikey_from_map_entry_v4(TDEMapEntryV4 * entry, const TDEPrincipalKey *principal_key, InternalKey *out)
+ikey_from_map_entry_v4(TDEMapEntryV4 *entry, const TDEPrincipalKey *principal_key, InternalKey *out)
 {
 	out->key_len = open_pg_tde_cipher_key_length(entry->cipher);
 	out->cipher = entry->cipher;