{
  description = "Hardened NixOS — VM/ISO testing";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    impermanence.url = "github:nix-community/impermanence";
    lanzaboote = {
      url = "github:nix-community/lanzaboote";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    disko = {
      url = "github:nix-community/disko/latest";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    agenix = {
      url = "github:ryantm/agenix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

  outputs = {
    self,
    nixpkgs,
    ...
  } @ inputs: let
    system = "x86_64-linux";
    lib = nixpkgs.lib;

    mkHardened = {modules ? []}:
      lib.nixosSystem {
        inherit system;
        specialArgs = {
          inherit inputs;
          nixpkgsPath = nixpkgs.outPath;
        };
        modules =
          [
            ./configuration.nix
          ]
          ++ modules;
      };

    pkgs = nixpkgs.legacyPackages.${system};
  in {
    nixosConfigurations = {
      vm = mkHardened {
        modules = [
          ./hardware-vm.nix
        ];
      };
      iso = mkHardened {
        modules = [
          {
            systemd.services.install = {
              description = "Install NixOS";
              wantedBy = ["multi-user.target"];
              after = ["network.target"];
              script = ''
                echo "Run: disko-install --flake .#vm --write-efi-boot-entries --disk vda /dev/vda"
              '';
            };
          }
        ];
      };
    };

    packages.${system} = {
      default = pkgs.just;
      qcow = (mkHardened {}).config.system.build.qemu-efi;
    };
  };
}