diff --git a/.envrc b/.envrc
index 5c6acf6f..12140103 100644
--- a/.envrc
+++ b/.envrc
@@ -8,6 +8,6 @@ if has nix_direnv_version; then
   watch_file modules/flake/programs/shell.nix
   watch_file modules/flake/programs/formatter.nix
 
-  # now we want to load the flake environment
-  use flake
+  # now we want to load the (npins-backed) shell environment
+  use nix
 fi
diff --git a/.github/workflows/build-isos.yml b/.github/workflows/build-isos.yml
index fe9ea838..f5b6e12e 100644
--- a/.github/workflows/build-isos.yml
+++ b/.github/workflows/build-isos.yml
@@ -43,12 +43,12 @@ jobs:
       - name: Build Lilith Iso
         continue-on-error: false
         run: |
-          nix build -L .#nixosConfigurations.lilith.config.system.build.isoImage
+          nix-shell --run 'just iso lilith'
           cp result/iso/*.iso ./lilith.iso
 
       - name: Build config
         run: |
-          nix build -L .#nixosConfigurations.amaterasu.config.home-manager.users.isabel.home-files
+          nix build --file default.nix nixosConfigurations.amaterasu.config.home-manager.users.isabel.home-files --option pure-eval true
           tar -czvhf dotfiles.tar.gz result/
 
       - name: Upload Release Artifacts
diff --git a/.github/workflows/check-lock.yml b/.github/workflows/check-lock.yml
deleted file mode 100644
index edd9fc32..00000000
--- a/.github/workflows/check-lock.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-name: Validate Flake Lock
-
-on:
-  workflow_dispatch:
-  push:
-    paths:
-      - "**.lock"
-
-permissions: {}
-
-jobs:
-  check-flake:
-    name: Check Lock
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Install Lix
-        uses: ./.github/actions/install-lix
-
-      - name: Check flake.lock
-        run: nix run github:extersia-org/pkgs#locker
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 6667187d..82391f23 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -1,11 +1,11 @@
-name: Validate Nix Flake
+name: Validate Nix Config
 
 on:
   workflow_dispatch:
   push:
     paths:
       - "**.nix"
-      - "**.lock"
+      - "npins/sources.json"
       - ".github/workflows/check.yml"
       - ".github/actions/**/*"
 
@@ -33,5 +33,5 @@ jobs:
       - name: Install Lix
         uses: ./.github/actions/install-lix
 
-      - name: Check Flake
-        run: nix flake check --show-trace --option allow-import-from-derivation false
+      - name: Check
+        run: nix-shell --run 'just check'
diff --git a/.github/workflows/diff.yml b/.github/workflows/diff.yml
index 413596cf..be200274 100644
--- a/.github/workflows/diff.yml
+++ b/.github/workflows/diff.yml
@@ -30,7 +30,7 @@ jobs:
             # shellcheck disable=SC2016
             nix eval --impure --json --expr '
               let
-                flake = (builtins.getFlake (toString ./.)).outputs;
+                flake = import ./. { };
                 mk = attr: toplevel:
                   map (name: {
                     displayName = name;
@@ -78,7 +78,7 @@ jobs:
           # shellcheck disable=SC2016
           nix eval --impure --json --expr '
             let
-              flake = (builtins.getFlake (toString ./.)).outputs;
+              flake = import ./. { };
               mk = attr: toplevel:
                 map (name: {
                   inherit name;
@@ -97,7 +97,7 @@ jobs:
           while IFS=$'\t' read -r name attr; do
             echo "::group::eval before: $name"
             NIX_SHOW_STATS=1 NIX_SHOW_STATS_PATH="../stats-before/all/${name}.json" \
-              nix eval --no-eval-cache ".#${attr}" > /dev/null || \
+              nix eval --no-eval-cache --file default.nix "${attr}" --option pure-eval true > /dev/null || \
               echo "warning: eval failed for $name (before)"
             echo "::endgroup::"
           done < <(jq -r '.[] | "\(.name)\t\(.attribute)"' ../hosts.json)
@@ -109,7 +109,7 @@ jobs:
           while IFS=$'\t' read -r name attr; do
             echo "::group::eval after: $name"
             NIX_SHOW_STATS=1 NIX_SHOW_STATS_PATH="stats-after/all/${name}.json" \
-              nix eval --no-eval-cache ".#${attr}" > /dev/null || \
+              nix eval --no-eval-cache --file default.nix "${attr}" --option pure-eval true > /dev/null || \
               echo "warning: eval failed for $name (after)"
             echo "::endgroup::"
           done < <(jq -r '.[] | "\(.name)\t\(.attribute)"' hosts.json)
@@ -117,13 +117,14 @@ jobs:
       - name: Compare stats
         run: |
           set -euo pipefail
+          cmp_stats="$(nix build --file default.nix packages.cmp-stats --option pure-eval true --no-link --print-out-paths)/bin/cmp-stats"
           {
             echo "<!-- nix-eval-stats -->"
             echo "## Nix Eval Stats"
             echo
             echo "Paired comparison across $(jq 'length' hosts.json) host(s). Metrics with identical values across all hosts are listed under _Unchanged_; the rest get a paired t-test (p-value, t-stat)."
             echo
-            nix run .#cmp-stats -- --explain stats-before stats-after
+            "$cmp_stats" --explain stats-before stats-after
           } > stats-table.md
 
       - name: Post comment
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 9c49ceb0..bb9c1260 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -27,7 +27,7 @@ jobs:
         uses: ./.github/actions/install-lix
 
       - name: Build docs
-        run: nix build .#docs
+        run: nix-shell --run 'just docs'
 
       - name: Upload Pages Artifact
         uses: "actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9" # v5.0.0
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 9011b5bc..ad14e130 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -1,4 +1,4 @@
-name: Bump Flake Inputs
+name: Bump npins Sources
 
 on:
   workflow_dispatch:
@@ -8,7 +8,7 @@ on:
 permissions: {}
 
 jobs:
-  update-lockfile:
+  update-sources:
     runs-on: ubuntu-latest
     environment: production
 
@@ -21,30 +21,47 @@ jobs:
       - name: Install Lix
         uses: ./.github/actions/install-lix
 
-      - name: Update Lockfile
+      - name: Update sources & open PR
         id: pr
-        uses: DeterminateSystems/update-flake-lock@c5930b397a673a70ca70be06020e943aeac310a1 # v27
-        with:
-          token: ${{ secrets.GH_TOKEN_UPDATES }}
-          git-author-name: bell's bot
-          git-author-email: bot@isabelroses.com
-          git-committer-name: bell's bot
-          git-committer-email: bot@isabelroses.com
-          commit-msg: "flake.lock: update all inputs"
-          pr-title: "flake.lock: update all inputs"
-          branch: update-flake-inputs
-          pr-body: |
-            ```
-            {{ env.GIT_COMMIT_MESSAGE }}
-            ```
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN_UPDATES }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          git config user.name "bell's bot"
+          git config user.email "bot@isabelroses.com"
+
+          nix-shell --run 'npins update'
+
+          if git diff --quiet -- npins/sources.json; then
+            echo "sources already up to date"
+            exit 0
+          fi
+
+          branch="update-npins-sources"
+          git switch -C "$branch"
+          git commit -am "npins: update sources"
+          git push --force "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" "HEAD:${branch}"
+
+          url="$(gh pr view "$branch" --json url --jq .url 2>/dev/null || true)"
+          if [ -z "$url" ]; then
+            url="$(gh pr create \
+              --title "npins: update sources" \
+              --body "Automated npins source update." \
+              --base main \
+              --head "$branch")"
+          fi
+          echo "url=$url" >> "$GITHUB_OUTPUT"
 
       - name: Wait for Checks & Merge
+        if: steps.pr.outputs.url != ''
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN_UPDATES }}
+          PR: ${{ steps.pr.outputs.url }}
         run: |
           # we can't instantly check for ci status or it errors; so lets horribly wait then
           # then check and watch ci status then merge
           sleep 30
           gh pr checks "$PR" --watch --fail-fast
           gh pr merge --rebase --delete-branch "$PR"
-        env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN_UPDATES }}
-          PR: ${{ steps.pr.outputs.pull-request-url }}
diff --git a/default.nix b/default.nix
new file mode 100644
index 00000000..bd8b3708
--- /dev/null
+++ b/default.nix
@@ -0,0 +1,87 @@
+{
+  sources ? import ./npins,
+  nixpkgs ? sources.nixpkgs,
+  system ? builtins.currentSystem,
+  lib ? import "${sources.nixpkgs}/lib",
+  pkgs ? import nixpkgs { inherit system; },
+}:
+let
+  outPath = ./modules/flake;
+  importOutput = path: import (outPath + path);
+
+  mkHost = import ./eval-config.nix { inherit lib sources; };
+  mkHosts = lib.mapAttrs mkHost;
+in
+lib.fix (self: {
+  inputs =
+    import ./flake-npins-shim.nix {
+      inherit pkgs sources;
+    }
+    // {
+      # lets access self. but we don't want to endlessly add inputs to self or we will IR
+      self = (lib.removeAttrs self [ "inputs" ]) // {
+        outPath = lib.fileset.toSource {
+          root = ./.;
+          fileset = lib.fileset.gitTracked ./.;
+        };
+      };
+    };
+
+  # a raw unfilted scope of packages
+  packages = importOutput /packages {
+    inherit pkgs;
+    inherit (self) inputs;
+  };
+
+  devShells.default = pkgs.callPackage (outPath + /programs/shell.nix) {
+    treefmt-wrapped = self.formatter;
+  };
+
+  lib = importOutput /lib {
+    inherit lib;
+    inherit (self) inputs;
+  };
+
+  checks = importOutput /checks {
+    inherit pkgs;
+    inherit (self) inputs;
+  };
+
+  formatter = pkgs.callPackage (outPath + /programs/formatter.nix) { };
+
+  # This is the list of system configuration
+  #
+  # the defaults consists of the following:
+  #  arch = "x86_64";
+  #  class = "nixos";
+  nixosConfigurations = mkHosts {
+    # keep-sorted start block=yes newline_separated=yes
+    amaterasu = { };
+
+    aphrodite = { };
+
+    athena = { };
+
+    isis = { };
+
+    lilith = {
+      class = "iso";
+    };
+
+    minerva = { };
+
+    skadi = {
+      arch = "aarch64";
+    };
+    # keep-sorted end
+  };
+
+  darwinConfigurations = mkHosts {
+    # keep-sorted start block=yes newline_separated=yes
+    tatsumaki = {
+      arch = "aarch64";
+      class = "darwin";
+    };
+    #keep-sorted end
+  };
+})
diff --git a/docs/src/content/docs/design/lix.md b/docs/src/content/docs/design/lix.md
index 9a2605a8..f689ad67 100644
--- a/docs/src/content/docs/design/lix.md
+++ b/docs/src/content/docs/design/lix.md
@@ -12,7 +12,7 @@ Furthermore this is with a custom patch set through [izlix](https://github.com/i
 This flake makes a point of using Lix where possible. The package is wired up directly in [`modules/base/nix/nix.nix`](https://github.com/isabelroses/dotfiles/blob/main/modules/base/nix/nix.nix) via:
 
 ```nix
-nix.package = inputs'.izlix.packages.lix;
+nix.package = inputs.izlix.packages.lix;
 ```
 
 If you'd rather use upstream Lix without my patches, swap `izlix` for the `lix-module`/`lix` flake of your choice.
diff --git a/modules/flake/lib/mkhost.nix b/eval-config.nix
similarity index 78%
rename from modules/flake/lib/mkhost.nix
rename to eval-config.nix
index 08521f16..00b76130 100644
--- a/modules/flake/lib/mkhost.nix
+++ b/eval-config.nix
@@ -1,12 +1,7 @@
 {
   lib,
-  inputs,
+  sources,
 }:
-let
-  inherit (inputs) self;
-
-  inherit (lib.attrsets) mapAttrs;
-in
 /**
   mkHost is a function that uses withSystem to give us inputs' and self'
   it also assumes the the system type either nixos or darwin and uses the appropriate
@@ -32,7 +27,7 @@ name:
   class ? "nixos",
 }:
 let
-  inherit (inputs) darwin nixpkgs;
+  inherit (sources) darwin nixpkgs;
 
   os =
     {
@@ -42,20 +37,24 @@ let
     .${class} or class;
   system = "${arch}-${os}";
 
-  evalHost = if class == "darwin" then darwin.lib.darwinSystem else nixpkgs.lib.nixosSystem;
+  evalHost =
+    if class == "darwin" then
+      import "${darwin}/eval-config.nix"
+    else
+      import "${nixpkgs}/nixos/lib/eval-config.nix";
 
-  # since i'm not using flake.parts at this current time but i still want the
-  # power that comes with using flake.parts i effectively recreate `inputs'`
-  # here. i wrote about this in my blog post:
-  # <https://isabelroses.com/blog/custom-lib-nixossystem/#the-final-touch>
-  inputs' = mapAttrs (_: mapAttrs (_: v: v.${system} or v)) inputs;
+  inherit (import ./default.nix { inherit system; }) inputs;
+  inherit (inputs) self;
 in
 evalHost {
+  # this is the default for nixosSystem but we are really adding it for nix-darwin
+  lib = import "${nixpkgs}/lib";
+
   # `specialArgs` should only be used for arguments that need to be evaluated
   # when resolving module structure (like in imports). for everything else we
   # have `_module.args`
   specialArgs = {
-    inherit inputs self;
+    inherit self inputs;
   };
 
   modules = [
@@ -70,11 +69,6 @@ evalHost {
     {
       key = "dotfiles#specialArgs";
       _file = "${__curPos.file}";
-
-      _module.args = {
-        inherit inputs';
-        self' = inputs'.self;
-      };
     }
 
     # here we make some basic assumptions about the system the person is using
diff --git a/flake-npins-shim.nix b/flake-npins-shim.nix
new file mode 100644
index 00000000..41326f1d
--- /dev/null
+++ b/flake-npins-shim.nix
@@ -0,0 +1,56 @@
+{
+  pkgs,
+  sources,
+}:
+{
+  # needs no changes
+  inherit (sources) nixpkgs darwin;
+
+  # don't care for the packages; just the modules
+  home-manager = {
+    nixosModules.home-manager = "${sources.home-manager}/nixos";
+    darwinModules.home-manager = "${sources.home-manager}/nix-darwin";
+  };
+
+  # only need the modules here
+  sops = {
+    nixosModules.sops = "${sources.sops}/modules/sops";
+    homeManagerModules.sops = "${sources.sops}/modules/home-manager/sops.nix";
+  };
+
+  # don't care for the packages here. catppuccin.sources exposes all we need
+  catppuccin = {
+    nixosModules.catppuccin = "${sources.catppuccin}/modules/nixos";
+    homeModules.catppuccin = "${sources.catppuccin}/modules/home-manager";
+  };
+
+  # already exposes a flake like output schema
+  lanzaboote = import sources.lanzaboote {
+    inherit pkgs;
+    inherit (pkgs.stdenv.hostPlatform) system;
+  };
+
+  # no packages; just need the module
+  simple-nixos-mailserver.nixosModules.default = import sources.simple-nixos-mailserver;
+
+  # we only need the module here
+  homebrew.darwinModules.nix-homebrew = "${sources.homebrew}/modules";
+
+  # already exposes flake like schema
+  spicetify = import sources.spicetify { inherit pkgs; };
+
+  # already exposes flake like schema
+  extersia = {
+    outPath = sources.extersia;
+  }
+  // import sources.extersia { inherit pkgs; };
+
+  # only construct packages. output schema is packages only
+  izlix = {
+    outPath = sources.izlix;
+    packages = import sources.izlix { inherit pkgs; };
+  };
+
+  # only exposes packages
+  izvim.packages = import sources.izvim { inherit pkgs; };
+}
diff --git a/flake.lock b/flake.lock
deleted file mode 100644
index a61ca0bc..00000000
--- a/flake.lock
+++ /dev/null
@@ -1,395 +0,0 @@
-{
-  "nodes": {
-    "catppuccin": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780833533,
-        "narHash": "sha256-0StMUC1sOkiQq7qoLQpobwVlad09EA5cy7HZit172Fw=",
-        "owner": "catppuccin",
-        "repo": "nix",
-        "rev": "4dd4177dc14b0c0b23bf3ce403f813be0c4c30de",
-        "type": "github"
-      },
-      "original": {
-        "owner": "catppuccin",
-        "repo": "nix",
-        "type": "github"
-      }
-    },
-    "crane": {
-      "locked": {
-        "lastModified": 1780532242,
-        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780795403,
-        "narHash": "sha256-AkWx4Zt9pQbD/f82Z8N57+d0HGLN/rV3gdMKJTpBPKs=",
-        "owner": "nix-darwin",
-        "repo": "nix-darwin",
-        "rev": "6a771120d607dcccb279a27d227650e324815c35",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-darwin",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
-    "extersia": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781057211,
-        "narHash": "sha256-kAckqz7vmhTnFIb85MitQzEFIqwAxKcHVeqNVSRB4xk=",
-        "owner": "extersia-org",
-        "repo": "pkgs",
-        "rev": "f16662cd1acf8b719a39af2e8d1adaf71197f67c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "extersia-org",
-        "repo": "pkgs",
-        "type": "github"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767039857,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "gift-wrap": {
-      "inputs": {
-        "nixpkgs": [
-          "izvim",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1773403464,
-        "narHash": "sha256-fckT48WShz/HqRgHgBKbVZCreC+Apfu3UqPZxFuL7Us=",
-        "owner": "tgirlcloud",
-        "repo": "gift-wrap",
-        "rev": "9499bc6e450d9959e2019f7122efd3b9077f333a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tgirlcloud",
-        "repo": "gift-wrap",
-        "type": "github"
-      }
-    },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "pre-commit",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781003320,
-        "narHash": "sha256-b9QFsLhW8mJaMhCLnLWVhkQpOTMWkPjA7Y+8kGKSX/Y=",
-        "owner": "isabelroses",
-        "repo": "home-manager",
-        "rev": "80c63febbb12de5875238abdb32e42be067bfdad",
-        "type": "github"
-      },
-      "original": {
-        "owner": "isabelroses",
-        "ref": "smfh",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "homebrew": {
-      "inputs": {
-        "brew-src": []
-      },
-      "locked": {
-        "lastModified": 1780492467,
-        "narHash": "sha256-zMEJwtQPmsPPgPczFkyjWHgd1z0HagOPS2Wt2WDYLJY=",
-        "owner": "zhaofengli",
-        "repo": "nix-homebrew",
-        "rev": "562332f97de9f5ba51aa647d70462e88222b2988",
-        "type": "github"
-      },
-      "original": {
-        "owner": "zhaofengli",
-        "repo": "nix-homebrew",
-        "type": "github"
-      }
-    },
-    "izlix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781146719,
-        "narHash": "sha256-P8UmYVSwNknRHGToLNI0Le4mlJm3D5aMNb9iIyuJSic=",
-        "owner": "isabelroses",
-        "repo": "izlix",
-        "rev": "325e6d1ed39b8ce9c0c5bd190a58e466df5a3899",
-        "type": "github"
-      },
-      "original": {
-        "owner": "isabelroses",
-        "repo": "izlix",
-        "type": "github"
-      }
-    },
-    "izvim": {
-      "inputs": {
-        "gift-wrap": "gift-wrap",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781072565,
-        "narHash": "sha256-/R5p6KufsNs85mDENRJpNe/I3ypGTS8A3lhIIVcg6+c=",
-        "owner": "isabelroses",
-        "repo": "nvim",
-        "rev": "c1df1c2424503873e28b4ee2d802039cd857c6e3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "isabelroses",
-        "repo": "nvim",
-        "type": "github"
-      }
-    },
-    "lanzaboote": {
-      "inputs": {
-        "crane": "crane",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "pre-commit": "pre-commit",
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1780957691,
-        "narHash": "sha256-DElCq5E9lipzEW+K1chfiw9OQhkwjGsTNUQZheiWTio=",
-        "owner": "nix-community",
-        "repo": "lanzaboote",
-        "rev": "b9e331d75d4618c7073ea08ff30fddf9a7d2fb08",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "lanzaboote",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1780930886,
-        "narHash": "sha256-omq0piVC7vKHVxfJi9uIW1EHQLsFSnDhbkLeO2rkSyw=",
-        "rev": "8c3cede7ddc26bd659d2d383b5610efbd2c7a16e",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1012902.8c3cede7ddc2/nixexprs.tar.xz?lastModified=1780930886&rev=8c3cede7ddc26bd659d2d383b5610efbd2c7a16e"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz"
-      }
-    },
-    "pre-commit": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1778507602,
-        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "catppuccin": "catppuccin",
-        "darwin": "darwin",
-        "extersia": "extersia",
-        "home-manager": "home-manager",
-        "homebrew": "homebrew",
-        "izlix": "izlix",
-        "izvim": "izvim",
-        "lanzaboote": "lanzaboote",
-        "nixpkgs": "nixpkgs",
-        "simple-nixos-mailserver": "simple-nixos-mailserver",
-        "sops": "sops",
-        "spicetify": "spicetify"
-      }
-    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780802404,
-        "narHash": "sha256-bGtIUeLb0yChX4h6hB40OOCwcYhcpQZHXSDvZGdWgeM=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "8e596a8430f2ce54d55c742198187d6945a5501e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "simple-nixos-mailserver": {
-      "inputs": {
-        "blobs": [],
-        "flake-compat": [],
-        "git-hooks": [],
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781101431,
-        "narHash": "sha256-NVcJWT5IX/NhWo/REax1pWVPy39XYl8xYpIzpbQFq0s=",
-        "owner": "simple-nixos-mailserver",
-        "repo": "nixos-mailserver",
-        "rev": "f6cda90e8f4cce83ceae17f1657a9dfbd7b9825b",
-        "type": "gitlab"
-      },
-      "original": {
-        "owner": "simple-nixos-mailserver",
-        "repo": "nixos-mailserver",
-        "type": "gitlab"
-      }
-    },
-    "sops": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780547341,
-        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "type": "github"
-      }
-    },
-    "spicetify": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1781101834,
-        "narHash": "sha256-gNVY6SYglFe37FpD+NnOjTipsqvVMM2vh/uc22KDEsA=",
-        "owner": "Gerg-L",
-        "repo": "spicetify-nix",
-        "rev": "0243dd6707c969fc8440216c811b3f2e4a4cceb7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Gerg-L",
-        "repo": "spicetify-nix",
-        "type": "github"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}
diff --git a/flake.nix b/flake.nix
deleted file mode 100644
index 3ae75c51..00000000
--- a/flake.nix
+++ /dev/null
@@ -1,114 +0,0 @@
-{
-  description = "isabel's dotfiles";
-
-  outputs = inputs: import ./modules/flake inputs;
-
-  inputs = {
-    # our main package supplier
-    #
-    # you may also notice that I don't use a `github:` url for nixpkgs this is
-    # this is because it save a massive 15mb, is faster than github and if I
-    # cared about command-not-found it would fix that
-    #
-    # See also:
-    # - https://nix.dev/manual/nix/stable/protocols/tarball-fetcher#lockable-http-tarball-protocol
-    # - http://web.archive.org/web/20250806225139/https://nix.dev/manual/nix/2.28/protocols/tarball-fetcher#lockable-http-tarball-protocol
-    nixpkgs.url = "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz";
-
-    # lix a good fork of nix, but also patched with my stuff
-    # so really you want: https://git.lix.systems/lix-project/lix/archive/main.tar.gz
-    izlix = {
-      type = "github";
-      owner = "isabelroses";
-      repo = "izlix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    # improved support for darwin
-    darwin = {
-      type = "github";
-      owner = "nix-darwin";
-      repo = "nix-darwin";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    # manage userspace with nix
-    home-manager = {
-      type = "github";
-      owner = "isabelroses";
-      repo = "home-manager";
-      ref = "smfh";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    ### Security stuff
-    # secure-boot on nixos
-    lanzaboote = {
-      type = "github";
-      owner = "nix-community";
-      repo = "lanzaboote";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    # Secrets, shhh
-    sops = {
-      type = "github";
-      owner = "Mic92";
-      repo = "sops-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    ### Additional packages
-    # a plain simple way to host a mail server
-    simple-nixos-mailserver = {
-      type = "gitlab";
-      owner = "simple-nixos-mailserver";
-      repo = "nixos-mailserver";
-
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        git-hooks.follows = "";
-        flake-compat.follows = "";
-        blobs.follows = "";
-      };
-    };
-
-    homebrew = {
-      type = "github";
-      owner = "zhaofengli";
-      repo = "nix-homebrew";
-      inputs.brew-src.follows = "";
-    };
-
-    spicetify = {
-      type = "github";
-      owner = "Gerg-L";
-      repo = "spicetify-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    ### misc
-    # declarative theme management
-    catppuccin = {
-      type = "github";
-      owner = "catppuccin";
-      repo = "nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    ### my programs
-    extersia = {
-      type = "github";
-      owner = "extersia-org";
-      repo = "pkgs";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    izvim = {
-      type = "github";
-      owner = "isabelroses";
-      repo = "nvim";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-  };
-}
diff --git a/home/default.nix b/home/default.nix
index f1dccc60..4f46aa62 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -1,10 +1,8 @@
 {
   lib,
   self,
-  self',
   config,
   inputs,
-  inputs',
   ...
 }:
 let
@@ -22,12 +20,7 @@ in
     });
 
     extraSpecialArgs = {
-      inherit
-        self
-        self'
-        inputs
-        inputs'
-        ;
+      inherit self inputs;
     };
 
     # we should define grauntied common modules here
diff --git a/home/isabel/packages.nix b/home/isabel/packages.nix
index 9809e341..78c47afe 100644
--- a/home/isabel/packages.nix
+++ b/home/isabel/packages.nix
@@ -2,7 +2,7 @@
   lib,
   pkgs,
   config,
-  inputs',
+  inputs,
   ...
 }:
 let
@@ -28,13 +28,13 @@ in
         # keep-sorted end
         ;
 
-      inherit (inputs'.extersia.packages)
+      inherit (inputs.extersia.packages)
         lethe # a cli that tracks nixos deployments
         quoteit # the cli for my quote's service
         ;
 
-      izvim = inputs'.izvim.packages.izvim.override {
-        inherit (inputs'.izlix.packages) nil;
+      izvim = inputs.izvim.packages.izvim.override {
+        inherit (inputs.izlix.packages) nil;
       };
 
       # nom >= 2.1.7 breaks with lix so lets just use an older version for now.
@@ -80,7 +80,7 @@ in
         # keep-sorted end
         ;
 
-      inherit (inputs'.extersia.packages) cake-wallet;
+      inherit (inputs.extersia.packages) cake-wallet;
     })
 
     (optionalAttrs (cfg.workstation.enable && (cfg.graphical.enable || isDarwin)) {
diff --git a/home/isabel/spotify.nix b/home/isabel/spotify.nix
index 35c157c4..d1c2d842 100644
--- a/home/isabel/spotify.nix
+++ b/home/isabel/spotify.nix
@@ -2,11 +2,10 @@
   pkgs,
   config,
   inputs,
-  inputs',
   ...
 }:
 let
-  spicePkgs = inputs'.spicetify.legacyPackages;
+  spicePkgs = inputs.spicetify.packages;
 in
 {
   imports = [ inputs.spicetify.homeManagerModules.spicetify ];
diff --git a/justfile b/justfile
index 7a216050..479c80bf 100644
--- a/justfile
+++ b/justfile
@@ -4,6 +4,14 @@ flake := env('FLAKE', justfile_directory())
 rebuild := if os() == "macos" { "sudo darwin-rebuild" } else { "nixos-rebuild" }
 system-args := if os() == "macos" { "" } else { "--elevate run0 --no-reexec" }
 
+# without flakes we address a host by attribute path into ./default.nix
+hostname := `hostname`
+config-attr := if os() == "macos" { "darwinConfigurations" } else { "nixosConfigurations" }
+
+# common build invocation: nom-monitored, pure-eval build from ./default.nix
+build := "nom build"
+build-args := "--file " + flake + "/default.nix --option pure-eval true"
+
 [private]
 default:
     @just --list --unsorted
@@ -13,11 +21,12 @@ default:
 [group('rebuild')]
 [no-exit-message]
 [private]
-builder goal *args:
+builder host goal *args:
     #!/usr/bin/env bash
     set -euo pipefail
     {{ rebuild }} {{ goal }} \
-      --flake {{ flake }} \
+      --file {{ flake }}/default.nix \
+      --attr {{ config-attr }}.{{ host }} \
       --log-format internal-json \
       {{ system-args }} \
       {{ args }} \
@@ -29,7 +38,7 @@ builder goal *args:
 deployer host goal *args:
     #!/usr/bin/env bash
     set -euo pipefail
-    just builder {{ goal }} --target-host {{ host }} --use-substitutes {{ args }}
+    just builder {{ host }} {{ goal }} --target-host {{ host }} --use-substitutes {{ args }}
     lethe record {{ host }}
 
 # deploy by switching the new system configuration
@@ -63,7 +72,6 @@ deployer-all goal:
     lethe diff skadi
     lethe diff isis
 
-
 # deploy to all hosts by switching
 [group('rebuild')]
 [no-exit-message]
@@ -77,13 +85,13 @@ deploy-all-boot: (deployer-all "boot")
 # rebuild the boot
 [group('rebuild')]
 [no-exit-message]
-boot *args: (builder "boot" args)
+boot *args: (builder hostname "boot" args)
   lethe diff $(hostname)
 
 # test what happens when you switch
 [group('rebuild')]
 [no-exit-message]
-test *args: (builder "test" args)
+test *args: (builder hostname "test" args)
 
 # switch the new system configuration
 [group('rebuild')]
@@ -91,7 +99,7 @@ test *args: (builder "test" args)
 switch *args:
     #!/usr/bin/env bash
     set -euo pipefail
-    just builder switch {{ args }}
+    just builder {{ hostname }} switch {{ args }}
     lethe record --local
     lethe diff $(hostname)
 
@@ -99,7 +107,7 @@ switch *args:
 [macos]
 [no-exit-message]
 provision host:
-    sudo nix run github:LnL7/nix-darwin -- switch --flake {{ flake }}#{{ host }}
+    sudo nix run github:LnL7/nix-darwin -- switch --file {{ flake }}/default.nix --attr darwinConfigurations.{{ host }}
     sudo -i nix-env --uninstall lix # we need to remove the none declarative install of lix
 
 # package group
@@ -109,42 +117,57 @@ provision host:
 [group('package')]
 [no-exit-message]
 iso image:
-    nom build {{ flake }}#nixosConfigurations.{{ image }}.config.system.build.isoImage
+    {{ build }} {{ build-args }} nixosConfigurations.{{ image }}.config.system.build.isoImage
+
+# build the documentation site
+[group('package')]
+[no-exit-message]
+docs:
+    {{ build }} {{ build-args }} packages.docs
 
 # build the tarball, you must specify the host you want to build
 [group('package')]
 [no-exit-message]
 tar host:
-    sudo nix run {{ flake }}#nixosConfigurations.{{ host }}.config.system.build.tarballBuilder
+    #!/usr/bin/env bash
+    set -euo pipefail
+    out=$({{ build }} {{ build-args }} nixosConfigurations.{{ host }}.config.system.build.tarballBuilder --no-link --print-out-paths)
+    sudo "$out"/bin/*
 
 # dev group
 
-# check the flake for errors
+# check the config for errors
 [group('dev')]
 [no-exit-message]
 check *args:
-    nix flake check --option allow-import-from-derivation false {{ args }}
+    #!/usr/bin/env bash
+    set -euo pipefail
+    {{ build }} {{ build-args }} checks \
+      --option allow-import-from-derivation false {{ args }}
 
 [group('dev')]
 [no-exit-message]
-repl-host host=`hostname`:
-    nix repl .#nixosConfigurations.{{ host }}
+repl-host host=hostname:
+    nix repl --expr '(import {{ flake }}/default.nix { }).nixosConfigurations.{{ host }}'
 
-# update a set of given inputs
+# update a set of given pins (npins), defaulting to all of them
 [group('dev')]
 [no-exit-message]
 update *input:
-    nix flake update {{ input }} \
-      --refresh \
-      --commit-lock-file \
-      --commit-lockfile-summary "flake.lock: update {{ if input == "" { "all inputs" } else { input } }}" \
-      --flake {{ flake }}
+    #!/usr/bin/env bash
+    set -euo pipefail
+    npins --directory {{ flake }}/npins update {{ input }}
+    git -C {{ flake }} add npins/sources.json
+    git -C {{ flake }} commit -m "npins: update {{ if input == "" { "all sources" } else { input } }}"
 
 # build & serve the docs locally
 [group('dev')]
 [no-exit-message]
 serve:
-    nix run {{ flake }}#docs.serve
+    #!/usr/bin/env bash
+    set -euo pipefail
+    out=$({{ build }} {{ build-args }} packages.docs.serve --no-link --print-out-paths)
+    "$out"/bin/serve
 
 # push to the mirrors
 [group('dev')]
@@ -166,6 +189,12 @@ roate-secrets:
 update-secrets:
     find secrets/ -name "*.yaml" | xargs -I {} sops updatekeys -y {}
 
+# format the config
+[group('dev')]
+[no-exit-message]
+fmt:
+  treefmt
+
 # utils group
 
 alias fix := repair
diff --git a/modules/base/nix/nix.nix b/modules/base/nix/nix.nix
index 967bcfe6..c9509f93 100644
--- a/modules/base/nix/nix.nix
+++ b/modules/base/nix/nix.nix
@@ -3,7 +3,7 @@
   pkgs,
   _class,
   config,
-  inputs',
+  inputs,
   ...
 }:
 let
@@ -21,7 +21,7 @@ in
     # https://akko.isabelroses.com/notice/AjMDXG28c8sLqhci0G
     #
     # NOTE: we are also using a specifically patched version
-    package = inputs'.izlix.packages.lix;
+    package = inputs.izlix.packages.lix;
     # package = pkgs.nixVersions.latest;
 
     # set up garbage collection to run <on the time frame specified per system>, and removing packages after 3 days
diff --git a/modules/base/nix/registry.nix b/modules/base/nix/registry.nix
index 81578b58..cbd0013b 100644
--- a/modules/base/nix/registry.nix
+++ b/modules/base/nix/registry.nix
@@ -2,9 +2,8 @@
 let
   inherit (lib.attrsets) filterAttrs attrValues mapAttrs;
   inherit (lib.modules) mkForce;
-  inherit (lib.types) isType;
 
-  flakeInputs = filterAttrs (name: value: (isType "flake" value) && (name != "self")) inputs;
+  flakeInputs = filterAttrs (name: value: (value ? outPath) && (name != "self")) inputs;
 in
 {
   # The path to the nixpkgs sources used to build the system. This is
diff --git a/modules/flake/checks/formatting.nix b/modules/flake/checks/formatting.nix
index 5f355749..f3b46401 100644
--- a/modules/flake/checks/formatting.nix
+++ b/modules/flake/checks/formatting.nix
@@ -1,10 +1,9 @@
 {
-  stdenvNoCC,
   runCommandLocal,
   self,
 }:
 let
-  fmt = self.formatter.${stdenvNoCC.hostPlatform.system};
+  fmt = self.formatter;
 in
 runCommandLocal "formatting-checks"
   {
diff --git a/modules/flake/default.nix b/modules/flake/default.nix
deleted file mode 100644
index bb4d689c..00000000
--- a/modules/flake/default.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-inputs:
-
-let
-
-  inherit (inputs) nixpkgs self;
-  inherit (nixpkgs) lib;
-
-  systems = [
-    "x86_64-linux"
-    "aarch64-linux"
-    "aarch64-darwin"
-  ];
-
-  forAllSystems = fn: lib.genAttrs systems (system: fn nixpkgs.legacyPackages.${system});
-
-  mkHosts = lib.mapAttrs self.lib.mkHost;
-in
-
-{
-  # a raw unfilted scope of packages
-  legacyPackages = forAllSystems (pkgs: import ./packages { inherit pkgs inputs; });
-
-  packages = forAllSystems (
-    pkgs:
-    lib.filterAttrs (
-      _: pkg:
-      let
-        isDerivation = lib.isDerivation pkg;
-        availableOnHost = lib.meta.availableOn pkgs.stdenv.hostPlatform pkg;
-        isBroken = pkg.meta.broken or false;
-      in
-      isDerivation && !isBroken && availableOnHost
-    ) self.legacyPackages.${pkgs.stdenv.hostPlatform.system}
-  );
-
-  # get a list of packages for the host system, and if none exist use an empty set
-  overlays.default = _: prev: self.packages.${prev.stdenv.hostPlatform.system} or { };
-
-  devShells = forAllSystems (pkgs: {
-    default = pkgs.callPackage ./programs/shell.nix {
-      treefmt-wrapped = self.formatter.${pkgs.stdenv.hostPlatform.system};
-    };
-  });
-
-  lib = import ./lib { inherit lib inputs; };
-
-  checks = forAllSystems (pkgs: import ./checks { inherit pkgs inputs; });
-
-  formatter = forAllSystems (pkgs: pkgs.callPackage ./programs/formatter.nix { });
-
-  # This is the list of system configuration
-  #
-  # the defaults consists of the following:
-  #  arch = "x86_64";
-  #  class = "nixos";
-  nixosConfigurations = mkHosts {
-    # keep-sorted start block=yes newline_separated=yes
-    amaterasu = { };
-
-    aphrodite = { };
-
-    athena = { };
-
-    isis = { };
-
-    lilith = {
-      class = "iso";
-    };
-
-    minerva = { };
-
-    skadi = {
-      arch = "aarch64";
-    };
-    # keep-sorted end
-  };
-
-  darwinConfigurations = mkHosts {
-    # keep-sorted start block=yes newline_separated=yes
-    tatsumaki = {
-      arch = "aarch64";
-      class = "darwin";
-    };
-    #keep-sorted end
-  };
-}
diff --git a/modules/flake/lib/default.nix b/modules/flake/lib/default.nix
index 399ce40b..711d34b9 100644
--- a/modules/flake/lib/default.nix
+++ b/modules/flake/lib/default.nix
@@ -7,7 +7,6 @@ lib.fixedPoints.makeExtensible (final: {
   # keep-sorted start block=yes
   hardware = import ./hardware.nix;
   helpers = import ./helpers.nix { inherit lib; };
-  mkHost = import ./mkhost.nix { inherit inputs lib; };
   secrets = import ./secrets.nix { inherit inputs; };
   services = import ./services.nix { inherit lib; };
   template = import ./template; # templates, selections of code that are repeated
@@ -31,5 +30,5 @@ lib.fixedPoints.makeExtensible (final: {
     ;
   inherit (final.secrets) mkSecret;
   inherit (final.services) mkGraphicalService mkServiceOption;
-  inherit (final.validators) ifOneEnabled anyHome;
+  inherit (final.validators) anyHome;
 })
diff --git a/modules/flake/packages/default.nix b/modules/flake/packages/default.nix
index 9b6cec79..63d45027 100644
--- a/modules/flake/packages/default.nix
+++ b/modules/flake/packages/default.nix
@@ -10,7 +10,7 @@ builtins.removeAttrs (pkgs.lib.makeScope pkgs.newScope (self: {
   docs = self.callPackage ./docs/package.nix { };
 
   iztaller = self.callPackage ./iztaller/package.nix {
-    nix = inputs.izlix.packages.${pkgs.stdenv.hostPlatform.system}.lix;
+    nix = inputs.izlix.packages.lix;
   };
 
   libdoc = self.callPackage ./docs/lib.nix { };
diff --git a/modules/flake/programs/formatter.nix b/modules/flake/programs/formatter.nix
index e4389015..e2ee224c 100644
--- a/modules/flake/programs/formatter.nix
+++ b/modules/flake/programs/formatter.nix
@@ -39,7 +39,7 @@ treefmt.withConfig {
 
   settings = {
     on-unmatched = "info";
-    tree-root-file = "flake.nix";
+    tree-root-file = "justfile";
 
     excludes = [ "secrets/*" ];
 
diff --git a/modules/flake/programs/shell.nix b/modules/flake/programs/shell.nix
index eb54a653..e78d68e0 100644
--- a/modules/flake/programs/shell.nix
+++ b/modules/flake/programs/shell.nix
@@ -3,7 +3,8 @@
   just,
   gitMinimal,
   sops,
-  # nix-output-monitor,
+  npins,
+  nix-output-monitor,
   treefmt-wrapped,
 }:
 mkShellNoCC {
@@ -14,7 +15,8 @@ mkShellNoCC {
     gitMinimal # we need git
     sops # secrets management
     treefmt-wrapped # nix formatter
-    # nix-output-monitor # get clean diff between generations
+    npins
+    nix-output-monitor # get clean diff between generations
   ]
   ++ treefmt-wrapped.runtimeInputs; # collect all our formatters
 
diff --git a/modules/iso/nix.nix b/modules/iso/nix.nix
index 5434ff69..27d4637a 100644
--- a/modules/iso/nix.nix
+++ b/modules/iso/nix.nix
@@ -1,8 +1,8 @@
-{ inputs', ... }:
+{ inputs, ... }:
 {
   nix = {
     # setting nix to be our preferred fork
-    package = inputs'.izlix.packages.lix;
+    package = inputs.izlix.packages.lix;
 
     # we can disable channels since we can just use the flake
     channel.enable = false;
diff --git a/modules/iso/programs.nix b/modules/iso/programs.nix
index 9aecbd68..d5031b70 100644
--- a/modules/iso/programs.nix
+++ b/modules/iso/programs.nix
@@ -1,4 +1,4 @@
-{ pkgs, self', ... }:
+{ pkgs, self, ... }:
 {
   # disable all installer tools and only bring the ones that we explicitly need
   # for installing or debugging
@@ -16,5 +16,5 @@
   programs.git.package = pkgs.gitMinimal;
 
   # needed packages for the installer
-  environment.systemPackages = [ self'.legacyPackages.iztaller ];
+  environment.systemPackages = [ self.packages.iztaller ];
 }
diff --git a/modules/nixos/security/run0.nix b/modules/nixos/security/run0.nix
index f2c8c352..08df336d 100644
--- a/modules/nixos/security/run0.nix
+++ b/modules/nixos/security/run0.nix
@@ -1,7 +1,7 @@
 {
   lib,
   options,
-  inputs',
+  inputs,
   ...
 }:
 {
@@ -18,7 +18,7 @@
   };
 
   garden.packages = {
-    inherit (inputs'.extersia.packages) run0-sudo-shim;
+    inherit (inputs.extersia.packages) run0-sudo-shim;
   };
 
   warnings = lib.lists.optional (options.security.run0 ? enable) ''
diff --git a/modules/nixos/services/akkoma/default.nix b/modules/nixos/services/akkoma/default.nix
index 8ae4633a..574146f3 100644
--- a/modules/nixos/services/akkoma/default.nix
+++ b/modules/nixos/services/akkoma/default.nix
@@ -3,7 +3,7 @@
   self,
   pkgs,
   config,
-  inputs',
+  inputs,
   ...
 }:
 let
@@ -37,7 +37,7 @@ in
           };
 
           "emoji/blobs" = pkgs.blobs_gg;
-          "emoji/awesome" = inputs'.extersia.packages.emojis;
+          "emoji/awesome" = inputs.extersia.packages.emojis;
         };
 
         config = {
diff --git a/modules/nixos/services/website.nix b/modules/nixos/services/website.nix
index 23eb2eac..ea586573 100644
--- a/modules/nixos/services/website.nix
+++ b/modules/nixos/services/website.nix
@@ -2,7 +2,7 @@
   lib,
   self,
   config,
-  inputs',
+  inputs,
   ...
 }:
 let
@@ -22,7 +22,7 @@ in
       ${cfg.domain} = {
         serverAliases = [ "www.${cfg.domain}" ];
         enableACME = true;
-        root = inputs'.extersia.packages.isabelroses-website;
+        root = inputs.extersia.packages.isabelroses-website;
       };
     };
   };
diff --git a/modules/nixos/system/loginManager.nix b/modules/nixos/system/loginManager.nix
index 853a8426..b84a2c9e 100644
--- a/modules/nixos/system/loginManager.nix
+++ b/modules/nixos/system/loginManager.nix
@@ -1,7 +1,7 @@
 {
   lib,
   config,
-  inputs',
+  inputs,
   ...
 }:
 let
@@ -20,7 +20,7 @@ in
       default_session = {
         user = "greeter";
         command = concatStringsSep " " [
-          (getExe inputs'.extersia.packages.tuigreet)
+          (getExe inputs.extersia.packages.tuigreet)
           "--time"
           "--remember"
           "--remember-user-session"
diff --git a/npins/default.nix b/npins/default.nix
new file mode 100644
index 00000000..49c87bd9
--- /dev/null
+++ b/npins/default.nix
@@ -0,0 +1,260 @@
+/*
+  This file is provided under the MIT licence:
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+# Generated by npins. Do not modify; will be overwritten regularly
+let
+  # Backwards-compatibly make something that previously didn't take any arguments take some
+  # The function must return an attrset, and will unfortunately be eagerly evaluated
+  # Same thing, but it catches eval errors on the default argument so that one may still call it with other arguments
+  mkFunctor =
+    fn:
+    let
+      e = builtins.tryEval (fn { });
+    in
+    (if e.success then e.value else { error = fn { }; }) // { __functor = _self: fn; };
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
+  range =
+    first: last: if first > last then [ ] else builtins.genList (n: first + n) (last - first + 1);
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257
+  stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1));
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
+  stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
+  concatStrings = builtins.concatStringsSep "";
+
+  # If the environment variable NPINS_OVERRIDE_${name} is set, then use
+  # the path directly as opposed to the fetched source.
+  # (Taken from Niv for compatibility)
+  mayOverride =
+    name: path:
+    let
+      envVarName = "NPINS_OVERRIDE_${saneName}";
+      saneName = stringAsChars (c: if (builtins.match "[a-zA-Z0-9]" c) == null then "_" else c) name;
+      ersatz = builtins.getEnv envVarName;
+    in
+    if ersatz == "" then
+      path
+    else
+      # this turns the string into an actual Nix path (for both absolute and
+      # relative paths)
+      builtins.trace "Overriding path of \"${name}\" with \"${ersatz}\" due to set \"${envVarName}\"" (
+        if builtins.substring 0 1 ersatz == "/" then
+          /. + ersatz
+        else
+          /. + builtins.getEnv "PWD" + "/${ersatz}"
+      );
+
+  mkSource =
+    name: spec:
+    {
+      pkgs ? null,
+    }:
+    assert spec ? type;
+    let
+      # Unify across builtin and pkgs fetchers.
+      # `fetchGit` requires a wrapper because of slight API differences.
+      fetchers =
+        if pkgs == null then
+          {
+            inherit (builtins) fetchTarball fetchurl;
+            # Frustratingly, due to flakes and `fetchTree`, `fetchGit`
+            # has a different signature than the other builtin
+            # fetchers
+            fetchGit = args: (builtins.fetchGit args).outPath;
+          }
+        else
+          {
+            fetchTarball =
+              {
+                url,
+                sha256,
+              }:
+              pkgs.fetchzip {
+                inherit url sha256;
+                extension = "tar";
+              };
+            inherit (pkgs) fetchurl;
+            fetchGit =
+              {
+                url,
+                submodules,
+                rev,
+                name,
+                narHash,
+              }:
+              pkgs.fetchgit {
+                inherit url rev name;
+                fetchSubmodules = submodules;
+                hash = narHash;
+              };
+          };
+
+      path =
+        if spec.type == "Git" then
+          mkGitSource fetchers spec
+        else if spec.type == "GitRelease" then
+          mkGitSource fetchers spec
+        else if spec.type == "PyPi" then
+          mkPyPiSource fetchers spec
+        else if spec.type == "Channel" then
+          mkChannelSource fetchers spec
+        else if spec.type == "Url" || spec.type == "MutableUrl" then
+          mkUrlSource fetchers spec
+        else if spec.type == "Container" then
+          mkContainerSource pkgs spec
+        else
+          builtins.throw "Unknown source type ${spec.type}";
+    in
+    spec // { outPath = mayOverride name path; };
+
+  mkGitSource =
+    {
+      fetchTarball,
+      fetchGit,
+      ...
+    }:
+    {
+      repository,
+      revision,
+      url ? null,
+      submodules,
+      hash,
+      ...
+    }:
+    assert repository ? type;
+    # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
+    # In the latter case, there we will always be an url to the tarball
+    if url != null && !submodules then
+      fetchTarball {
+        inherit url;
+        sha256 = hash;
+      }
+    else
+      let
+        url =
+          if repository.type == "Git" then
+            repository.url
+          else if repository.type == "GitHub" then
+            "https://github.com/${repository.owner}/${repository.repo}.git"
+          else if repository.type == "GitLab" then
+            "${repository.server}/${repository.repo_path}.git"
+          else if repository.type == "Forgejo" then
+            "${repository.server}/${repository.owner}/${repository.repo}.git"
+          else
+            throw "Unrecognized repository type ${repository.type}";
+        urlToName =
+          url: rev:
+          let
+            matched = builtins.match "^.*/([^/]*)(\\.git)?$" url;
+
+            short = builtins.substring 0 7 rev;
+
+            appendShort = if (builtins.match "[a-f0-9]*" rev) != null then "-${short}" else "";
+          in
+          "${if matched == null then "source" else builtins.head matched}${appendShort}";
+        name = urlToName url revision;
+      in
+      fetchGit {
+        rev = revision;
+        narHash = hash;
+
+        inherit name submodules url;
+      };
+
+  mkPyPiSource =
+    { fetchurl, ... }:
+    {
+      url,
+      hash,
+      ...
+    }:
+    fetchurl {
+      inherit url;
+      sha256 = hash;
+    };
+
+  mkChannelSource =
+    { fetchTarball, ... }:
+    {
+      url,
+      hash,
+      ...
+    }:
+    fetchTarball {
+      inherit url;
+      sha256 = hash;
+    };
+
+  mkUrlSource =
+    {
+      fetchTarball,
+      fetchurl,
+      ...
+    }:
+    {
+      url,
+      hash,
+      unpack,
+      ...
+    }:
+    (if unpack then fetchTarball else fetchurl) {
+      inherit url;
+      sha256 = hash;
+    };
+
+  mkContainerSource =
+    pkgs:
+    {
+      image_name,
+      image_tag,
+      image_digest,
+      hash,
+      ...
+    }@args:
+    if pkgs == null then
+      builtins.throw "container sources require passing in a Nixpkgs value: https://github.com/andir/npins/blob/master/README.md#using-the-nixpkgs-fetchers"
+    else
+      pkgs.dockerTools.pullImage (
+        {
+          imageName = image_name;
+          imageDigest = image_digest;
+          finalImageTag = image_tag;
+          inherit hash;
+        }
+        // (if args.arch or null != null then { inherit (args) arch; } else { })
+      );
+
+in
+mkFunctor (
+  {
+    input ? ./sources.json,
+  }:
+  let
+    data =
+      if builtins.isPath input then
+        # while `readFile` will throw an error anyways if the path doesn't exist,
+        # we still need to check beforehand because *our* error can be caught but not the one from the builtin
+        # See: <https://git.lix.systems/lix-project/lix/issues/1098>
+        if builtins.pathExists input then
+          builtins.fromJSON (builtins.readFile input)
+        else
+          throw "Input path ${toString input} does not exist"
+      else if builtins.isAttrs input then
+        input
+      else
+        throw "Unsupported input type ${builtins.typeOf input}, must be a path or an attrset";
+    inherit (data) version;
+  in
+  if version == 8 then
+    builtins.mapAttrs (name: spec: mkFunctor (mkSource name spec)) data.pins
+  else
+    throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
+)
diff --git a/npins/sources.json b/npins/sources.json
new file mode 100644
index 00000000..71c07486
--- /dev/null
+++ b/npins/sources.json
@@ -0,0 +1,154 @@
+{
+  "pins": {
+    "catppuccin": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "catppuccin",
+        "repo": "nix"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "4dd4177dc14b0c0b23bf3ce403f813be0c4c30de",
+      "url": "https://github.com/catppuccin/nix/archive/4dd4177dc14b0c0b23bf3ce403f813be0c4c30de.tar.gz",
+      "hash": "sha256-0StMUC1sOkiQq7qoLQpobwVlad09EA5cy7HZit172Fw="
+    },
+    "darwin": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "nix-darwin",
+        "repo": "nix-darwin"
+      },
+      "branch": "master",
+      "submodules": false,
+      "revision": "f73cbf1f6549f1bf349398f8276801a9c1a17aa7",
+      "url": "https://github.com/nix-darwin/nix-darwin/archive/f73cbf1f6549f1bf349398f8276801a9c1a17aa7.tar.gz",
+      "hash": "sha256-rK6/8hoDWZe64npiBEIcrJ5JLv1zBnn6HBZGbVj/nDU="
+    },
+    "extersia": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "extersia-org",
+        "repo": "pkgs"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "0245ba87cd63d7822c9bf07ba22c2320d6d6a26c",
+      "url": "https://github.com/extersia-org/pkgs/archive/0245ba87cd63d7822c9bf07ba22c2320d6d6a26c.tar.gz",
+      "hash": "sha256-IxN3STgvD90Ap23Fa6djRTF2u1d9PZbpdfeb/L2X+ik="
+    },
+    "home-manager": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "isabelroses",
+        "repo": "home-manager"
+      },
+      "branch": "smfh",
+      "submodules": false,
+      "revision": "80c63febbb12de5875238abdb32e42be067bfdad",
+      "url": "https://github.com/isabelroses/home-manager/archive/80c63febbb12de5875238abdb32e42be067bfdad.tar.gz",
+      "hash": "sha256-b9QFsLhW8mJaMhCLnLWVhkQpOTMWkPjA7Y+8kGKSX/Y="
+    },
+    "homebrew": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "zhaofengli",
+        "repo": "nix-homebrew"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "562332f97de9f5ba51aa647d70462e88222b2988",
+      "url": "https://github.com/zhaofengli/nix-homebrew/archive/562332f97de9f5ba51aa647d70462e88222b2988.tar.gz",
+      "hash": "sha256-zMEJwtQPmsPPgPczFkyjWHgd1z0HagOPS2Wt2WDYLJY="
+    },
+    "izlix": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "isabelroses",
+        "repo": "izlix"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "325e6d1ed39b8ce9c0c5bd190a58e466df5a3899",
+      "url": "https://github.com/isabelroses/izlix/archive/325e6d1ed39b8ce9c0c5bd190a58e466df5a3899.tar.gz",
+      "hash": "sha256-P8UmYVSwNknRHGToLNI0Le4mlJm3D5aMNb9iIyuJSic="
+    },
+    "izvim": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "isabelroses",
+        "repo": "nvim"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "fdd789bfc29aa17c7de3bb0e465516ac1918cc9a",
+      "url": "https://github.com/isabelroses/nvim/archive/fdd789bfc29aa17c7de3bb0e465516ac1918cc9a.tar.gz",
+      "hash": "sha256-vB1745JNsMcbKWnNK6yX09/7pAnUufF+qUWvWQ/409o="
+    },
+    "lanzaboote": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "nix-community",
+        "repo": "lanzaboote"
+      },
+      "branch": "master",
+      "submodules": false,
+      "revision": "b9e331d75d4618c7073ea08ff30fddf9a7d2fb08",
+      "url": "https://github.com/nix-community/lanzaboote/archive/b9e331d75d4618c7073ea08ff30fddf9a7d2fb08.tar.gz",
+      "hash": "sha256-DElCq5E9lipzEW+K1chfiw9OQhkwjGsTNUQZheiWTio="
+    },
+    "nixpkgs": {
+      "type": "Url",
+      "url": "https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz",
+      "unpack": true,
+      "hash": "sha256-omq0piVC7vKHVxfJi9uIW1EHQLsFSnDhbkLeO2rkSyw="
+    },
+    "simple-nixos-mailserver": {
+      "type": "Git",
+      "repository": {
+        "type": "GitLab",
+        "repo_path": "simple-nixos-mailserver/nixos-mailserver",
+        "server": "https://gitlab.com/"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "f6cda90e8f4cce83ceae17f1657a9dfbd7b9825b",
+      "url": "https://gitlab.com/api/v4/projects/simple-nixos-mailserver%2Fnixos-mailserver/repository/archive.tar.gz?sha=f6cda90e8f4cce83ceae17f1657a9dfbd7b9825b",
+      "hash": "sha256-NVcJWT5IX/NhWo/REax1pWVPy39XYl8xYpIzpbQFq0s="
+    },
+    "sops": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "Mic92",
+        "repo": "sops-nix"
+      },
+      "branch": "master",
+      "submodules": false,
+      "revision": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
+      "url": "https://github.com/Mic92/sops-nix/archive/9ed65852b6257fbeae4355bc24ecfea307ca759a.tar.gz",
+      "hash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo="
+    },
+    "spicetify": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "Gerg-L",
+        "repo": "spicetify-nix"
+      },
+      "branch": "master",
+      "submodules": false,
+      "revision": "0243dd6707c969fc8440216c811b3f2e4a4cceb7",
+      "url": "https://github.com/Gerg-L/spicetify-nix/archive/0243dd6707c969fc8440216c811b3f2e4a4cceb7.tar.gz",
+      "hash": "sha256-gNVY6SYglFe37FpD+NnOjTipsqvVMM2vh/uc22KDEsA="
+    }
+  },
+  "version": 8
+}
diff --git a/shell.nix b/shell.nix
index 1f947f17..d82ab5bd 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,9 +1 @@
-let
-  compat = fetchTarball {
-    url = "https://git.lix.systems/lix-project/flake-compat/archive/6588972962297c7abd300a72c55b2c7e21c1dc54.tar.gz";
-    sha256 = "sha256-PplvwAEkj+/MFkM6Q9V59L6f6i3Tbdc/9yLRf/iwECg=";
-  };
-
-  flake = import compat { src = ./.; };
-in
-flake.shellNix
+(import ./. { }).devShells.default