diff --git a/modules/nixos/services/buildbot.nix b/modules/nixos/services/buildbot.nix
deleted file mode 100644
index aa3cfc2f..00000000
--- a/modules/nixos/services/buildbot.nix
+++ /dev/null
@@ -1,125 +0,0 @@
-{
-  lib,
-  self,
-  pkgs,
-  config,
-  inputs,
-  ...
-}:
-let
-  inherit (lib.modules) mkIf mkMerge;
-  inherit (self.lib) mkServiceOption mkSecret;
-
-  inherit (config.sops) secrets;
-
-  rdomain = config.networking.domain;
-
-  cfg = config.garden.services.buildbot;
-in
-{
-  options.garden.services.buildbot = mkServiceOption "buildbot" { domain = "ci.${rdomain}"; };
-
-  imports = [
-    inputs.buildbot-nix.nixosModules.buildbot-master
-    inputs.buildbot-nix.nixosModules.buildbot-worker
-  ];
-
-  config = mkIf cfg.enable (mkMerge [
-    {
-      sops.secrets = {
-        buildbot-worker = mkSecret {
-          file = "buildbot";
-          key = "worker";
-        };
-        buildbot-workers = mkSecret {
-          file = "buildbot";
-          key = "workers";
-        };
-        buildbot-gh-webhook-secret = mkSecret {
-          file = "buildbot";
-          key = "gh-webhook-secret";
-        };
-        buildbot-gh-private-key = mkSecret {
-          file = "buildbot";
-          key = "gh-private-key";
-        };
-        buildbot-gh-oauth = mkSecret {
-          file = "buildbot";
-          key = "gh-oauth";
-        };
-      };
-
-      services = {
-        buildbot-nix = {
-          master = {
-            enable = true;
-
-            inherit (cfg) domain;
-
-            accessMode.public = { };
-            useHTTPS = true;
-
-            admins = [ "isabelroses" ];
-            workersFile = secrets.buildbot-workers.path;
-
-            pullBased.repositories.infra = {
-              url = "https://github.com/isabelroses/dotfiles.git";
-              defaultBranch = "main";
-            };
-
-            authBackend = "github";
-            github = {
-              enable = true;
-              webhookSecretFile = secrets.buildbot-gh-webhook-secret.path;
-              authType.app = {
-                id = 1153859;
-                secretKeyFile = secrets.buildbot-gh-private-key.path;
-              };
-              oauthId = "Iv23liSeLy6J7IS9awg1";
-              oauthSecretFile = secrets.buildbot-gh-oauth.path;
-            };
-          };
-
-          worker = {
-            enable = true;
-            # masterUrl = cfg.domain;
-            workerPasswordFile = secrets.buildbot-worker.path;
-          };
-        };
-
-        nginx.virtualHosts.${cfg.domain} = { };
-      };
-    }
-
-    (mkIf config.garden.services.attic.enable {
-      age.secrets = {
-        attic-prod-auth-token = mkSecret { file = "attic/prod-auth-token"; };
-        attic-netrc = mkSecret { file = "attic/netrc"; };
-      };
-
-      # Add netrc file for this machine to do its normal thing with the cache, as a machine.
-      nix.settings.netrc-file = config.age.secrets.attic-netrc.path;
-
-      systemd.services.attic-watch-store = {
-        wantedBy = [ "multi-user.target" ];
-        after = [ "network-online.target" ];
-        environment.HOME = "/var/lib/attic-watch-store";
-        serviceConfig = {
-          DynamicUser = true;
-          MemoryHigh = "5%";
-          MemoryMax = "10%";
-          LoadCredential = "prod-auth-token:${config.age.secrets.attic-prod-auth-token.path}";
-          StateDirectory = "attic-watch-store";
-        };
-        path = [ pkgs.attic-client ];
-        script = ''
-          set -eux -o pipefail
-          ATTIC_TOKEN=$(< $CREDENTIALS_DIRECTORY/prod-auth-token)
-          attic login prod https://${cfg.domain} $ATTIC_TOKEN
-          attic use prod
-          exec attic watch-store prod:prod
-        '';
-      };
-    })
-  ]);
-}
diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index a66f2358..0870e5c2 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -14,11 +14,11 @@
     ./immich.nix
     ./jellyfin.nix
     ./kanidm.nix
-    # ./buildbot.nix
     ./lego.nix
     ./mailserver.nix
     ./matrix.nix
     ./nginx.nix
+    # ./nixbot.nix
     ./nixpkgs-prs-bot.nix
     ./pds
     ./piper.nix
diff --git a/modules/nixos/services/nixbot.nix b/modules/nixos/services/nixbot.nix
new file mode 100644
index 00000000..325b07ae
--- /dev/null
+++ b/modules/nixos/services/nixbot.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  self,
+  config,
+  inputs,
+  ...
+}:
+let
+  inherit (lib.modules) mkIf;
+  inherit (self.lib) mkServiceOption mkSecret;
+
+  inherit (config.sops) secrets;
+  rdomain = config.networking.domain;
+  cfg = config.garden.services.nixbot;
+in
+{
+  options.garden.services.nixbot = mkServiceOption "nixbot" { domain = "ci.${rdomain}"; };
+
+  imports = [ inputs.nixbot.nixosModules.default ];
+
+  config = mkIf cfg.enable {
+    sops.secrets = {
+      nixbot-gh-webhook-secret = mkSecret {
+        file = "nixbot";
+        key = "gh-webhook-secret";
+      };
+      nixbot-gh-private-key = mkSecret {
+        file = "nixbot";
+        key = "gh-private-key";
+      };
+      nixbot-gh-oauth = mkSecret {
+        file = "nixbot";
+        key = "gh-oauth";
+      };
+    };
+
+    services = {
+      nixbot = {
+        enable = true;
+        inherit (cfg) domain;
+        statusContextPrefix = "buildbot";
+        buildSystems = [ "x86_64-linux" ];
+
+        admins = [ "github:isabelroses" ];
+
+        github = {
+          enable = true;
+
+          # needed to be set
+          appId = 1153859;
+          secretKeyFile = secrets.nixbot-gh-private-key.path;
+
+          # set if you want to use oauth
+          oauthId = "Iv23liSeLy6J7IS9awg1";
+          oauthSecretFile = secrets.nixbot-gh-oauth.path;
+
+          webhookSecretFile = secrets.nixbot-gh-webhook-secret.path;
+        };
+      };
+
+      nginx.virtualHosts.${cfg.domain} = { };
+    };
+  };
+}
diff --git a/secrets/services/buildbot.yaml b/secrets/services/nixbot.yaml
similarity index 97%
rename from secrets/services/buildbot.yaml
rename to secrets/services/nixbot.yaml
index 6cbfea3f..34987f94 100644
--- a/secrets/services/buildbot.yaml
+++ b/secrets/services/nixbot.yaml
@@ -1,8 +1,6 @@
 gh-oauth-token: ENC[AES256_GCM,data:Ml7OPkEmO8YgNlFk5XM7aGQN7CVii8tny/Xoj2M+t9w+Q9qizELowg==,iv:SER7/TNzjzdOWqC7QbhGVJ+l2wJS9LJIO4cJrsIVuu8=,tag:doPSnmLb5/IMbUwN4XenyQ==,type:str]
 gh-private-key: ENC[AES256_GCM,data:nvHkxHVrqcQUsVJHX9/uHLxlU30jljDnIEU1Hbob9ZhdRjuN0am9TygKGeXFc1FAw6zRFyIv+Xvh96IV5h7I7M66t/15hRv13CEEz4hrmGY9/on0zskqhZERzkVF8pyGEZVQfWWRqgkpSmjUXwwNQL55mKskm7CxkVKYYkHstZbyy0KFTFR+Cndi/yFznELPGqqtYswaN7Hf29GMhCpiyM8lZcVWGB6jzk9xOdvnwxOwbOFzYPOWMcxpYqrlSmvWSd1qbYikQJWi73Lt9rEruPUea9bRs3NWK/j1okKT7bI8AjhJPAjbkHORLrd7e2UawHG1T5v80UyB+Bzro+uyekxnsWRTrRJGSqwOsLEu/1GjGTsfACUJQ324SKVjFfWhOlw++K0zNMziQa2N2heNACUCEu2PUMovXqaXv5K92r3Q726+SmoNmWWtoUf5KkOTaYR9wVEVIei6c0AcK3WBiiaYzAWjMR4xLeIDACyI+QW6ZRyEQge9eDOCVO2op5vY8hBwuvB8VKoqD6IYmUnpG3zsNdVF8i8jIwMG4rwDP0GcizqrZBHo/I/orNT8kr0vDhryhnUH6wKhXzOvzfmunUR4t0L7G9Uefbi2++4AORQ6AuKEFVPyHgRcAWOi6M0oH7Gob45RMZwPwIkS5+XHjmcp+krku9yRPjgCi9F7I7AxxJPkTVMzW0JUvjwXw8NRlgZwbfkB0/Oshuy1YHoEkoMdy1HUGhbPa2MTxl8mbC805Edv5Hj1nYFjmnOD5sa+21AIEuT3X2uIYaVmZ8jnl9cvnaGktvxQVPDOVVNqnciaiRi42ya76lSqb3jHvUCdrxQ9UmsjoqsfKTW/irA1AfAcM05Q2ZQEIXXvKhgD/j3+iPiT9tqYM5qyWt6q9I6EgjchmgsBIfaIbi3PjLKNRrraLJNR/fQRYtyOKVG6QsCoZDrDPzoUkiv1Shn5iO0hNJl2UPWk1NKeEolajF/LflBIKC+7mUIulwGA61FID+MJy9++lSMb4grZ+xIVvhPryo1Zxz+TdEAat9oK0VoFBLOAtTXbVukgGGZ5MpYLFwhtbFhwB//phZYk/SHe2KtTA/csGVWK7LrmyIVU5NvHxkchVb9gxyhkNpyrooeit8g34k77Auk+6W/ONmuykVzRh0HmiUNJ3lDTrMmF8dfW+pBw6qMuy1rCXTp4qT9lzdJ26RWyUqunFOgnFkfLResPexlxa8d03a3MqoyoTDrrGShqW+yz37xpNdj+A2Q/455may3E4xqrUuQHZym1nKfvEoXi85ARKrjFktWzep9vnAV6CzEPw2vuqYgpps5qGXk6JttvUum6rQdT20sqLpZbYjDxGoMliVf5tAexmxCjWETKIzV4gL1yZtsCG/tIlVE8xUeHyqJvR+HnR2ERswxQVRWNOfe5b2Kglql/dh18pTcBmX1ExkYo4ieAfZnUfyXfme5AvnqDnplaZnec3eMKbAkRhmPhsQvM3jmvvq5RkwfHrf0uwbrG0Ycv0KCDuLbdNyWKRvkkDlGWIVrY+k6jHC4mnNaku5Il5xLH2wkJNBNAtoKdQ08PzcuKdejdzJuziGgmUiqdNoc6A+f0AAgfiOra9fLQLbIW9ReIyv4A8KFaj9UBxAqgDJJuZEAY/6HJI9G55UPh95fyvHCltpGQu8q79sARme3EoiJme/5h3hFDQs8DkE9eqpDeaqVIlVyHluIN0wQfPJ4tlDq/P8c6RZfvZidB/Ad4FFEfXdViDdVOR6Iw/Vg16CmaDEpUWjl9lpEwZop54mJtkHRbrAlOdO4dT5e59cqg6bnt10z1dq2MVR96CJX+Ge6/e2/Da78f8QhPAyiswi/5YMgd9SFW+nmRyKzXOVEPW2gUonXBatFfMqpo30Z/mnMDDRnLr3ag/JYI9iLwc9uywE2u7VgML4Nd1LQykYKwmI0DonV8/QjN/rFFRfYpzaU1NeBNTgPtBfpAN+ZRCVPXqJmudJ3/LfQZCpq6Tbv2XWh5SeBNpj3szk5mBp3idKyyW2D+9XwAXyH0aKeEYbjtxN1QCbrHXVQjW6VWd8NRkOI0u3M2gd4Wwj8vitDfQIN6M0b7lBq2+aMg2zTpTd7HhywoI1VZd2ohkMew4+y+BabhBVmXzYNqJfbbOI5A1nZyObgq6tNs2oip818bSjfyQSS09gwyCa26TVh1oxthYAVSCUYD+3erR5cdcYTY/VX7eWA53LBVbPQu90CgZ7TaDg==,iv:kY+m72MnlgI0BQobuLFFahtqYtwUhoNfd3kslf3NAS4=,tag:Rthqo1EqbuTWojSVKDT5Og==,type:str]
 gh-webhook-secret: ENC[AES256_GCM,data:/TWHpUefcXkBdRLmgOhocolr/YE=,iv:YBjMHXMTI26TyWKQJmIWsU5ZGs9dXWUIaNcLl4I8Q50=,tag:+sYxx4YIae27PtM0HwC22g==,type:str]
-worker: ENC[AES256_GCM,data:juslOiZ824lSltn8YUTwB43PX48=,iv:fXlxVZ9SmBBkvhdmphVmBNDjF5Vs3HmzUq1QZsVMaos=,tag:bd5Gifl3iFcpdgomhdf6tA==,type:str]
-workers: ENC[AES256_GCM,data:x0B+KHq+mwIdaOuznndV35Be8wiGbzHUDZtDFGdV6RO1yQh1PqMcJbFjH6O+CfkI4/vJ5l7VGKTUf2ehOg/DXds7Vxy6O70VDgrohcw0O6vx97cgCQ==,iv:T+jdVARyeQ2gLqbggTx5kybBakZg/G5YeSjbzEDKPdc=,tag:3ona/QtB07gyJH3JdN0pEw==,type:str]
 sops:
     age:
         - enc: |
@@ -245,7 +243,7 @@ sops:
             +MkaHjidF1y8OWA=
             -----END AGE ENCRYPTED FILE-----
           recipient: age1pq1jykxgs7z8l5gzpg6j40qp9vzpnkz0a3kern2stm67xjtj6z0lfs32836dafmpvj62afwpc5v2fyhajjjjfzjrvsspffflgdz8pk22tgq2fud8nrtlx7e0s32t0f3s284q6h543vuyvxwf9rfjhc9cgnk9la0zg6psvv9z2m682sth53zr0f2fxkmv3pcpz6vx4n9gmgnq22ax53zyyulphz8htan33d4ekgxz3fau90j02njss66uxks4yn8kl59wu25usf9rjfnccgx9xt2cnwnhs7nh6zswccmhs0gpvkghx0scpyy8tqfcgcnfjl69zlx2qj7jcu42799erd95nrpfszq8yq0pywu9c6knem5v4w2sd8t5ahaw98x8smj49a2nfvetwpaxr6299fkgqgcccs95lter6muqha5xym28ryu4tpsf9hrw6rkze87c7n9t4drh733c8gqhtcp0q28cj2snz3dty4psmtn4kfv9yc773ktjk6xdp2myfvxfyz8tp90valfv6jx9prrv8yccu8vv7jdsc40hugastvvqr5mywl6rgwj9phvh76cq079u7dch7la2u6qqprunk930vuqzjx6fllwhx6as5xvz3p2lx555kpegeej5ggtvagskyt65tge0a5zhmadttrt2zg83um6hz3hgl0pp63jqvva7u0kqkz4censz2gppqcmctpquj3xqx2w7rmyxeq5dwnp5nyugueywm9a9q3xfuq4xgqc88w4y58zq45ejvycmlqsxmc78sa6xcy8mkmy82afdrqc5x7fcx8mdj0gjw4w5m9g6c3stulfjlju8z926jwyljdgcha258xu5dprcvt66vufe6tu45t309re2rzw9gluvyzw97un9m62crd34w33u29uu539wtr4aghx8nrphvd23pt87mqusuj4gf9yh252q7hhgcgrhq2hs6esp9mpq9pf8wvtusz77c3wjpducg55gkjyqvu6y6mn9d3fzspn20frrylkqsw85xchrej06hvtrxut9f4tpyaz6se983vmpjnvx74hy6r7kjedyf06fja8jrvnsqqde64zvg98za8qftpravy6mynrnyuu49knvev3zzws0xusaepz3wd2vx44cc0dau3u88cjtgd6ffq333upszxftaas2tgjfl4ezgpztw4wmsgh8xeczcp5yft3kt7tq55hnvzkrs92mj3kg9jsdk5d8j3jpxz29zsaxjxqry8jreyr2s9nqf44ls9k7npv89lqervqtx45fzu3rnpkjer4fact4x5mvqazwuwe3kasqx6rscqucqe53r28whqtxyrpxz6mr466e03wk5lvgsxycfv8d0gsm7r9ys8a4jgayqr6y52wgdfxm9aqyfvext02vvpauxqv5pqsfggmx33nzpn5g4jy8rzca79tlfynqx94084kk7awyqxrtx5q7t72gy6qr8wnazeg075y7cfe0f5ur3pz8wn0nzqkpue9f6aketqu4vxqtsc5ck8xkcr745tvyjfjw25zdjvyjwgljw7fy3jhc34rp293zjmjkuxr855su3jqya7e5hw2sravw4d9wf9gg9y38zpxwsxvpj8gjmxexxju3729e4srjg72vfde3s728yet5r6gayj6zhjndzgs66pvqjauar3utg88d2m9nztusx8wa4yd7hw8vds80fln902d2jetd3c9rp685curr3jdc45y3w2aggyuc0m5q7ekxh25ys6y09xjxpcql7m9ghz9980tydfsqw4ft5c246ggrejgqety0x489xly7sspandcku8u32negtfnvdd8c2th49kzdzl7752k4e7xq0jjn5fnks4xs9806sj5pydcj58tcfne87rcu4ghhw0x0qjfe4lg6k0xwlhn8eh669jhxgdd2mh3xxdtwqnc5d03
-    lastmodified: "2026-06-03T13:43:08Z"
-    mac: ENC[AES256_GCM,data:T3CTIt+ZREVrRLXEhB/XQaGrnskmmkPVpHHD/C4zF6/7aIXBBFRQFKbLIvXM68g6fYG5XR/LEMLy8zHKFMA6B0kiNl/1KV/HPNppafoYWdX8mCP4g1uPBaw69fqQY9lxh+F8i0YiS8xYSdhZgJQsn2zQmSI8T7qs22BqMjheL60=,iv:+fzDJqm1ECtDyi1j60vtDwT1nLpRU8phUMmngk9KuFk=,tag:1eSL9DZJ0fXbJ3tLAm9Ydg==,type:str]
+    lastmodified: "2026-06-30T09:59:59Z"
+    mac: ENC[AES256_GCM,data:XuncweEUNMKN/Q1Z8jazbxaav3/Axk3ALTR1cPPj7NybXGhVOHN1/CYh7sRzoAMPrsXFeLhRjcxYp6pg1i5HdwBmd9ZVfajPhZtXsinWoTKjxA+3qj/1R5nzEHN4CPnTs4MHLfpO1mW949um0egC8yn/XXAPCMrLl6UxN+DEJ9k=,iv:ZD1XBZKrzIArIkw88eYV2dxSidVRPAMmkdfpCrF73Og=,tag:C8DJwU9V890NUI6y/VZMxg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.13.1