diff --git a/flake.nix b/flake.nix
index 332d7917..d3489962 100644
--- a/flake.nix
+++ b/flake.nix
@@ -252,7 +252,7 @@
               rootDir=$(jj --ignore-working-copy root || git rev-parse --show-toplevel) || (echo "error: can't find repo root?"; exit 1)
               cd "$rootDir"
 
-              rm api/tangled/*
+              rm -f api/tangled/*
               lexgen --build-file lexicon-build-config.json lexicons
               sed -i.bak 's/\tutil/\/\/\tutil/' api/tangled/*
               ${pkgs.gotools}/bin/goimports -w api/tangled/*
diff --git a/nix/modules/knot.nix b/nix/modules/knot.nix
index 3376f516..ce8816f2 100644
--- a/nix/modules/knot.nix
+++ b/nix/modules/knot.nix
@@ -93,6 +93,12 @@ in
             description = "Internal address for inter-service communication";
           };
 
+          owner = mkOption {
+            type = types.str;
+            example = "did:plc:qfpnj4og54vl56wngdriaxug";
+            description = "DID of owner (required)";
+          };
+
           secretFile = mkOption {
             type = lib.types.path;
             example = "KNOT_SERVER_SECRET=<hash>";
@@ -199,6 +205,7 @@ in
             "KNOT_SERVER_LISTEN_ADDR=${cfg.server.listenAddr}"
             "KNOT_SERVER_DB_PATH=${cfg.server.dbPath}"
             "KNOT_SERVER_HOSTNAME=${cfg.server.hostname}"
+            "KNOT_SERVER_OWNER=${cfg.server.owner}"
           ];
           EnvironmentFile = cfg.server.secretFile;
           ExecStart = "${cfg.package}/bin/knot server";
diff --git a/nix/vm.nix b/nix/vm.nix
index f0840bb3..a54e282f 100644
--- a/nix/vm.nix
+++ b/nix/vm.nix
@@ -70,13 +70,14 @@ in
         };
         # This is fine because any and all ports that are forwarded to host are explicitly marked above, we don't need a separate guest firewall
         networking.firewall.enable = false;
+        time.timeZone = "Europe/London";
         services.getty.autologinUser = "root";
         environment.systemPackages = with pkgs; [curl vim git sqlite litecli];
         services.tangled-knot = {
           enable = true;
           motd = "Welcome to the development knot!\n";
           server = {
-            secretFile = builtins.toFile "knot-secret" ("KNOT_SERVER_SECRET=" + (envVar "TANGLED_VM_KNOT_SECRET"));
+            owner = envVar "TANGLED_VM_KNOT_OWNER";
             hostname = "localhost:6000";
             listenAddr = "0.0.0.0:6000";
           };