diff --git a/host-specific/othinus/configuration.nix b/host-specific/othinus/configuration.nix
index 89143b3..2465bc0 100644
--- a/host-specific/othinus/configuration.nix
+++ b/host-specific/othinus/configuration.nix
@@ -13,6 +13,7 @@
   programs.mosh.enable = lib.mkForce false;
 
   ngp.binaryCacheCopy.enable = false;
+  # TODO(ngp): clean this up so it's not necessary when ngp.binaryCacheCopy.enable == false
   system.activationScripts.copyNixStoreToMisaki.text = lib.mkForce "";
 
   nix.distributedBuilds = lib.mkForce false;
diff --git a/host-specific/othinus/manticore-vm.nix b/host-specific/othinus/manticore-vm.nix
index dfedaba..ce39fa2 100644
--- a/host-specific/othinus/manticore-vm.nix
+++ b/host-specific/othinus/manticore-vm.nix
@@ -12,11 +12,20 @@ let
 
   guest = inputs.nixpkgs.lib.nixosSystem {
     inherit (pkgs.stdenv.hostPlatform) system;
+    specialArgs = {
+      extraGroups = [ ];
+      enableNFTables = true;
+    };
     modules = [
+      inputs.agenix.nixosModules.default
+      ../../services.nix
+      ../../users.nix
       (
         { modulesPath, pkgs, ... }:
         {
-          imports = [ "${modulesPath}/virtualisation/qemu-vm.nix" ];
+          imports = [
+            "${modulesPath}/virtualisation/qemu-vm.nix"
+          ];
 
           nixpkgs.overlays = [
             (final: prev: {
@@ -106,19 +115,6 @@ let
             };
           };
 
-          users.users.noah = {
-            isNormalUser = true;
-            extraGroups = [ "wheel" ];
-            openssh.authorizedKeys.keys = lib.strings.splitString "\n" (
-              builtins.readFile (
-                builtins.fetchurl {
-                  url = "https://meta.sr.ht/~chiefnoah.keys";
-                  name = "chiefnoah.keys";
-                  sha256 = "15wipcgx4lbhx88x4abpcia82rk9806icdvs3j3ydj9zk3aj3ig8";
-                }
-              )
-            );
-          };
           security.sudo.wheelNeedsPassword = false;
 
           virtualisation = {