From 15879674883d8b01264c8735edd7fa2519546b61 Mon Sep 17 00:00:00 2001
From: Nikolaos Karaolidis <nick@karaolidis.com>
Date: Sat, 19 Jul 2025 12:51:28 +0100
Subject: [PATCH] Refactor flake patching/recursion

Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>
---
 .gitmodules                                   |   8 -
 README.md                                     |   4 +-
 flake.lock                                    | 152 +++++++--------
 flake.nix                                     | 183 ++++++------------
 .../hardware/gu605c-spi-cs-gpio/default.nix   |  10 +-
 hosts/jupiter/configs/wireguard/default.nix   |   5 +-
 lib/scripts/add-host.sh                       |   6 +-
 lib/scripts/remove-host.sh                    |   5 +-
 lib/scripts/update.sh                         |  39 ----
 .../darktable/ghost-cms-publish/default.nix   |  18 +-
 packages/darktable/hald-clut/default.nix      |   4 +-
 packages/darktable/lua-scripts/default.nix    |   4 +-
 packages/docker/jellyseerr/default.nix        |  31 +--
 packages/docker/traefik/default.nix           |   4 +
 .../jellyfin/plugins/bookshelf/default.nix    |   6 +-
 .../plugins/intro-skipper/default.nix         |   8 +-
 .../plugins/opensubtitles/default.nix         |   6 +-
 .../plugins/playbackreporting/default.nix     |   6 +-
 packages/jellyfin/plugins/reports/default.nix |   6 +-
 packages/jellyfin/plugins/sso/default.nix     |   6 +-
 .../plugins/subtitleextract/default.nix       |   6 +-
 .../jellyfin/plugins/tmdbboxsets/default.nix  |   6 +-
 packages/jellyfin/plugins/tvdb/default.nix    |   6 +-
 packages/linux-firmware-latest/default.nix    |   4 +-
 packages/littlelink-server/default.nix        |  20 +-
 .../plugins/better-word-count/default.nix     |   8 +-
 .../obsidian/plugins/dataview/default.nix     |   6 +-
 .../obsidian/plugins/excalidraw/default.nix   |  12 +-
 packages/obsidian/plugins/kanban/default.nix  |   8 +-
 .../obsidian/plugins/languagetool/default.nix |   8 +-
 packages/obsidian/plugins/linter/default.nix  |   6 +-
 .../obsidian/plugins/map-view/default.nix     |   6 +-
 .../plugins/minimal-settings/default.nix      |   6 +-
 .../obsidian/plugins/outliner/default.nix     |   6 +-
 .../plugins/style-settings/default.nix        |  10 +-
 packages/obsidian/plugins/tasks/default.nix   |   8 +-
 .../plugins/url-into-selection/default.nix    |   6 +-
 packages/obsidian/themes/minimal/default.nix  |   6 +-
 packages/oidcwarden/default.nix               |   8 +-
 .../prometheus-fail2ban-exporter/default.nix  |  10 +-
 .../prometheus-podman-exporter/default.nix    |  10 +-
 packages/sas/cacert/default.nix               |   2 +-
 packages/sas/viya4-orders-cli/default.nix     |   8 +-
 packages/shlink-web-client/default.nix        |  10 +-
 packages/shlink/default.nix                   |   6 +-
 packages/ssh/known-hosts/github/default.nix   |   2 +-
 .../ssh/known-hosts/sas/artifact/default.nix  |   2 +-
 .../ssh/known-hosts/sas/cldlgn/default.nix    |   2 +-
 .../ssh/known-hosts/sas/gerrit/default.nix    |   2 +-
 .../ssh/known-hosts/sas/gitlab/default.nix    |   2 +-
 .../yazi/plugins/custom-shell/default.nix     |   2 +-
 patches.nix                                   |  10 +
 submodules/home-manager                       |   1 -
 submodules/nixpkgs                            |   1 -
 treefmt.nix                                   |   2 -
 55 files changed, 303 insertions(+), 426 deletions(-)
 delete mode 100644 .gitmodules
 create mode 100644 patches.nix
 delete mode 160000 submodules/home-manager
 delete mode 160000 submodules/nixpkgs

diff --git a/.gitmodules b/.gitmodules
deleted file mode 100644
index 4f2e69e..0000000
--- a/.gitmodules
+++ /dev/null
@@ -1,8 +0,0 @@
-[submodule "submodules/nixpkgs"]
-	path = submodules/nixpkgs
-	url = git@github.com:karaolidis/nixpkgs.git
-	branch = integration
-[submodule "submodules/home-manager"]
-	path = submodules/home-manager
-	url = git@github.com:karaolidis/home-manager.git
-	branch = integration
diff --git a/README.md b/README.md
index 1349bc3..e89786f 100644
--- a/README.md
+++ b/README.md
@@ -27,9 +27,7 @@ NixOS dotfiles and configuration for various hosts and users.
     - [`add-host.sh`](./lib/scripts/add-host.sh): Instantiate the keys for a new host configuration.
     - [`remove-host.sh`](./lib/scripts/remove-host.sh): Remove references to a host.
     - [`update-keys.sh`](./lib/scripts/update-keys.sh): Update the encryption keys in all relevant files using `sops.yaml` configurations.
-    - [`update.sh`](./lib/scripts/update.sh): Update flake and all git submodules.
-
-- [`submodules/`](./submodules): Flake forks used in the repository, such as [`nixpkgs`](https://github.com/NixOS/nixpkgs) and [`home-manager`](https://github.com/nix-community/home-manager).
+    - [`update.sh`](./lib/scripts/update.sh): Update flake and all packages.
 
 Any `options.nix` files create custom option definitions when present.
 
diff --git a/flake.lock b/flake.lock
index 79a3cd7..486168c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -11,16 +11,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1751930350,
-        "narHash": "sha256-hBIrzyrwG3XjeNyzVNWKDX+yYVlpwAqf9ovgF7qecug=",
+        "lastModified": 1752328525,
+        "narHash": "sha256-0aaVFLQxY1dKIS5jzwhbO847yIdr3U0o2heUzC5iat4=",
         "owner": "aylur",
         "repo": "ags",
-        "rev": "22f37ccb0db58d9d8a11ad0054ab20ecfad005ad",
+        "rev": "2eb3ea54311b0f7ba9d333d661d12cda1ed5507e",
         "type": "github"
       },
       "original": {
         "owner": "aylur",
-        "ref": "main",
         "repo": "ags",
         "type": "github"
       }
@@ -32,16 +31,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1752227802,
-        "narHash": "sha256-5Nr80lTZJ8ewuxIzRHc6E8L4LW4rdGZukiZyL7nOVSE=",
+        "lastModified": 1752404970,
+        "narHash": "sha256-XULTToDUkIshNXEO+YP2mAHdQv8bxWDvKjbamBfOC8E=",
         "owner": "aylur",
         "repo": "astal",
-        "rev": "81eb3770965190024803ed6dd0fe35318da64831",
+        "rev": "2c5eb54f39e1710c6e2c80915a240978beb3269a",
         "type": "github"
       },
       "original": {
         "owner": "aylur",
-        "ref": "main",
         "repo": "astal",
         "type": "github"
       }
@@ -53,20 +51,43 @@
         ]
       },
       "locked": {
-        "lastModified": 1752113600,
-        "narHash": "sha256-7LYDxKxZgBQ8LZUuolAQ8UkIB+jb4A2UmiR+kzY9CLI=",
+        "lastModified": 1746728054,
+        "narHash": "sha256-eDoSOhxGEm2PykZFa/x9QG5eTH0MJdiJ9aR00VAofXE=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "79264292b7e3482e5702932949de9cbb69fedf6d",
+        "rev": "ff442f5d1425feb86344c028298548024f21256d",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "master",
+        "ref": "latest",
         "repo": "disko",
         "type": "github"
       }
     },
+    "flake-input-patcher": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": [
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1751871600,
+        "narHash": "sha256-I4/2ekJrbRMhOpKfzgnlrN45nQj9YQmZnoSeAaRa1SU=",
+        "owner": "jfly",
+        "repo": "flake-input-patcher",
+        "rev": "4ff068126d49829b106280738944bde91951d59d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jfly",
+        "repo": "flake-input-patcher",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -104,7 +125,6 @@
       },
       "original": {
         "owner": "numtide",
-        "ref": "main",
         "repo": "flake-utils",
         "type": "github"
       }
@@ -132,32 +152,31 @@
         ]
       },
       "locked": {
-        "lastModified": 1752220369,
-        "narHash": "sha256-Fk4KFIfdq4iATbwojGQvHFly93mZJnGuD6k+P4YV/lE=",
-        "owner": "karaolidis",
+        "lastModified": 1752814804,
+        "narHash": "sha256-irfg7lnfEpJY+3Cffkluzp2MTVw1Uq9QGxFp6qadcXI=",
+        "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "444d7a18b87260772c5293a10f998d3da67e5f44",
+        "rev": "d0300c8808e41da81d6edfc202f3d3833c157daf",
         "type": "github"
       },
       "original": {
-        "owner": "karaolidis",
-        "ref": "integration",
+        "owner": "nix-community",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1752234186,
-        "narHash": "sha256-v9iaBVKTk6vGVle8q6s22reTtl+BxJFA+i6Gs5YmMXo=",
-        "owner": "karaolidis",
+        "lastModified": 1752687322,
+        "narHash": "sha256-RKwfXA4OZROjBTQAl9WOZQFm7L8Bo93FQwSJpAiSRvo=",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5b6fdd0939385dff89d6cfc5d2e125a392f7a107",
+        "rev": "6e987485eb2c77e5dcc5af4e3c70843711ef9251",
         "type": "github"
       },
       "original": {
-        "owner": "karaolidis",
-        "ref": "integration",
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -170,16 +189,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1752229622,
-        "narHash": "sha256-jGJH7ssNiuex4+FVOS97PRhmkMAeJreKfmEkWhka/Bc=",
+        "lastModified": 1752908641,
+        "narHash": "sha256-7fSP4+p5QjWXFbnD4NeVQjtdCSsTMX2yAP1eNDooq4E=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "b814b0f9755b2d58ecd69303cb438d0776ee49a5",
+        "rev": "ea63ce63073a11274ef327c5eb7f2ebb67606ebe",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "main",
         "repo": "NUR",
         "type": "github"
       }
@@ -189,35 +207,35 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "utils": "utils"
+        "utils": [
+          "flake-utils"
+        ]
       },
       "locked": {
-        "lastModified": 1752193435,
-        "narHash": "sha256-kEmmqqBoiB46HcFNYojiTAqZiCraaHMAbB5wxWg2/cU=",
+        "lastModified": 1752555591,
+        "narHash": "sha256-3u29/v6VCHnaXjkMmjgwIGzR4Oul9EVHqxgJB6xTN0w=",
         "owner": "icewind1991",
         "repo": "nvidia-patch-nixos",
-        "rev": "ab69bce4e85c45c356acbc9ab818fbbd646e44c3",
+        "rev": "1140fd66d2f7e0be1a72ac9fdc32fffe4bb371e5",
         "type": "github"
       },
       "original": {
         "owner": "icewind1991",
-        "ref": "main",
         "repo": "nvidia-patch-nixos",
         "type": "github"
       }
     },
     "quadlet-nix": {
       "locked": {
-        "lastModified": 1751931728,
-        "narHash": "sha256-i4OALPUnFhe9j9NauZaszZZTgIYSaLHmCO2gp9MZYKQ=",
+        "lastModified": 1752618481,
+        "narHash": "sha256-8132xTqalZxJZbznHDNoia1UqjNdL/hIQD4IXnI9F58=",
         "owner": "SEIAROTg",
         "repo": "quadlet-nix",
-        "rev": "5cb4f185dc3722d589bdf238e6802c4c9f87994e",
+        "rev": "0c1d64f360c1a3c3534f6b592ca3ed5d46cf8429",
         "type": "github"
       },
       "original": {
         "owner": "SEIAROTg",
-        "ref": "main",
         "repo": "quadlet-nix",
         "type": "github"
       }
@@ -227,6 +245,7 @@
         "ags": "ags",
         "astal": "astal",
         "disko": "disko",
+        "flake-input-patcher": "flake-input-patcher",
         "flake-utils": "flake-utils",
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
@@ -235,7 +254,7 @@
         "quadlet-nix": "quadlet-nix",
         "sops-nix": "sops-nix",
         "spicetify-nix": "spicetify-nix",
-        "systems": "systems_2",
+        "systems": "systems",
         "treefmt-nix": "treefmt-nix"
       }
     },
@@ -246,16 +265,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1751606940,
-        "narHash": "sha256-KrDPXobG7DFKTOteqdSVeL1bMVitDcy7otpVZWDE6MA=",
+        "lastModified": 1752544651,
+        "narHash": "sha256-GllP7cmQu7zLZTs9z0J2gIL42IZHa9CBEXwBY9szT0U=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "3633fc4acf03f43b260244d94c71e9e14a2f6e0d",
+        "rev": "2c8def626f54708a9c38a5861866660395bb3461",
         "type": "github"
       },
       "original": {
         "owner": "Mic92",
-        "ref": "master",
         "repo": "sops-nix",
         "type": "github"
       }
@@ -270,16 +288,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1751776600,
-        "narHash": "sha256-75wd/aSvSoXUVd/buwI+Gsqx6LdmBVMbdXw+tCV1u58=",
+        "lastModified": 1752381641,
+        "narHash": "sha256-R2iDZb94RosuCeuIukacZVVXxzWYr4jn/QI/ax15nW8=",
         "owner": "Gerg-L",
         "repo": "spicetify-nix",
-        "rev": "54fad36eeae085f4a6ce4522bc351705b9c0c58a",
+        "rev": "8f9fd947c52aa6adb6bafe72516eccf186708954",
         "type": "github"
       },
       "original": {
         "owner": "Gerg-L",
-        "ref": "master",
         "repo": "spicetify-nix",
         "type": "github"
       }
@@ -299,22 +316,6 @@
         "type": "github"
       }
     },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "ref": "main",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
@@ -322,37 +323,18 @@
         ]
       },
       "locked": {
-        "lastModified": 1752055615,
-        "narHash": "sha256-19m7P4O/Aw/6+CzncWMAJu89JaKeMh3aMle1CNQSIwM=",
+        "lastModified": 1752909129,
+        "narHash": "sha256-Eh8FkMvGRaY71BU/oyZTTzt9RsBIq2E6j0r3eLZ/2kY=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "c9d477b5d5bd7f26adddd3f96cfd6a904768d4f9",
+        "rev": "0043b95d80b5bf6d61e84d237e2007727f4dd38d",
         "type": "github"
       },
       "original": {
         "owner": "numtide",
-        "ref": "main",
         "repo": "treefmt-nix",
         "type": "github"
       }
-    },
-    "utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index d2ca1b6..193bdb0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,110 +1,64 @@
 {
   inputs = {
-    nixpkgs = {
-      # --- Official
-      # type = "github";
-      # owner = "NixOS";
-      # repo = "nixpkgs";
-      # ref = "master";
-      # --- Fork
-      type = "github";
-      owner = "karaolidis";
-      repo = "nixpkgs";
-      ref = "integration";
-      # --- Local
-      # url = "git+file:./submodules/nixpkgs";
-    };
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
     home-manager = {
-      # --- Official
-      # type = "github";
-      # owner = "nix-community"
-      # repo = "home-manager";
-      # --- Fork
-      type = "github";
-      owner = "karaolidis";
-      repo = "home-manager";
-      ref = "integration";
-      # --- Local
-      # url = "git+file:./submodules/home-manager";
-
+      url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     disko = {
-      type = "github";
-      owner = "nix-community";
-      repo = "disko";
-      ref = "master";
-
+      url = "github:nix-community/disko/latest";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     sops-nix = {
-      type = "github";
-      owner = "Mic92";
-      repo = "sops-nix";
-      ref = "master";
-
+      url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    systems = {
-      type = "github";
-      owner = "nix-systems";
-      repo = "default";
-      ref = "main";
-    };
+    systems.url = "github:nix-systems/default";
 
     nur = {
-      type = "github";
-      owner = "nix-community";
-      repo = "NUR";
-      ref = "main";
-
+      url = "github:nix-community/NUR";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     flake-utils = {
-      type = "github";
-      owner = "numtide";
-      repo = "flake-utils";
-      ref = "main";
-
+      url = "github:numtide/flake-utils";
       inputs.systems.follows = "systems";
     };
 
     treefmt-nix = {
-      type = "github";
-      owner = "numtide";
-      repo = "treefmt-nix";
-      ref = "main";
-
+      url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    quadlet-nix = {
-      type = "github";
-      owner = "SEIAROTg";
-      repo = "quadlet-nix";
-      ref = "main";
+    flake-input-patcher = {
+      url = "github:jfly/flake-input-patcher";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        systems.follows = "systems";
+      };
+    };
+
+    quadlet-nix.url = "github:SEIAROTg/quadlet-nix";
+
+    nvidia-patch = {
+      url = "github:icewind1991/nvidia-patch-nixos";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        utils.follows = "flake-utils";
+      };
     };
 
     astal = {
-      type = "github";
-      owner = "aylur";
-      repo = "astal";
-      ref = "main";
-
+      url = "github:aylur/astal";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     ags = {
-      type = "github";
-      owner = "aylur";
-      repo = "ags";
-      ref = "main";
-
+      url = "github:aylur/ags";
       inputs = {
         nixpkgs.follows = "nixpkgs";
         astal.follows = "astal";
@@ -112,66 +66,37 @@
     };
 
     spicetify-nix = {
-      type = "github";
-      owner = "Gerg-L";
-      repo = "spicetify-nix";
-      ref = "master";
-
+      url = "github:Gerg-L/spicetify-nix";
       inputs = {
         nixpkgs.follows = "nixpkgs";
         systems.follows = "systems";
       };
     };
-
-    nvidia-patch = {
-      type = "github";
-      owner = "icewind1991";
-      repo = "nvidia-patch-nixos";
-      ref = "main";
-
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
 
   outputs =
-    { self, nixpkgs, ... }@inputs:
-    {
-      nixosConfigurations = {
-        installer = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/installer ];
-          specialArgs = { inherit inputs system; };
-        };
+    inputs:
+    let
+      mkInputs =
+        system:
+        let
+          patcher = inputs.flake-input-patcher.lib.${system};
+        in
+        patcher.patch inputs (import ./patches.nix { inherit patcher; });
 
-        himalia = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/himalia ];
+      mkNixosConfiguration =
+        inputs: system: modules:
+        inputs.nixpkgs.lib.nixosSystem {
+          inherit system modules;
           specialArgs = { inherit inputs system; };
         };
-
-        elara = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/elara ];
-          specialArgs = { inherit inputs system; };
-        };
-
-        jupiter = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/jupiter ];
-          specialArgs = { inherit inputs system; };
-        };
-
-        jupiter-vps = nixpkgs.lib.nixosSystem rec {
-          system = "x86_64-linux";
-          modules = [ ./hosts/jupiter-vps ];
-          specialArgs = { inherit inputs system; };
-        };
-      };
-    }
-    // inputs.flake-utils.lib.eachSystem [ "x86_64-linux" ] (
-      system:
+    in
+    (
       let
-        pkgs = import nixpkgs {
+        system = "x86_64-linux";
+        inputs = mkInputs system;
+
+        pkgs = import inputs.nixpkgs {
           inherit system;
           config.allowUnfree = true;
         };
@@ -179,12 +104,20 @@
         treefmt = inputs.treefmt-nix.lib.evalModule pkgs ./treefmt.nix;
       in
       {
-        devShells = import ./hosts/common/shells { inherit pkgs; };
-        lib = import ./lib { inherit pkgs; };
-        packages = import ./packages { inherit pkgs inputs system; };
+        nixosConfigurations = {
+          installer = mkNixosConfiguration inputs system [ ./hosts/installer ];
+          himalia = mkNixosConfiguration inputs system [ ./hosts/himalia ];
+          elara = mkNixosConfiguration inputs system [ ./hosts/elara ];
+          jupiter = mkNixosConfiguration inputs system [ ./hosts/jupiter ];
+          jupiter-vps = mkNixosConfiguration inputs system [ ./hosts/jupiter-vps ];
+        };
 
-        formatter = treefmt.config.build.wrapper;
-        checks.formatting = treefmt.config.build.check self;
+        devShells.${system} = import ./hosts/common/shells { inherit pkgs; };
+        lib.${system} = import ./lib { inherit pkgs; };
+        packages.${system} = import ./packages { inherit pkgs inputs system; };
+
+        formatter.${system} = treefmt.config.build.wrapper;
+        checks.formatting.${system} = treefmt.config.build.check inputs.self;
       }
     );
 }
diff --git a/hosts/himalia/hardware/gu605c-spi-cs-gpio/default.nix b/hosts/himalia/hardware/gu605c-spi-cs-gpio/default.nix
index 27b999f..9d95565 100644
--- a/hosts/himalia/hardware/gu605c-spi-cs-gpio/default.nix
+++ b/hosts/himalia/hardware/gu605c-spi-cs-gpio/default.nix
@@ -1,5 +1,5 @@
 { pkgs, ... }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "asus-gu605c-acpi";
   version = "0.0.1";
 
@@ -17,12 +17,12 @@ pkgs.stdenv.mkDerivation rec {
 
   buildPhase = ''
     mkdir -p kernel/firmware/acpi
-    iasl -we -p kernel/firmware/acpi/${pname} ${src}
-    find kernel | cpio -H newc -o > ${pname}.cpio
+    iasl -we -p kernel/firmware/acpi/${finalAttrs.pname} ${finalAttrs.src}
+    find kernel | cpio -H newc -o > ${finalAttrs.pname}.cpio
   '';
 
   installPhase = ''
     mkdir -p $out
-    cp ${pname}.cpio $out/
+    cp ${finalAttrs.pname}.cpio $out/
   '';
-}
+})
diff --git a/hosts/jupiter/configs/wireguard/default.nix b/hosts/jupiter/configs/wireguard/default.nix
index 80846ae..915e20e 100644
--- a/hosts/jupiter/configs/wireguard/default.nix
+++ b/hosts/jupiter/configs/wireguard/default.nix
@@ -24,8 +24,9 @@ in
     wireguard.interfaces.wg0 =
       let
         ip = "${pkgs.iproute2}/bin/ip";
+        table = "wireguard";
       in
-      rec {
+      {
         ips = [
           "10.0.0.2/24"
           "${jupiterPublicIPv4}/32"
@@ -33,7 +34,7 @@ in
 
         privateKeyFile = config.sops.secrets."wireguard/client/vps".path;
 
-        table = "wireguard";
+        inherit table;
         postSetup = [ "${ip} rule add from ${jupiterPublicIPv4} table ${table}" ];
         postShutdown = [ "${ip} rule del from ${jupiterPublicIPv4} table ${table}" ];
 
diff --git a/lib/scripts/add-host.sh b/lib/scripts/add-host.sh
index 6ece7ab..0ebbe82 100755
--- a/lib/scripts/add-host.sh
+++ b/lib/scripts/add-host.sh
@@ -192,11 +192,7 @@ cat <<EOF > "./hosts/$host/README.md"
 EOF
 
 sed -i "/nixosConfigurations = {/a\\
-        $host = nixpkgs.lib.nixosSystem rec {\\
-          system = \"x86_64-linux\";\\
-          modules = [ ./hosts/$host ];\\
-          specialArgs = { inherit inputs system; };\\
-        };\n\n" flake.nix
+          $host = mkNixosConfiguration inputs system [ ./hosts/$host ];\n" flake.nix
 
 sed -i "/knownHosts = {/a\\    $host.publicKeyFile = ../../../../$host/secrets/ssh_host_ed25519_key.pub;" ./hosts/common/configs/system/ssh/default.nix
 
diff --git a/lib/scripts/remove-host.sh b/lib/scripts/remove-host.sh
index 6722c8f..eb8263d 100755
--- a/lib/scripts/remove-host.sh
+++ b/lib/scripts/remove-host.sh
@@ -18,9 +18,8 @@ find . -type f -name "sops.yaml" | while IFS= read -r sops_file; do
   sed -i "/          - \*$host/d" "$sops_file"
 done
 
-sed -i "/$host/d" ./hosts/common/configs/system/ssh/default.nix
-sed -i "/$host = nixpkgs.lib.nixosSystem rec {/,/^[[:space:]]*};/d" flake.nix
-sed -i "/$host/d" ./README.md
+sed -i "/$host = mkNixosConfiguration/d" flake.nix
+sed -i "/`$host`/d" ./README.md
 
 rm -rf "./hosts/$host"
 
diff --git a/lib/scripts/update.sh b/lib/scripts/update.sh
index 3268795..fc6ce0a 100755
--- a/lib/scripts/update.sh
+++ b/lib/scripts/update.sh
@@ -4,43 +4,6 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-echo "Updating submodules..."
-
-paths=$(git config --file .gitmodules --name-only --get-regexp path | while read -r line; do
-  path=$(git config --file .gitmodules --get "$line")
-  url=$(git config --file .gitmodules --get "${line%.*}.url")
-  if [[ $url == *"karaolidis"* ]]; then
-    echo "$path"
-  fi
-done)
-
-for path in $paths; do
-  echo "Processing submodule: $path"
-
-  cd "$path" || exit
-
-  default_branch=$(git remote show origin | awk '/HEAD branch/ {print $NF}')
-  git checkout "$default_branch"
-  git fetch upstream
-  git merge "upstream/$default_branch"
-
-  branches=$(git for-each-ref --format='%(refname:short)' refs/heads/ | grep -v "^${default_branch}$")
-  for branch in $branches; do
-    git checkout "$branch"
-    git rebase "$default_branch"
-  done
-
-  git checkout integration
-  git push origin --all --force-with-lease
-  git push origin --tags --force-with-lease
-
-  cd - > /dev/null || exit
-done
-
-echo "All submodules updated successfully."
-
-echo "Updating packages..."
-
 find packages -type f -name "*.nix" | while read -r file; do
   update_command=$(grep -oP '^#\s*AUTO-UPDATE:\s*\K.+' "$file" || true)
   if [[ -n "$update_command" ]]; then
@@ -49,6 +12,4 @@ find packages -type f -name "*.nix" | while read -r file; do
   fi
 done
 
-echo "All packages updated successfully."
-
 nix flake update
diff --git a/packages/darktable/ghost-cms-publish/default.nix b/packages/darktable/ghost-cms-publish/default.nix
index 082fa0c..7327c2e 100644
--- a/packages/darktable/ghost-cms-publish/default.nix
+++ b/packages/darktable/ghost-cms-publish/default.nix
@@ -1,19 +1,19 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=main darktable-ghost-cms-publish --subpackage npmSrc
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "darktable-ghost-cms-publish";
   version = "0-unstable-2025-02-23";
 
   src = pkgs.fetchFromGitLab {
     domain = "git.karaolidis.com";
     owner = "karaolidis";
-    repo = pname;
+    repo = finalAttrs.pname;
     rev = "26780273b2a093c6e6a3140d0220d252f0bc709e";
     hash = "sha256-5aoGkqxMyvyK8EDsSE6kZa+dpExxVH2GRx2n87VusKE=";
   };
 
   npmSrc = pkgs.buildNpmPackage {
-    inherit src pname version;
+    inherit (finalAttrs) src pname version;
 
     npmDepsHash = "sha256-K/x9ZEMNO8D+SkvVPfqVJtZaDXY5gDApRRocg/POY68=";
     dontNpmBuild = true;
@@ -25,16 +25,16 @@ pkgs.stdenv.mkDerivation rec {
 
   # FIXME: https://github.com/NixOS/nixpkgs/issues/255890
   wrapper = pkgs.writeShellApplication {
-    name = pname;
+    name = finalAttrs.pname;
     runtimeInputs = with pkgs; [ bun ];
     text = ''
-      exec bun ${npmSrc}/src/index.ts "$@"
+      exec bun ${finalAttrs.npmSrc}/src/index.ts "$@"
     '';
   };
 
   installPhase = ''
-    mkdir -p $out/bin $out/lib/${pname}
-    cp publish.lua $out/lib/${pname}/
-    cp ${wrapper}/bin/${pname} $out/bin/
+    mkdir -p $out/bin $out/lib/${finalAttrs.pname}
+    cp publish.lua $out/lib/${finalAttrs.pname}/
+    cp ${finalAttrs.wrapper}/bin/${finalAttrs.pname} $out/bin/
   '';
-}
+})
diff --git a/packages/darktable/hald-clut/default.nix b/packages/darktable/hald-clut/default.nix
index c74734e..0621b17 100644
--- a/packages/darktable/hald-clut/default.nix
+++ b/packages/darktable/hald-clut/default.nix
@@ -1,12 +1,12 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=master darktable-hald-clut
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
   pname = "hald-clut";
   version = "0-unstable-2019-03-21";
 
   src = pkgs.fetchFromGitHub {
     owner = "cedeber";
-    repo = pname;
+    repo = "hald-clut";
     rev = "3b3180f82d4dcea1e6e8c5648473539a910d7f49";
     hash = "sha256-R8vyYmcsfk49QsSV3v0QblXcO6U0oIfDyxbHPLwSMdo=";
   };
diff --git a/packages/darktable/lua-scripts/default.nix b/packages/darktable/lua-scripts/default.nix
index a4d2362..bf251f9 100644
--- a/packages/darktable/lua-scripts/default.nix
+++ b/packages/darktable/lua-scripts/default.nix
@@ -1,12 +1,12 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=master darktable-lua-scripts
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
   pname = "lua-scripts";
   version = "release-2.0.0-unstable-2025-07-05";
 
   src = pkgs.fetchFromGitHub {
     owner = "darktable-org";
-    repo = pname;
+    repo = "lua-scripts";
     rev = "aed3275943f218e559c58b98579ceafb02e220da";
     hash = "sha256-vRE0kxqbjdjwU+S0Eu44ctYulYPgD0XsrTsz1ESq6t0=";
   };
diff --git a/packages/docker/jellyseerr/default.nix b/packages/docker/jellyseerr/default.nix
index fa550a0..ed7086d 100644
--- a/packages/docker/jellyseerr/default.nix
+++ b/packages/docker/jellyseerr/default.nix
@@ -8,20 +8,25 @@ let
   };
 
   # FIXME: https://github.com/fallenbagel/jellyseerr/pull/1505
-  jellyseerr = pkgs.jellyseerr.overrideAttrs (oldAttrs: rec {
-    src = pkgs.fetchFromGitHub {
-      owner = "Fallenbagel";
-      repo = "jellyseerr";
-      tag = "preview-OIDC";
-      hash = "sha256-iBnO0WjNqvXfuJMoS6z/NmYgtW5FQ9Ptp9uV5rODIf8=";
-    };
-
-    pnpmDeps = (pkgs.pnpm_9.override { nodejs = pkgs.nodejs_22; }).fetchDeps {
+  jellyseerr = pkgs.jellyseerr.overrideAttrs (
+    oldAttrs:
+    let
+      src = pkgs.fetchFromGitHub {
+        owner = "Fallenbagel";
+        repo = "jellyseerr";
+        tag = "preview-OIDC";
+        hash = "sha256-iBnO0WjNqvXfuJMoS6z/NmYgtW5FQ9Ptp9uV5rODIf8=";
+      };
+    in
+    {
       inherit src;
-      inherit (oldAttrs) pname version;
-      hash = "sha256-lq/b2PqQHsZmnw91Ad4h1uxZXsPATSLqIdb/t2EsmMI=";
-    };
-  });
+      pnpmDeps = (pkgs.pnpm_9.override { nodejs = pkgs.nodejs_22; }).fetchDeps {
+        inherit src;
+        inherit (oldAttrs) pname version;
+        hash = "sha256-lq/b2PqQHsZmnw91Ad4h1uxZXsPATSLqIdb/t2EsmMI=";
+      };
+    }
+  );
 in
 pkgs.dockerTools.buildImage {
   name = "jellyseerr";
diff --git a/packages/docker/traefik/default.nix b/packages/docker/traefik/default.nix
index 68e62d1..23142a7 100644
--- a/packages/docker/traefik/default.nix
+++ b/packages/docker/traefik/default.nix
@@ -11,6 +11,10 @@ pkgs.dockerTools.buildImage {
 
   config = {
     Entrypoint = [ "traefik" ];
+    Volumes = {
+      "/var/lib/traefik" = { };
+    };
+    WorkingDir = "/var/lib/traefik";
     ExposedPorts = {
       "80/tcp" = { };
     };
diff --git a/packages/jellyfin/plugins/bookshelf/default.nix b/packages/jellyfin/plugins/bookshelf/default.nix
index aa667d2..3c7b4b2 100644
--- a/packages/jellyfin/plugins/bookshelf/default.nix
+++ b/packages/jellyfin/plugins/bookshelf/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-bookshelf
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "bookshelf";
   version = "12";
 
   src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-bookshelf/releases/download/v${version}/bookshelf_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-bookshelf/releases/download/v${finalAttrs.version}/bookshelf_${finalAttrs.version}.0.0.0.zip";
     sha256 = "sha256-P85SLXaJuFIv9AmAE6mPbxZDMBhqEt+88dZiPUKu2iQ=";
     stripRoot = false;
   };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
   installPhase = ''
     cp -r $src $out
   '';
-}
+})
diff --git a/packages/jellyfin/plugins/intro-skipper/default.nix b/packages/jellyfin/plugins/intro-skipper/default.nix
index 22801a7..56329da 100644
--- a/packages/jellyfin/plugins/intro-skipper/default.nix
+++ b/packages/jellyfin/plugins/intro-skipper/default.nix
@@ -1,16 +1,16 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-intro-skipper
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "intro-skipper";
   version = "10.10/v1.10.10.20";
 
   src =
     let
-      parts = pkgs.lib.strings.splitString "/" version;
+      parts = pkgs.lib.strings.splitString "/" finalAttrs.version;
       full = builtins.elemAt parts 1;
     in
     pkgs.fetchzip {
-      url = "https://github.com/intro-skipper/intro-skipper/releases/download/${version}/intro-skipper-${full}.zip";
+      url = "https://github.com/intro-skipper/intro-skipper/releases/download/${finalAttrs.version}/intro-skipper-${full}.zip";
       sha256 = "sha256-RlrZkE8108Uj5V90+jw2o5fXb+K+9/hoDcEaSkKLDGg=";
       stripRoot = false;
     };
@@ -18,4 +18,4 @@ pkgs.stdenv.mkDerivation rec {
   installPhase = ''
     cp -r $src $out
   '';
-}
+})
diff --git a/packages/jellyfin/plugins/opensubtitles/default.nix b/packages/jellyfin/plugins/opensubtitles/default.nix
index a22c7a4..8a349f0 100644
--- a/packages/jellyfin/plugins/opensubtitles/default.nix
+++ b/packages/jellyfin/plugins/opensubtitles/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-opensubtitles
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "opensubtitles";
   version = "20";
 
   src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-opensubtitles/releases/download/v${version}/open-subtitles_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-opensubtitles/releases/download/v${finalAttrs.version}/open-subtitles_${finalAttrs.version}.0.0.0.zip";
     sha256 = "sha256-U17wQn32GB4nh05ExYJhzRw4nDvYOCB4EJtDoaaUnjI=";
     stripRoot = false;
   };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
   installPhase = ''
     cp -r $src $out
   '';
-}
+})
diff --git a/packages/jellyfin/plugins/playbackreporting/default.nix b/packages/jellyfin/plugins/playbackreporting/default.nix
index 49e93bd..41ff600 100644
--- a/packages/jellyfin/plugins/playbackreporting/default.nix
+++ b/packages/jellyfin/plugins/playbackreporting/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-playbackreporting
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "playbackreporting";
   version = "16";
 
   src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-playbackreporting/releases/download/v${version}/playback-reporting_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-playbackreporting/releases/download/v${finalAttrs.version}/playback-reporting_${finalAttrs.version}.0.0.0.zip";
     sha256 = "sha256-UrWxS0CpeeW4nYNyRNxnK0jqiAqXwfLv3YfFokfVH0A=";
     stripRoot = false;
   };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
   installPhase = ''
     cp -r $src $out
   '';
-}
+})
diff --git a/packages/jellyfin/plugins/reports/default.nix b/packages/jellyfin/plugins/reports/default.nix
index b7c5c8a..8a39570 100644
--- a/packages/jellyfin/plugins/reports/default.nix
+++ b/packages/jellyfin/plugins/reports/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-reports
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "reports";
   version = "17";
 
   src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-reports/releases/download/v${version}/reports_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-reports/releases/download/v${finalAttrs.version}/reports_${finalAttrs.version}.0.0.0.zip";
     sha256 = "sha256-kN1UDhx5/1sw3PO5co2YkfbZNiDj56F2YAT8S/0EdZM=";
     stripRoot = false;
   };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
   installPhase = ''
     cp -r $src $out
   '';
-}
+})
diff --git a/packages/jellyfin/plugins/sso/default.nix b/packages/jellyfin/plugins/sso/default.nix
index 20aff3f..c3af67e 100644
--- a/packages/jellyfin/plugins/sso/default.nix
+++ b/packages/jellyfin/plugins/sso/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-sso
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "sso";
   version = "3.5.2.4";
 
   src = pkgs.fetchzip {
-    url = "https://github.com/9p4/jellyfin-plugin-sso/releases/download/v${version}/sso-authentication_${version}.zip";
+    url = "https://github.com/9p4/jellyfin-plugin-sso/releases/download/v${finalAttrs.version}/sso-authentication_${finalAttrs.version}.zip";
     sha256 = "sha256-e+w5m6/7vRAynStDj34eBexfCIEgDJ09huHzi5gQEbo=";
     stripRoot = false;
   };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
   installPhase = ''
     cp -r $src $out
   '';
-}
+})
diff --git a/packages/jellyfin/plugins/subtitleextract/default.nix b/packages/jellyfin/plugins/subtitleextract/default.nix
index 9b0b960..57c24d5 100644
--- a/packages/jellyfin/plugins/subtitleextract/default.nix
+++ b/packages/jellyfin/plugins/subtitleextract/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-subtitleextract
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "subtitleextract";
   version = "4";
 
   src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-subtitleextract/releases/download/v${version}/subtitle-extract_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-subtitleextract/releases/download/v${finalAttrs.version}/subtitle-extract_${finalAttrs.version}.0.0.0.zip";
     sha256 = "sha256-FstPWUYsZg416DNshIV4yOvbg6U21cRxKse8hITUyBY=";
     stripRoot = false;
   };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
   installPhase = ''
     cp -r $src $out
   '';
-}
+})
diff --git a/packages/jellyfin/plugins/tmdbboxsets/default.nix b/packages/jellyfin/plugins/tmdbboxsets/default.nix
index fd1cc2b..844a29b 100644
--- a/packages/jellyfin/plugins/tmdbboxsets/default.nix
+++ b/packages/jellyfin/plugins/tmdbboxsets/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-tmdbboxsets
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "tmdbboxsets";
   version = "11";
 
   src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-tmdbboxsets/releases/download/v${version}/tmdb-box-sets_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-tmdbboxsets/releases/download/v${finalAttrs.version}/tmdb-box-sets_${finalAttrs.version}.0.0.0.zip";
     sha256 = "sha256-cO3hpjFacS62kdXn8ebS7oMtFT9LJAt8Q4b36aSxwCQ=";
     stripRoot = false;
   };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
   installPhase = ''
     cp -r $src $out
   '';
-}
+})
diff --git a/packages/jellyfin/plugins/tvdb/default.nix b/packages/jellyfin/plugins/tvdb/default.nix
index 33cbf4f..0d5da74 100644
--- a/packages/jellyfin/plugins/tvdb/default.nix
+++ b/packages/jellyfin/plugins/tvdb/default.nix
@@ -1,11 +1,11 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake jellyfin-plugin-tvdb
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "tvdb";
   version = "19";
 
   src = pkgs.fetchzip {
-    url = "https://github.com/jellyfin/jellyfin-plugin-tvdb/releases/download/v${version}/thetvdb_${version}.0.0.0.zip";
+    url = "https://github.com/jellyfin/jellyfin-plugin-tvdb/releases/download/v${finalAttrs.version}/thetvdb_${finalAttrs.version}.0.0.0.zip";
     sha256 = "sha256-011wpVwQy562XDAwAQ44GJTbu/ESHcyo5F/wrtNBAcs=";
     stripRoot = false;
   };
@@ -13,4 +13,4 @@ pkgs.stdenv.mkDerivation rec {
   installPhase = ''
     cp -r $src $out
   '';
-}
+})
diff --git a/packages/linux-firmware-latest/default.nix b/packages/linux-firmware-latest/default.nix
index 973e973..3cb3451 100644
--- a/packages/linux-firmware-latest/default.nix
+++ b/packages/linux-firmware-latest/default.nix
@@ -1,12 +1,12 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=main linux-firmware-latest
-pkgs.stdenvNoCC.mkDerivation rec {
+pkgs.stdenvNoCC.mkDerivation {
   pname = "linux-firmware";
   version = "20250708-unstable-2025-07-08";
 
   src = pkgs.fetchFromGitLab {
     owner = "kernel-firmware";
-    repo = pname;
+    repo = "linux-firmware";
     rev = "99d64b4f788c16e81b6550ef94f43c6b91cfad2d";
     hash = "sha256-TJ97A9I0ipsqgg7ex3pAQgdhDJcLbkNCvuLppt9a07o=";
   };
diff --git a/packages/littlelink-server/default.nix b/packages/littlelink-server/default.nix
index 4a56335..faa7b1d 100644
--- a/packages/littlelink-server/default.nix
+++ b/packages/littlelink-server/default.nix
@@ -1,6 +1,6 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=main littlelink-server --subpackage yarnSrc
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "littlelink-server";
   version = "0-unstable-2025-07-16";
 
@@ -12,10 +12,10 @@ pkgs.stdenv.mkDerivation rec {
   };
 
   yarnSrc = pkgs.stdenv.mkDerivation {
-    inherit src pname version;
+    inherit (finalAttrs) src pname version;
 
     offlineCache = pkgs.fetchYarnDeps {
-      yarnLock = src + "/yarn.lock";
+      yarnLock = finalAttrs.src + "/yarn.lock";
       hash = "sha256-nv1NgMm56wWlAYqqdH9UKTnWNhjxWBs1lmG+UCCQAzk=";
     };
 
@@ -29,24 +29,24 @@ pkgs.stdenv.mkDerivation rec {
     yarnBuildFlags = [ "--noninteractive" ];
 
     installPhase = ''
-      mkdir -p $out/lib/${pname}
-      cp -r build node_modules $out/lib/${pname}
+      mkdir -p $out/lib/${finalAttrs.pname}
+      cp -r build node_modules $out/lib/${finalAttrs.pname}
     '';
   };
 
   wrapper = pkgs.writeShellApplication {
-    name = pname;
+    name = finalAttrs.pname;
     runtimeInputs = with pkgs; [ nodejs_20 ];
     text = ''
-      cd ${yarnSrc}/lib/${pname}
+      cd ${finalAttrs.yarnSrc}/lib/${finalAttrs.pname}
       exec node build/server.js "$@"
     '';
   };
 
   installPhase = ''
     mkdir -p $out/bin
-    cp ${wrapper}/bin/${pname} $out/bin/
+    cp ${finalAttrs.wrapper}/bin/${finalAttrs.pname} $out/bin/
   '';
 
-  meta.mainProgram = pname;
-}
+  meta.mainProgram = finalAttrs.pname;
+})
diff --git a/packages/obsidian/plugins/better-word-count/default.nix b/packages/obsidian/plugins/better-word-count/default.nix
index 31191a9..ad11749 100644
--- a/packages/obsidian/plugins/better-word-count/default.nix
+++ b/packages/obsidian/plugins/better-word-count/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-better-word-count
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
   pname = "better-word-count";
   version = "0.10.1";
 
   src = pkgs.fetchFromGitHub {
     owner = "lukeleppan";
-    repo = pname;
-    rev = version;
+    repo = "better-word-count";
+    rev = finalAttrs.version;
     hash = "sha256-+z31nYnCrHjuV4ICVO+cKBM5q/zYA7Ju+J+6eU7t9Bo=";
   };
 
@@ -23,4 +23,4 @@ pkgs.buildNpmPackage rec {
     cp ./dist/main.js $out/main.js
     cp ./src/styles.css $out/styles.css
   '';
-}
+})
diff --git a/packages/obsidian/plugins/dataview/default.nix b/packages/obsidian/plugins/dataview/default.nix
index 6f7a5aa..ee84de8 100644
--- a/packages/obsidian/plugins/dataview/default.nix
+++ b/packages/obsidian/plugins/dataview/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-dataview
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
   pname = "dataview";
   version = "0.5.70";
 
   src = pkgs.fetchFromGitHub {
     owner = "blacksmithgu";
     repo = "obsidian-dataview";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-qz2Un5r4bZyX0mZ7J7Yvd/gSWKn/GxUUrC7OF2jTL3c=";
   };
 
@@ -23,4 +23,4 @@ pkgs.buildNpmPackage rec {
     cp ./build/main.js $out/main.js
     cp ./styles.css $out/styles.css
   '';
-}
+})
diff --git a/packages/obsidian/plugins/excalidraw/default.nix b/packages/obsidian/plugins/excalidraw/default.nix
index a8f32b4..b75bce4 100644
--- a/packages/obsidian/plugins/excalidraw/default.nix
+++ b/packages/obsidian/plugins/excalidraw/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-excalidraw --subpackage mathjaxToSVG
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
   pname = "obsidian.plugins.excalidraw";
   version = "2.13.0";
 
   pkg = pkgs.fetchFromGitHub {
     owner = "zsviczian";
     repo = "obsidian-excalidraw-plugin";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-zZDKgVQDwa2Mb5DQtu5/QUQnMbBudQxhrVSNr8Xi44o=";
   };
 
@@ -15,7 +15,7 @@ pkgs.buildNpmPackage rec {
     pname = "obsidian.plugins.excalidraw.mathjaxToSVG";
     version = "1.0.0";
 
-    src = "${pkg}/MathjaxToSVG";
+    src = "${finalAttrs.pkg}/MathjaxToSVG";
     npmDepsHash = "sha256-AosKWlX08dpXNQ2YlrfR6jEInmU02Ztf26nmV19Jxok=";
 
     configurePhase = ''
@@ -28,7 +28,7 @@ pkgs.buildNpmPackage rec {
     '';
   };
 
-  src = pkg;
+  src = finalAttrs.pkg;
 
   npmDepsHash = "sha256-Cb8PTYW2fxYLlvCrDJhtV5KnOMkSTlBO8QJR4p6wyr8=";
   npmPackFlags = [ "--ignore-scripts" ];
@@ -36,7 +36,7 @@ pkgs.buildNpmPackage rec {
   configurePhase = ''
     mkdir dist
     mkdir -p ./MathjaxToSVG/dist
-    cp ${mathjaxToSVG}/index.js ./MathjaxToSVG/dist/index.js
+    cp ${finalAttrs.mathjaxToSVG}/index.js ./MathjaxToSVG/dist/index.js
   '';
 
   installPhase = ''
@@ -45,4 +45,4 @@ pkgs.buildNpmPackage rec {
     cp ./dist/main.js $out/main.js
     cp ./dist/styles.css $out/styles.css
   '';
-}
+})
diff --git a/packages/obsidian/plugins/kanban/default.nix b/packages/obsidian/plugins/kanban/default.nix
index 5e59b26..8e20522 100644
--- a/packages/obsidian/plugins/kanban/default.nix
+++ b/packages/obsidian/plugins/kanban/default.nix
@@ -1,18 +1,18 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-kanban
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "kanban";
   version = "2.0.51";
 
   src = pkgs.fetchFromGitHub {
     owner = "mgmeyers";
     repo = "obsidian-kanban";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-NahypggwPrub2KxRBAn54ZpEInP1V+6l/xmUKUt6myA=";
   };
 
   offlineCache = pkgs.fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
+    yarnLock = finalAttrs.src + "/yarn.lock";
     hash = "sha256-eof2W9Ja4RlmjQ0SnaF/jadHX3GRkCRrMwZU2z0M/Jk=";
   };
 
@@ -29,4 +29,4 @@ pkgs.stdenv.mkDerivation rec {
     cp ./main.js $out/main.js
     cp ./styles.css $out/styles.css
   '';
-}
+})
diff --git a/packages/obsidian/plugins/languagetool/default.nix b/packages/obsidian/plugins/languagetool/default.nix
index 0ba3c8e..fadb715 100644
--- a/packages/obsidian/plugins/languagetool/default.nix
+++ b/packages/obsidian/plugins/languagetool/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-languagetool
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "languagetool";
   version = "0.3.7";
 
   src = pkgs.fetchFromGitHub {
     owner = "Clemens-E";
     repo = "obsidian-languagetool-plugin";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-OsdOOrXNoraKuFPqvgn6pj6ZagEbiFCJyQ529eyZXUU=";
   };
 
@@ -17,7 +17,7 @@ pkgs.stdenv.mkDerivation rec {
   ];
 
   offlineCache = pkgs.fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
+    yarnLock = finalAttrs.src + "/yarn.lock";
     hash = "sha256-749RGQmg9Mte7TR6k3qP6xcb8+rj/C60LYLbF8j8gNc=";
   };
 
@@ -34,4 +34,4 @@ pkgs.stdenv.mkDerivation rec {
     cp ./main.js $out/main.js
     cp ./styles.css $out/styles.css
   '';
-}
+})
diff --git a/packages/obsidian/plugins/linter/default.nix b/packages/obsidian/plugins/linter/default.nix
index bb1b8bd..55b37a1 100644
--- a/packages/obsidian/plugins/linter/default.nix
+++ b/packages/obsidian/plugins/linter/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-linter
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
   pname = "linter";
   version = "1.29.2";
 
   src = pkgs.fetchFromGitHub {
     owner = "platers";
     repo = "obsidian-linter";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-I60nP99bdQfvq+GYtUvHPpYqp/nqpn3BqrgZzgPzRpI=";
   };
 
@@ -20,4 +20,4 @@ pkgs.buildNpmPackage rec {
     cp ./main.js $out/main.js
     cp ./src/styles.css $out/styles.css
   '';
-}
+})
diff --git a/packages/obsidian/plugins/map-view/default.nix b/packages/obsidian/plugins/map-view/default.nix
index 9728da1..c707b3c 100644
--- a/packages/obsidian/plugins/map-view/default.nix
+++ b/packages/obsidian/plugins/map-view/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-map-view
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
   pname = "map-view";
   version = "5.5.0";
 
   src = pkgs.fetchFromGitHub {
     owner = "esm7";
     repo = "obsidian-map-view";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-HiH6KPLnCNyidp6TI7HJK4aj5SL0B0xO6HOWUgjVdd4=";
   };
 
@@ -25,4 +25,4 @@ pkgs.buildNpmPackage rec {
     cp ./dist/main.js $out/main.js
     cp ./dist/styles.css $out/styles.css
   '';
-}
+})
diff --git a/packages/obsidian/plugins/minimal-settings/default.nix b/packages/obsidian/plugins/minimal-settings/default.nix
index 602e969..44b5837 100644
--- a/packages/obsidian/plugins/minimal-settings/default.nix
+++ b/packages/obsidian/plugins/minimal-settings/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-minimal-settings
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
   pname = "minimal-settings";
   version = "8.1.1";
 
   src = pkgs.fetchFromGitHub {
     owner = "kepano";
     repo = "obsidian-minimal-settings";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-JcWqSVgSRJAm0QiLnGuPpv0S9SVZw7UdtuKnvUAKiwQ=";
   };
 
@@ -22,4 +22,4 @@ pkgs.buildNpmPackage rec {
     cp ./main.js $out/main.js
     cp ./styles.css $out/styles.css
   '';
-}
+})
diff --git a/packages/obsidian/plugins/outliner/default.nix b/packages/obsidian/plugins/outliner/default.nix
index 5799570..e4b8e29 100644
--- a/packages/obsidian/plugins/outliner/default.nix
+++ b/packages/obsidian/plugins/outliner/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-outliner
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
   pname = "outliner";
   version = "4.9.0";
 
   src = pkgs.fetchFromGitHub {
     owner = "vslinko";
     repo = "obsidian-outliner";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-W8cEAuFwGZUJvJgZo9Yz5aJV7xfm5kFZ9bpvwSPWhmE=";
   };
 
@@ -20,4 +20,4 @@ pkgs.buildNpmPackage rec {
     cp ./main.js $out/main.js
     cp ./styles.css $out/styles.css
   '';
-}
+})
diff --git a/packages/obsidian/plugins/style-settings/default.nix b/packages/obsidian/plugins/style-settings/default.nix
index a6fa8b7..2800b79 100644
--- a/packages/obsidian/plugins/style-settings/default.nix
+++ b/packages/obsidian/plugins/style-settings/default.nix
@@ -1,24 +1,24 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-style-settings --src-attr unpatchedSrc
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "style-settings";
   version = "1.0.9";
 
   unpatchedSrc = pkgs.fetchFromGitHub {
     owner = "mgmeyers";
     repo = "obsidian-style-settings";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-eNbZQ/u3mufwVX+NRJpMSk5uGVkWfW0koXKq7wg9d+I=";
   };
 
   # Wrap in applyPatches so that offlineCache below is built correctly
   src = pkgs.applyPatches {
-    src = unpatchedSrc;
+    src = finalAttrs.unpatchedSrc;
     patches = [ ./package-lock.patch ];
   };
 
   offlineCache = pkgs.fetchYarnDeps {
-    yarnLock = "${src}/yarn.lock";
+    yarnLock = "${finalAttrs.src}/yarn.lock";
     hash = "sha256-tqX09XWI3ZL9bXVdjgsAEuvfCAjnyWj5uSWGFbNApds=";
   };
 
@@ -35,4 +35,4 @@ pkgs.stdenv.mkDerivation rec {
     cp ./main.js $out/main.js
     cp ./styles.css $out/styles.css
   '';
-}
+})
diff --git a/packages/obsidian/plugins/tasks/default.nix b/packages/obsidian/plugins/tasks/default.nix
index ff3d523..983bb8f 100644
--- a/packages/obsidian/plugins/tasks/default.nix
+++ b/packages/obsidian/plugins/tasks/default.nix
@@ -1,18 +1,18 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-tasks
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "tasks";
   version = "7.20.0";
 
   src = pkgs.fetchFromGitHub {
     owner = "obsidian-tasks-group";
     repo = "obsidian-tasks";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-K9/H2BgruB1O9KwW+xoiCsuXFfu6o4xZDCI40OEmh+o=";
   };
 
   offlineCache = pkgs.fetchYarnDeps {
-    yarnLock = src + "/yarn.lock";
+    yarnLock = finalAttrs.src + "/yarn.lock";
     hash = "sha256-ecPZvpMQkL2o0X4qx6h1jwQVZrtTC3+Aj7n/SBLRQbo=";
   };
 
@@ -29,4 +29,4 @@ pkgs.stdenv.mkDerivation rec {
     cp ./main.js $out/main.js
     cp ./styles.css $out/styles.css
   '';
-}
+})
diff --git a/packages/obsidian/plugins/url-into-selection/default.nix b/packages/obsidian/plugins/url-into-selection/default.nix
index 71a87d5..ebbebc3 100644
--- a/packages/obsidian/plugins/url-into-selection/default.nix
+++ b/packages/obsidian/plugins/url-into-selection/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-plugin-url-into-selection
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
   pname = "url-into-selection";
   version = "1.7.0";
 
   src = pkgs.fetchFromGitHub {
     owner = "denolehov";
     repo = "obsidian-url-into-selection";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-xmKJOuXirg/LFVK/0925fazW+cm+XUlLpAUgpAS6bZI=";
   };
 
@@ -21,4 +21,4 @@ pkgs.buildNpmPackage rec {
     cp ./manifest.json $out/manifest.json
     cp ./main.js $out/main.js
   '';
-}
+})
diff --git a/packages/obsidian/themes/minimal/default.nix b/packages/obsidian/themes/minimal/default.nix
index 7da7394..c5b86a8 100644
--- a/packages/obsidian/themes/minimal/default.nix
+++ b/packages/obsidian/themes/minimal/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake obsidian-theme-minimal
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
   pname = "minimal";
   version = "8.0.1";
 
   src = pkgs.fetchFromGitHub {
     owner = "kepano";
     repo = "obsidian-minimal";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-9FHkJ47R+cy2Pq62OuUUZQLSxd929xUIsQcpFGb4rso=";
   };
 
@@ -25,4 +25,4 @@ pkgs.buildNpmPackage rec {
     cp ./manifest.json $out/manifest.json
     cp ./theme.css $out/theme.css
   '';
-}
+})
diff --git a/packages/oidcwarden/default.nix b/packages/oidcwarden/default.nix
index c5ba8af..bb1e9d9 100644
--- a/packages/oidcwarden/default.nix
+++ b/packages/oidcwarden/default.nix
@@ -1,21 +1,21 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake oidcwarden
 # FIXME: https://github.com/dani-garcia/vaultwarden/pull/3899
-pkgs.rustPlatform.buildRustPackage rec {
+pkgs.rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oidcwarden";
   version = "2025.6.1-2";
 
   src = pkgs.fetchFromGitHub {
     owner = "Timshel";
     repo = "OIDCWarden";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-wpb+7/a8TEaLvOiMt/POLvl+rb6hHG99audNghSJvII=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-fMePvMnefdcN90Y3BPqcKNXyg7tUd64IOUnOQis/qTU=";
 
-  env.VW_VERSION = version;
+  env.VW_VERSION = finalAttrs.version;
 
   nativeBuildInputs = with pkgs; [ pkg-config ];
   buildInputs = with pkgs; [
@@ -31,4 +31,4 @@ pkgs.rustPlatform.buildRustPackage rec {
   };
 
   meta.mainProgram = "oidcwarden";
-}
+})
diff --git a/packages/prometheus-fail2ban-exporter/default.nix b/packages/prometheus-fail2ban-exporter/default.nix
index 7d661f3..67ad430 100644
--- a/packages/prometheus-fail2ban-exporter/default.nix
+++ b/packages/prometheus-fail2ban-exporter/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake prometheus-fail2ban-exporter
-pkgs.buildGoModule rec {
+pkgs.buildGoModule (finalAttrs: {
   pname = "prometheus-fail2ban-exporter";
   version = "0.10.3";
 
   src = pkgs.fetchFromGitLab {
     owner = "hctrdev";
     repo = "fail2ban-prometheus-exporter";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-CyYGY6SovnvgExB22G+LEKRDRzbDZWhWUjctJMkprYs=";
   };
 
@@ -18,8 +18,8 @@ pkgs.buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=${version}"
-    "-X main.commit=${version}"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.version}"
     "-X main.date=1970-01-01T00:00:00Z"
     "-X main.builtBy=NixOS"
   ];
@@ -28,4 +28,4 @@ pkgs.buildGoModule rec {
     mkdir -p $out/bin
     cp -r "$GOPATH/bin/fail2ban-prometheus-exporter" $out/bin/prometheus-fail2ban-exporter
   '';
-}
+})
diff --git a/packages/prometheus-podman-exporter/default.nix b/packages/prometheus-podman-exporter/default.nix
index 6eaec17..7e1461e 100644
--- a/packages/prometheus-podman-exporter/default.nix
+++ b/packages/prometheus-podman-exporter/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake prometheus-podman-exporter
-pkgs.buildGoModule rec {
+pkgs.buildGoModule (finalAttrs: {
   pname = "prometheus-podman-exporter";
   version = "1.17.2";
 
   src = pkgs.fetchFromGitHub {
     owner = "containers";
     repo = "prometheus-podman-exporter";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-TlQQbeYcCTZKF6DUKM+UE8iU9KC5tLpCtee62sNbW8s=";
   };
 
@@ -31,8 +31,8 @@ pkgs.buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/containers/prometheus-podman-exporter/cmd.buildVersion=${version}"
-    "-X github.com/containers/prometheus-podman-exporter/cmd.buildRevision=${builtins.head (pkgs.lib.strings.splitString "." version)}"
+    "-X github.com/containers/prometheus-podman-exporter/cmd.buildVersion=${finalAttrs.version}"
+    "-X github.com/containers/prometheus-podman-exporter/cmd.buildRevision=${builtins.head (pkgs.lib.strings.splitString "." finalAttrs.version)}"
     "-X github.com/containers/prometheus-podman-exporter/cmd.buildBranch=HEAD"
   ];
 
@@ -48,4 +48,4 @@ pkgs.buildGoModule rec {
     fi
       '
   '';
-}
+})
diff --git a/packages/sas/cacert/default.nix b/packages/sas/cacert/default.nix
index 8af52bf..52ef918 100644
--- a/packages/sas/cacert/default.nix
+++ b/packages/sas/cacert/default.nix
@@ -1,5 +1,5 @@
 { pkgs, ... }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
   pname = "sas-cacert";
   version = "0-unstable-2025-05-13";
 
diff --git a/packages/sas/viya4-orders-cli/default.nix b/packages/sas/viya4-orders-cli/default.nix
index bc12b73..e8393bd 100644
--- a/packages/sas/viya4-orders-cli/default.nix
+++ b/packages/sas/viya4-orders-cli/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake viya4-orders-cli
-pkgs.buildGoModule rec {
+pkgs.buildGoModule (finalAttrs: {
   pname = "viya4-orders-cli";
   version = "1.7.0";
 
   src = pkgs.fetchFromGitHub {
     owner = "sassoftware";
     repo = "viya4-orders-cli";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-0AZBKxQC3NDgwtdnso0zEd4h9PBexFzqig4tWoHJTFM=";
   };
 
@@ -18,11 +18,11 @@ pkgs.buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X github.com/sassoftware/viya4-orders-cli/cmd.version=${version}"
+    "-X github.com/sassoftware/viya4-orders-cli/cmd.version=${finalAttrs.version}"
   ];
 
   installPhase = ''
     mkdir -p $out/bin
     cp "$GOPATH/bin/viya4-orders-cli" $out/bin/viya4-orders-cli
   '';
-}
+})
diff --git a/packages/shlink-web-client/default.nix b/packages/shlink-web-client/default.nix
index 0d91275..631326c 100644
--- a/packages/shlink-web-client/default.nix
+++ b/packages/shlink-web-client/default.nix
@@ -1,13 +1,13 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake shlink-web-client
-pkgs.buildNpmPackage rec {
+pkgs.buildNpmPackage (finalAttrs: {
   pname = "shlink-web-client";
   version = "4.4.1";
 
   src = pkgs.fetchFromGitHub {
     owner = "shlinkio";
-    repo = pname;
-    rev = "v${version}";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
     hash = "sha256-qq683pLqbQ6kMAzc9QOrUdGh67joCy401h3OOr270qQ=";
   };
 
@@ -19,11 +19,11 @@ pkgs.buildNpmPackage rec {
 
   postPatch = ''
     tmpfile=$(mktemp)
-    ${pkgs.lib.meta.getExe pkgs.jq} '.homepage = "${homepage}"' package.json > "$tmpfile"
+    ${pkgs.lib.meta.getExe pkgs.jq} '.homepage = "${finalAttrs.homepage}"' package.json > "$tmpfile"
     mv "$tmpfile" package.json
   '';
 
   installPhase = ''
     cp -r build $out
   '';
-}
+})
diff --git a/packages/shlink/default.nix b/packages/shlink/default.nix
index fa798d9..108f5ee 100644
--- a/packages/shlink/default.nix
+++ b/packages/shlink/default.nix
@@ -1,15 +1,15 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake shlink
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation (finalAttrs: {
   pname = "shlink";
   version = "4.4.6";
 
   src = pkgs.fetchzip {
-    url = "https://github.com/shlinkio/shlink/releases/download/v${version}/shlink${version}_php8.4_dist.zip";
+    url = "https://github.com/shlinkio/shlink/releases/download/v${finalAttrs.version}/shlink${finalAttrs.version}_php8.4_dist.zip";
     sha256 = "sha256-fjGUQoIKAiB45jeCnbOjMnDOFIadWXdsdn/d8tRuJP8=";
   };
 
   installPhase = ''
     cp -r $src $out
   '';
-}
+})
diff --git a/packages/ssh/known-hosts/github/default.nix b/packages/ssh/known-hosts/github/default.nix
index 9a57f9b..1858151 100644
--- a/packages/ssh/known-hosts/github/default.nix
+++ b/packages/ssh/known-hosts/github/default.nix
@@ -4,7 +4,7 @@
   system,
   ...
 }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
   pname = "ssh-known-hosts-github";
   version = "0-unstable-2025-02-25";
 
diff --git a/packages/ssh/known-hosts/sas/artifact/default.nix b/packages/ssh/known-hosts/sas/artifact/default.nix
index cddc6dc..08b3dfe 100644
--- a/packages/ssh/known-hosts/sas/artifact/default.nix
+++ b/packages/ssh/known-hosts/sas/artifact/default.nix
@@ -4,7 +4,7 @@
   system,
   ...
 }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
   pname = "ssh-known-hosts-sas-artifact";
   version = "0-unstable-2025-03-14";
 
diff --git a/packages/ssh/known-hosts/sas/cldlgn/default.nix b/packages/ssh/known-hosts/sas/cldlgn/default.nix
index 5522c60..740112c 100644
--- a/packages/ssh/known-hosts/sas/cldlgn/default.nix
+++ b/packages/ssh/known-hosts/sas/cldlgn/default.nix
@@ -4,7 +4,7 @@
   system,
   ...
 }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
   pname = "ssh-known-hosts-sas-cldlgn";
   version = "0-unstable-2025-02-25";
 
diff --git a/packages/ssh/known-hosts/sas/gerrit/default.nix b/packages/ssh/known-hosts/sas/gerrit/default.nix
index e4dd33c..d1832f1 100644
--- a/packages/ssh/known-hosts/sas/gerrit/default.nix
+++ b/packages/ssh/known-hosts/sas/gerrit/default.nix
@@ -4,7 +4,7 @@
   system,
   ...
 }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
   pname = "ssh-known-hosts-sas-gerrit";
   version = "0-unstable-2025-02-25";
 
diff --git a/packages/ssh/known-hosts/sas/gitlab/default.nix b/packages/ssh/known-hosts/sas/gitlab/default.nix
index 98ae47b..ebd7f4e 100644
--- a/packages/ssh/known-hosts/sas/gitlab/default.nix
+++ b/packages/ssh/known-hosts/sas/gitlab/default.nix
@@ -4,7 +4,7 @@
   system,
   ...
 }:
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
   pname = "ssh-known-hosts-sas-gitlab";
   version = "0-unstable-2025-02-25";
 
diff --git a/packages/yazi/plugins/custom-shell/default.nix b/packages/yazi/plugins/custom-shell/default.nix
index 265d82c..cebfa8d 100644
--- a/packages/yazi/plugins/custom-shell/default.nix
+++ b/packages/yazi/plugins/custom-shell/default.nix
@@ -1,6 +1,6 @@
 { pkgs, ... }:
 # AUTO-UPDATE: nix-update --flake --version=branch=main yazi-plugin-custom-shell
-pkgs.stdenv.mkDerivation rec {
+pkgs.stdenv.mkDerivation {
   pname = "custom-shell";
   version = "0-unstable-2025-06-07";
 
diff --git a/patches.nix b/patches.nix
new file mode 100644
index 0000000..fc50ec2
--- /dev/null
+++ b/patches.nix
@@ -0,0 +1,10 @@
+{ patcher, ... }:
+{
+  home-manager.patches = [
+    (patcher.fetchpatch {
+      name = "ssh: make userKnownHostsFiles consistent with nixpkgs";
+      url = "https://github.com/nix-community/home-manager/compare/master...karaolidis:home-manager:consistent-ssh-known-hosts-files.diff";
+      hash = "sha256-5EHdNqezDVF1xOO8g+qQj40GuS8XR1Vgm4D5zlDQo4I=";
+    })
+  ];
+}
diff --git a/submodules/home-manager b/submodules/home-manager
deleted file mode 160000
index 444d7a1..0000000
--- a/submodules/home-manager
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 444d7a18b87260772c5293a10f998d3da67e5f44
diff --git a/submodules/nixpkgs b/submodules/nixpkgs
deleted file mode 160000
index 5b6fdd0..0000000
--- a/submodules/nixpkgs
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 5b6fdd0939385dff89d6cfc5d2e125a392f7a107
diff --git a/treefmt.nix b/treefmt.nix
index 56aa7cb..e9d57d6 100644
--- a/treefmt.nix
+++ b/treefmt.nix
@@ -16,8 +16,6 @@
   settings = {
     global = {
       excludes = [
-        # Third-party
-        "submodules/*"
         # Binary Files
         "*.jpg"
         "*.png"