diff --git a/flake.lock b/flake.lock
index 805689e5..bac6ea36 100644
--- a/flake.lock
+++ b/flake.lock
@@ -342,11 +342,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1697100850,
-        "narHash": "sha256-qSAzJVzNRIo+r3kBjL8TcpJctcgcHlnZyqdzpWgtg0M=",
+        "lastModified": 1698053470,
+        "narHash": "sha256-sP8D/41UiwC2qn0X40oi+DfuVzNHMROqIWdSdCI/AYA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "fb6af288f6cf0f00d3af60cf9d5110433b954565",
+        "rev": "80d98a7d55c6e27954a166cb583a41325e9512d7",
         "type": "github"
       },
       "original": {
@@ -420,11 +420,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1697226376,
-        "narHash": "sha256-cumLLb1QOUtWieUnLGqo+ylNt3+fU8Lcv5Zl+tYbRUE=",
+        "lastModified": 1697851979,
+        "narHash": "sha256-lJ8k4qkkwdvi+t/Xc6Fn74kUuobpu9ynPGxNZR6OwoA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "898cb2064b6e98b8c5499f37e81adbdf2925f7c5",
+        "rev": "5550a85a087c04ddcace7f892b0bdc9d8bb080c8",
         "type": "github"
       },
       "original": {
@@ -436,11 +436,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1697059129,
-        "narHash": "sha256-9NJcFF9CEYPvHJ5ckE8kvINvI84SZZ87PvqMbH6pro0=",
+        "lastModified": 1697723726,
+        "narHash": "sha256-SaTWPkI8a5xSHX/rrKzUe+/uVNy6zCGMXgoeMb7T9rg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5e4c2ada4fcd54b99d56d7bd62f384511a7e2593",
+        "rev": "7c9cc5a6e5d38010801741ac830a3f8fd667a7a0",
         "type": "github"
       },
       "original": {
@@ -546,11 +546,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1697544658,
-        "narHash": "sha256-WehJ7I1lis82yKZVEIzKxnmzbwQXh3+14HAWvIMofQQ=",
+        "lastModified": 1698112794,
+        "narHash": "sha256-q1RTQs68wugx13FobipERbvJX0YpfVVbsEISVL6Imic=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "564f727a32998fe4b2959843e86481a5fef523c9",
+        "rev": "08887f3641c0294d2f96d827e6236b6a3fd496ea",
         "type": "github"
       },
       "original": {
diff --git a/machines/shai-hulud/configuration.nix b/machines/shai-hulud/configuration.nix
index 9c9fb312..5e09f239 100644
--- a/machines/shai-hulud/configuration.nix
+++ b/machines/shai-hulud/configuration.nix
@@ -1,16 +1,18 @@
 inputs:
 { config, pkgs, lib, ... }:
 with lib; {
-  imports = [
-    ./hardware-configuration.nix
-    inputs.self.nixosModules.laptop
-    inputs.self.nixosModules.pc
-  ] ++ (with inputs.nixos-hardware.nixosModules; [
-    common-cpu-intel
-    common-pc-ssd
-    microsoft-surface-common
-    microsoft-surface-pro-intel
-  ]);
+  imports = [ ./hardware-configuration.nix ]
+    ++ (with inputs.nixos-hardware.nixosModules; [
+      common-cpu-intel
+      common-pc-ssd
+      microsoft-surface-common
+      microsoft-surface-pro-intel
+    ]) ++ [
+      inputs.self.nixosModules.laptop
+      inputs.self.nixosModules.pc
+
+      ./fs.nix
+    ];
 
   microsoft-surface.kernelVersion = "6.1.53";
 
diff --git a/machines/shai-hulud/fs.nix b/machines/shai-hulud/fs.nix
new file mode 100644
index 00000000..d321f0e9
--- /dev/null
+++ b/machines/shai-hulud/fs.nix
@@ -0,0 +1,23 @@
+{
+  fileSystems."/" = {
+    device = "tank/enc/root";
+    fsType = "zfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/4DC0-283F";
+    fsType = "vfat";
+  };
+
+  fileSystems."/home" = {
+    device = "tank/enc/home";
+    fsType = "zfs";
+  };
+
+  fileSystems."/nix" = {
+    device = "tank/nix";
+    fsType = "zfs";
+  };
+
+  swapDevices = [ ];
+}
diff --git a/machines/shai-hulud/hardware-configuration.nix b/machines/shai-hulud/hardware-configuration.nix
index 8c1f5b08..59fba0e5 100644
--- a/machines/shai-hulud/hardware-configuration.nix
+++ b/machines/shai-hulud/hardware-configuration.nix
@@ -12,28 +12,6 @@
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/b1bf3fde-687c-4c9b-b1f4-d660bd062deb";
-    fsType = "xfs";
-  };
-
-  fileSystems."/nix" = {
-    device = "/dev/disk/by-uuid/07b362e1-c917-40c9-8486-9a8a87857e60";
-    fsType = "xfs";
-  };
-
-  fileSystems."/home" = {
-    device = "/dev/disk/by-uuid/efd6ef1b-56b4-4b5c-bb6b-e263c1c988fa";
-    fsType = "xfs";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/4DC0-283F";
-    fsType = "vfat";
-  };
-
-  swapDevices = [ ];
-
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction