From 9674dbb5696d16e23558c95962a57e74bdbbb1a3 Mon Sep 17 00:00:00 2001
From: Astrid Yu <astrid@astrid.tech>
Date: Mon, 1 Jan 2024 11:07:10 -0800
Subject: [PATCH] Update nixpkgs-stable to 23.11

---
 .github/workflows/check-targets.yml     | 149 ++++++++++++++++++++----
 flake.lock                              |  27 +----
 flake.nix                               |   2 -
 nix/home-manager/astral/cli/default.nix |   2 +-
 nix/lib/github-actions.nix              |  10 +-
 nix/nixos-modules/astral/nix-utils.nix  |   4 +-
 nix/outputs.nix                         |  16 +--
 7 files changed, 150 insertions(+), 60 deletions(-)

diff --git a/.github/workflows/check-targets.yml b/.github/workflows/check-targets.yml
index db897783..9683112c 100644
--- a/.github/workflows/check-targets.yml
+++ b/.github/workflows/check-targets.yml
@@ -60,6 +60,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -69,7 +71,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'devShells.x86_64-darwin.default'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'devShells.x86_64-darwin.default'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -101,6 +104,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -110,7 +115,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'devShells.x86_64-linux.default'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'devShells.x86_64-linux.default'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -142,6 +148,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -151,7 +159,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'homeConfigurations.astrid@soulcaster.activationPackage'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'homeConfigurations.astrid@soulcaster.activationPackage'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -183,6 +192,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -192,7 +203,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'homeConfigurations.astrid@Discovery.activationPackage'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'homeConfigurations.astrid@Discovery.activationPackage'
           "$TARGET_FLAKE#"'homeConfigurations.astrid@aliaconda.activationPackage'
           "$TARGET_FLAKE#"'homeConfigurations.astrid@banana.activationPackage' "$TARGET_FLAKE#"'homeConfigurations.astrid@chungus.activationPackage'
           "$TARGET_FLAKE#"'homeConfigurations.astrid@shai-hulud.activationPackage'
@@ -229,6 +241,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -238,7 +252,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'packages.x86_64-linux.installer-iso'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'packages.x86_64-linux.installer-iso'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -270,6 +285,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -298,7 +315,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.__basePC.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.__basePC.config.system.build.toplevel'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -331,6 +349,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -340,7 +360,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.__baseServer.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.__baseServer.config.system.build.toplevel'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -373,6 +394,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -382,7 +405,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.amiya.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.amiya.config.system.build.toplevel'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -416,6 +440,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -444,7 +470,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.banana.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.banana.config.system.build.toplevel'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -477,6 +504,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -486,7 +515,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.bonney.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.bonney.config.system.build.toplevel'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -519,6 +549,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -547,7 +579,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.chungus.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.chungus.config.system.build.toplevel'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -580,6 +613,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -589,13 +624,15 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.diluc.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.diluc.config.system.build.toplevel'
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
           deploy_flake_attr: nixosConfigurations.diluc.config.astral.ci.deploy-package
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
         name: Deploy with nixosConfigurations.diluc.config.astral.ci.deploy-package
-        run: GC_DONT_GC=1 nix run --show-trace "$TARGET_FLAKE#$deploy_flake_attr"
+        run: GC_DONT_GC=1 nix run --accept-flake-config --show-trace --log-lines 10000
+          "$TARGET_FLAKE#$deploy_flake_attr"
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -628,6 +665,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -637,13 +676,15 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.durin.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.durin.config.system.build.toplevel'
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
           deploy_flake_attr: nixosConfigurations.durin.config.astral.ci.deploy-package
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
         name: Deploy with nixosConfigurations.durin.config.astral.ci.deploy-package
-        run: GC_DONT_GC=1 nix run --show-trace "$TARGET_FLAKE#$deploy_flake_attr"
+        run: GC_DONT_GC=1 nix run --accept-flake-config --show-trace --log-lines 10000
+          "$TARGET_FLAKE#$deploy_flake_attr"
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -676,6 +717,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -685,7 +728,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.gfdesk.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.gfdesk.config.system.build.toplevel'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -718,6 +762,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -727,7 +773,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.inferno.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.inferno.config.system.build.toplevel'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -762,6 +809,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -790,7 +839,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.shai-hulud.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.shai-hulud.config.system.build.toplevel'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -824,6 +874,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -852,7 +904,53 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.twinkpaw.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.twinkpaw.config.system.build.toplevel'
+      - if: ${{ always() }}
+        name: Log remaining space
+        run: 'echo "=== Space left after build ==="
+
+          df -h
+
+          '
+    strategy:
+      fail-fast: false
+  nixos-system-xn--vp9h:
+    name: NixOS sys. xn--vp9h
+    needs:
+      - nixos-system-__baseServer
+    runs-on: ubuntu-latest
+    steps:
+      - uses: webfactory/ssh-agent@v0.8.0
+        with:
+          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
+      - env:
+          KNOWN_HOSTS: ${{ env.KNOWN_HOSTS }}
+        name: Append to known_hosts
+        run: 'echo ''\n'' >> ~/.ssh/known_hosts
+
+          echo "$KNOWN_HOSTS" >> ~/.ssh/known_hosts
+
+          '
+      - uses: cachix/install-nix-action@v22
+        with:
+          extra_nix_config: 'experimental-features = nix-command flakes
+
+            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
+
+            allowUnfree = true
+
+            '
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v12
+        with:
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          name: astralbijection
+      - env:
+          TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
+        name: Build targets
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.xn--vp9h.config.system.build.toplevel'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -885,6 +983,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -894,13 +994,15 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.yato.config.system.build.toplevel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.yato.config.system.build.toplevel'
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
           deploy_flake_attr: nixosConfigurations.yato.config.astral.ci.deploy-package
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
         name: Deploy with nixosConfigurations.yato.config.astral.ci.deploy-package
-        run: GC_DONT_GC=1 nix run --show-trace "$TARGET_FLAKE#$deploy_flake_attr"
+        run: GC_DONT_GC=1 nix run --accept-flake-config --show-trace --log-lines 10000
+          "$TARGET_FLAKE#$deploy_flake_attr"
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
@@ -932,6 +1034,8 @@ jobs:
 
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
 
+            allowUnfree = true
+
             '
           nix_path: nixpkgs=channel:nixos-unstable
       - uses: cachix/cachix-action@v12
@@ -960,7 +1064,8 @@ jobs:
       - env:
           TARGET_FLAKE: ${{ env.TARGET_FLAKE }}
         name: Build targets
-        run: GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.shai-hulud.config.boot.kernelPackages.kernel'
+        run: GC_DONT_GC=1 nix build --accept-flake-config --show-trace --log-lines
+          10000 --fallback "$TARGET_FLAKE#"'nixosConfigurations.shai-hulud.config.boot.kernelPackages.kernel'
       - if: ${{ always() }}
         name: Log remaining space
         run: 'echo "=== Space left after build ==="
diff --git a/flake.lock b/flake.lock
index c0cec905..93183b08 100644
--- a/flake.lock
+++ b/flake.lock
@@ -286,21 +286,19 @@
       "inputs": {
         "nixpkgs": [
           "nixpkgs-unstable"
-        ],
-        "utils": "utils_2"
+        ]
       },
       "locked": {
-        "lastModified": 1671323335,
-        "narHash": "sha256-LRrLk7HJna1DIsTSz4+b/7t8Xw3NP+xkiBZ5z44mmzo=",
+        "lastModified": 1701153607,
+        "narHash": "sha256-h+odOVyiGmEERMECoFOj5P7FPiMR8IPRzroFA4sKivg=",
         "owner": "Mic92",
         "repo": "nix-ld",
-        "rev": "a6fd41e3934eb35f04f88826ee0118e391b4e31f",
+        "rev": "bf5aa84a713c31d95b4307e442e966d6c7fd7ae7",
         "type": "github"
       },
       "original": {
         "owner": "Mic92",
         "repo": "nix-ld",
-        "rev": "a6fd41e3934eb35f04f88826ee0118e391b4e31f",
         "type": "github"
       }
     },
@@ -681,21 +679,6 @@
       }
     },
     "utils_2": {
-      "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "utils_3": {
       "inputs": {
         "systems": "systems_2"
       },
@@ -719,7 +702,7 @@
         "flake-utils": "flake-utils_5",
         "nix": "nix",
         "nixpkgs": "nixpkgs_5",
-        "utils": "utils_3"
+        "utils": "utils_2"
       },
       "locked": {
         "lastModified": 1699433213,
diff --git a/flake.nix b/flake.nix
index b1a98f46..345d5fb5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -76,6 +76,4 @@
   };
 
   outputs = inputs: import ./nix/outputs.nix inputs;
-
-  nixConfig.allowUnfree = true;
 }
diff --git a/nix/home-manager/astral/cli/default.nix b/nix/home-manager/astral/cli/default.nix
index 9da1bbd8..429fca11 100644
--- a/nix/home-manager/astral/cli/default.nix
+++ b/nix/home-manager/astral/cli/default.nix
@@ -85,7 +85,7 @@ in with lib; {
         enable = true;
         initExtra = commonProfile;
         enableCompletion = true;
-        enableSyntaxHighlighting = true;
+        syntaxHighlighting.enable = true;
 
         autocd = true;
         defaultKeymap = "emacs";
diff --git a/nix/lib/github-actions.nix b/nix/lib/github-actions.nix
index ffdbe145..4c030cdf 100644
--- a/nix/lib/github-actions.nix
+++ b/nix/lib/github-actions.nix
@@ -1,5 +1,6 @@
 { lib }:
-with lib; rec {
+let nixFlags = "--accept-flake-config --show-trace --log-lines 10000";
+in with lib; rec {
   ghexpr = v: "\${{ ${v} }}";
 
   makeGithubWorkflow = { nodes, cachix, cronSchedule, known_hosts }: {
@@ -133,6 +134,7 @@ with lib; rec {
               extra_nix_config = ''
                 experimental-features = nix-command flakes
                 access-tokens = github.com=${ghexpr "secrets.GITHUB_TOKEN"}
+                allowUnfree = true
               '';
             };
           }
@@ -152,14 +154,14 @@ with lib; rec {
             installables =
               map (attr: ''"$TARGET_FLAKE#"'' + escapeShellArg attr) buildList;
             args = concatStringsSep " " installables;
-          in "GC_DONT_GC=1 nix build --show-trace --log-lines 10000 --fallback ${args}";
+          in "GC_DONT_GC=1 nix build ${nixFlags} --fallback ${args}";
           env.TARGET_FLAKE = ghexpr "env.TARGET_FLAKE";
         };
 
         runStep = {
           name = "Run ${run}";
           run = ''
-            GC_DONT_GC=1 nix run --show-trace "$TARGET_FLAKE#$run_flake_attr"'';
+            GC_DONT_GC=1 nix run ${nixFlags} "$TARGET_FLAKE#$run_flake_attr"'';
           env = {
             run_flake_attr = run;
             TARGET_FLAKE = ghexpr "env.TARGET_FLAKE";
@@ -169,7 +171,7 @@ with lib; rec {
         deployStep = {
           name = "Deploy with ${deploy}";
           run = ''
-            GC_DONT_GC=1 nix run --show-trace "$TARGET_FLAKE#$deploy_flake_attr"'';
+            GC_DONT_GC=1 nix run ${nixFlags} "$TARGET_FLAKE#$deploy_flake_attr"'';
           "if" = ghexpr
             "github.event_name == 'push' && github.ref == 'refs/heads/main'";
           env = {
diff --git a/nix/nixos-modules/astral/nix-utils.nix b/nix/nixos-modules/astral/nix-utils.nix
index 83bbf5ba..6c173879 100644
--- a/nix/nixos-modules/astral/nix-utils.nix
+++ b/nix/nixos-modules/astral/nix-utils.nix
@@ -15,6 +15,8 @@
     };
 
     package = pkgs.nixUnstable;
-    extraOptions = "experimental-features = nix-command flakes";
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
   };
 }
diff --git a/nix/outputs.nix b/nix/outputs.nix
index f15ec47a..784010b6 100644
--- a/nix/outputs.nix
+++ b/nix/outputs.nix
@@ -47,37 +47,37 @@ in {
 
   homeConfigurations = {
     default = home-manager.lib.homeManagerConfiguration {
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      pkgs = import nixpkgs { system = "x86_64-linux"; };
       modules = [ self.homeModules.astral-cli ];
     };
 
     m1 = home-manager.lib.homeManagerConfiguration {
-      pkgs = nixpkgs.legacyPackages.aarch64-darwin;
+      pkgs = import nixpkgs { system = "aarch64-darwin"; };
       modules = [ self.homeModules.astral-cli-full ];
     };
 
     "astrid@aliaconda" = home-manager.lib.homeManagerConfiguration {
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      pkgs = import nixpkgs { system = "x86_64-linux"; };
       modules = [ self.homeModules.astral-scientific vscode-server-home ];
     };
     "astrid@banana" = home-manager.lib.homeManagerConfiguration {
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      pkgs = import nixpkgs { system = "x86_64-linux"; };
       modules = [ self.homeModules.astral-gui ];
     };
     "astrid@chungus" = home-manager.lib.homeManagerConfiguration {
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      pkgs = import nixpkgs { system = "x86_64-linux"; };
       modules = [ self.homeModules.astral-gui ];
     };
     "astrid@Discovery" = home-manager.lib.homeManagerConfiguration {
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      pkgs = import nixpkgs { system = "x86_64-linux"; };
       modules = [ self.homeModules.astral-gui vscode-server-home ];
     };
     "astrid@shai-hulud" = home-manager.lib.homeManagerConfiguration {
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      pkgs = import nixpkgs { system = "x86_64-linux"; };
       modules = [ self.homeModules.astral-gui-tablet ];
     };
     "astrid@soulcaster" = home-manager.lib.homeManagerConfiguration {
-      pkgs = nixpkgs.legacyPackages.x86_64-darwin;
+      pkgs = import nixpkgs { system = "x86_64-darwin"; };
       modules = [ self.homeModules.astral-macos ];
     };
   };