diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 246b4ac..0a51837 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -28,24 +28,3 @@ jobs:
       - name: Deploy fermi
         run: >
           nix run 'github:serokell/deploy-rs' '.#fermi'
-
-  iso:
-    name: Create nixos isos
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        arch: [x86_64]
-        variant:
-          - minimal
-          - graphical
-    steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - name: Generate ISO file
-        run:
-          nix run 'nixpkgs#just' iso "${{ matrix.variant }}" "${{ matrix.arch }}"
-      - uses: actions/upload-artifact@v4
-        with:
-          name: nixos-aftix-${{ matrix.variant }}-${{ matrix.arch }}-linux.iso
-          path: result/iso/*.iso
diff --git a/flake.lock b/flake.lock
index d141d5f..4dc2a78 100644
--- a/flake.lock
+++ b/flake.lock
@@ -121,11 +121,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1711973905,
-        "narHash": "sha256-UFKME/N1pbUtn+2Aqnk+agUt8CekbpuqwzljivfIme8=",
+        "lastModified": 1715699772,
+        "narHash": "sha256-sKhqIgucN5sI/7UQgBwsonzR4fONjfMr9OcHK/vPits=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "88b3059b020da69cbe16526b8d639bd5e0b51c8b",
+        "rev": "b3ea6f333f9057b77efd9091119ba67089399ced",
         "type": "github"
       },
       "original": {
@@ -141,11 +141,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1715526530,
-        "narHash": "sha256-1ot3VxxbRexDAbk70n0yLt7EEEzypAGK3ut+YV7m/Mg=",
+        "lastModified": 1715822638,
+        "narHash": "sha256-Z4ZoyK8jYRmBZwMaEZLEmAilrfdpekwwwohliqC14/E=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "94a818d8b914e06c04c21b5f0bafbb4b96ee8b47",
+        "rev": "476eef8d85aa09389ae7baf6e6b60357f6a01432",
         "type": "github"
       },
       "original": {
@@ -372,6 +372,7 @@
       "original": {
         "owner": "hyprwm",
         "repo": "hyprland-plugins",
+        "rev": "dcbdc9a08d1df753d6799bab823486f1fff5b8e6",
         "type": "github"
       }
     },
@@ -519,11 +520,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1715447595,
-        "narHash": "sha256-VsVAUQOj/cS1LCOmMjAGeRksXIAdPnFIjCQ0XLkCsT0=",
+        "lastModified": 1715787315,
+        "narHash": "sha256-cYApT0NXJfqBkKcci7D9Kr4CBYZKOQKDYA23q8XNuWg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "062ca2a9370a27a35c524dc82d540e6e9824b652",
+        "rev": "33d1e753c82ffc557b4a585c77de43d4c922ebb5",
         "type": "github"
       },
       "original": {
@@ -551,11 +552,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1715532293,
-        "narHash": "sha256-jYeT0x7bC3eQ7THIUhYCyUJdK7eSpRWN4qepqCEnBaY=",
+        "lastModified": 1715866584,
+        "narHash": "sha256-laNSMD4ZgnXTnYKAs9C5IQNt+CGwUZhhlvog+61mC6E=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "fb67bbce53412fe1f1af6aad3a33c2bed4de0806",
+        "rev": "821d6aa90394fdc84550a3be55f3920a71ebb834",
         "type": "github"
       },
       "original": {
@@ -607,11 +608,11 @@
     },
     "stablepkgs": {
       "locked": {
-        "lastModified": 1715395895,
-        "narHash": "sha256-DreMqi6+qa21ffLQqhMQL2XRUkAGt3N7iVB5FhJKie4=",
+        "lastModified": 1715668745,
+        "narHash": "sha256-xp62OkRkbUDNUc6VSqH02jB0FbOS+MsfMb7wL1RJOfA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "71bae31b7dbc335528ca7e96f479ec93462323ff",
+        "rev": "9ddcaffecdf098822d944d4147dd8da30b4e6843",
         "type": "github"
       },
       "original": {
@@ -720,11 +721,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1715316640,
-        "narHash": "sha256-PIVfZJ9L/tVZjo7HoVtnba2ol7VPMXLxO8oVMKPLYHE=",
+        "lastModified": 1715672231,
+        "narHash": "sha256-i+PETwG/8ra7wer6yqwCxg5+yK24/HW8ddu/EwzLMnc=",
         "owner": "Alexays",
         "repo": "Waybar",
-        "rev": "cb2d54a23797c2a04a1e50bd35e810ea9b1eb74a",
+        "rev": "912d0e83f36bce702fdef848a74247093b9f33e7",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index ea07633..0841277 100644
--- a/flake.nix
+++ b/flake.nix
@@ -38,7 +38,7 @@
 
     hyprland.url = "github:hyprwm/Hyprland/v0.40.0?submodules=1";
     hyprland-plugins = {
-      url = "github:hyprwm/hyprland-plugins";
+      url = "github:hyprwm/hyprland-plugins/dcbdc9a08d1df753d6799bab823486f1fff5b8e6";
       inputs.hyprland.follows = "hyprland";
     };
 
@@ -60,18 +60,20 @@
   } @ inputs: let
     system = "x86_64-linux";
 
-    overlay = _: prev: {
+    overlay = final: prev: {
       coreutils-full = prev.uutils-coreutils-noprefix;
 
-      stty = prev.writeScriptBin "stty" (let
-        pkg =
+      stty = prev.writeShellApplication {
+        name = "stty";
+        runtimeInputs =
           if prev.lib.strings.hasSuffix "-linux" prev.system
-          then prev.busybox
-          else prev.coreutils;
-      in ''
-        #!${prev.stdenv.shell}
-        ${pkg}/bin/stty $@
-      '');
+          then [final.busybox]
+          else [prev.coreutils];
+
+        text = ''
+          stty "$@"
+        '';
+      };
     };
 
     pkgsCfg = {
diff --git a/hardware/hamilton.nix b/hardware/hamilton.nix
index cfd2e67..234a7a8 100644
--- a/hardware/hamilton.nix
+++ b/hardware/hamilton.nix
@@ -16,7 +16,7 @@
       availableKernelModules = ["nvme" "xhci_pci" "ahci" "usbhid" "sd_mod"];
       kernelModules = [];
     };
-    kernelModules = ["kvm-amd"];
+    kernelModules = ["kvm_amd"];
     extraModulePackages = [];
   };
 
diff --git a/home/aftix.nix b/home/aftix.nix
index 3511e0c..af91c07 100644
--- a/home/aftix.nix
+++ b/home/aftix.nix
@@ -36,7 +36,7 @@ in {
   ];
 
   nixpkgs.overlays = [
-    (_: prev: let
+    (final: _: let
       hostTemplate = escapeShellArg (builtins.toJSON {
         "github.com" = {
           users.aftix.oauth_token = "PLACEHOLDER";
@@ -50,13 +50,16 @@ in {
 
       cfg = escapeShellArg configHome;
     in {
-      link-gh-hosts = prev.writeScriptBin "link-gh-hosts" ''
-        #!${prev.stdenv.shell}
-        [[ -f ${secretPath} ]] || exit 1
-        TOKEN="$(cat ${secretPath})"
-        echo ${hostTemplate} > ${cfg}/gh/hosts.yml
-        ${pkgs.gnused}/bin/sed -i"" -e "s/PLACEHOLDER/$TOKEN/g" ${cfg}/gh/hosts.yml
-      '';
+      link-gh-hosts = final.writeShellApplication {
+        name = "link-gh-hosts";
+        runtimeInputs = with final; [gnused];
+        text = ''
+          [[ -f ${secretPath} ]] || exit 1
+          TOKEN="$(cat ${secretPath})"
+          echo ${hostTemplate} > ${cfg}/gh/hosts.yml
+          sed -i"" -e "s/PLACEHOLDER/$TOKEN/g" ${cfg}/gh/hosts.yml
+        '';
+      };
     })
   ];
 
diff --git a/home/common/gnupg.nix b/home/common/gnupg.nix
index 33722e8..d0a33a6 100644
--- a/home/common/gnupg.nix
+++ b/home/common/gnupg.nix
@@ -8,25 +8,28 @@
   inherit (config.xdg) dataHome;
 in {
   nixpkgs.overlays = [
-    (_: prev: {
-      pinentry-custom = prev.writeScriptBin "pinentry-custom" ''
-        #!${prev.stdenv.shell}
-        if [ -z "$PINENTRY_USER_DATA" ] ; then
-          exec pinentry-curses "$@"
-          exit 0
-        fi
+    (final: _: {
+      pinentry-custom = final.writeShellApplication {
+        name = "pinentry-custom";
+        runtimeInputs = with final; [pinentry-qt];
+        text = ''
+          if [ -z "$PINENTRY_USER_DATA" ] ; then
+            exec pinentry-curses "$@"
+            exit 0
+          fi
 
-        case $PINENTRY_USER_DATA in
-        qt)
-          exec ${prev.pinentry-qt}/bin/pinentry-qt "$@"
-          ;;
-        none)
-          exit 1
-          ;;
-        *)
-          exec ${prev.pinentry-qt}/bin/pinentry-curses "$@"
-        esac
-      '';
+          case $PINENTRY_USER_DATA in
+          qt)
+            exec pinentry-qt "$@"
+            ;;
+          none)
+            exit 1
+            ;;
+          *)
+            exec pinentry-curses "$@"
+          esac
+        '';
+      };
     })
   ];
 
diff --git a/home/opt/aria2.nix b/home/opt/aria2.nix
index 0a62c5f..aec71c2 100644
--- a/home/opt/aria2.nix
+++ b/home/opt/aria2.nix
@@ -4,17 +4,21 @@
   ...
 }: {
   nixpkgs.overlays = [
-    (_: prev: {
-      aria2d = prev.writeScriptBin "aria2d" (let
-        rpcDir = "${config.xdg.configHome}/aria2";
-        rpcFile = "${rpcDir}/aria2d.env";
-      in ''
-        #!${prev.stdenv.shell}
-        mkdir -p "${rpcDir}"
-        dd if=/dev/urandom of=/dev/stdout bs=64 count=1 2>/dev/null | base64 | tr -d '\n=*' | xargs printf "ARIA2_RPC_TOKEN=%s" > "${rpcFile}"
-        source "${rpcFile}"
-        ${prev.aria2}/bin/aria2c --conf-path="${rpcDir}/aria2d.conf" --rpc-secret="$ARIA2_RPC_TOKEN"
-      '');
+    (final: _: {
+      aria2d = final.writeShellApplication {
+        name = "aria2d";
+        runtimeInputs = with final; [aria2];
+        text = let
+          rpcDir = "${config.xdg.configHome}/aria2";
+          rpcFile = "${rpcDir}/aria2d.env";
+        in ''
+          mkdir -p "${rpcDir}"
+          dd if=/dev/urandom of=/dev/stdout bs=64 count=1 2>/dev/null | base64 | tr -d '\n=*' | xargs printf "ARIA2_RPC_TOKEN=%s" > "${rpcFile}"
+          # shellcheck source=/dev/null
+          source "${rpcFile}"
+          aria2c --conf-path="${rpcDir}/aria2d.conf" --rpc-secret="$ARIA2_RPC_TOKEN"
+        '';
+      };
     })
   ];
   home.packages = with pkgs; [aria2 aria2d python312Packages.aria2p];
diff --git a/home/opt/email.nix b/home/opt/email.nix
index f257301..f7524ae 100644
--- a/home/opt/email.nix
+++ b/home/opt/email.nix
@@ -14,22 +14,24 @@
   inherit (lib.strings) concatMapStringsSep;
 in {
   nixpkgs.overlays = [
-    (_: prev: {
-      mutt-purgecache = prev.writeScriptBin "mutt-purgecache" ''
-        #!${prev.stdenv.shell}
-        CACHE_LIMIT=512000 #KiB
-
-        cd "$1" 2>/dev/null
-        [ $? -ne 0 ] && exit
-
-        [ $(du -s . | cut -f1 -d$'\t') -lt $CACHE_LIMIT ] && exit
-        while IFS= read -r i; do
-          rm "$i"
-          [ $(du -s . | cut -f1 -d$'\t') -lt $CACHE_LIMIT ] && exit
-        done <<EOF
-        $(find . -type f -exec ls -rt1 {} +)
-        EOF
-      '';
+    (final: _: {
+      mutt-purgecache = final.writeShellApplication {
+        name = "mutt-purgecache";
+        runtimeInputs = with final; [findutils];
+        text = ''
+          CACHE_LIMIT=512000 #KiB
+
+          cd "$1" 2>/dev/null || exit
+
+          [ "$(du -s . | cut -f1 -d$'\t')" -lt $CACHE_LIMIT ] && exit
+          while IFS= read -r i; do
+            rm "$i"
+            [ "$(du -s . | cut -f1 -d$'\t')" -lt $CACHE_LIMIT ] && exit
+          done <<EOF
+          $(find . -type f -exec ls -rt1 {} +)
+          EOF
+        '';
+      };
     })
   ];
 
diff --git a/home/opt/hypr.nix b/home/opt/hypr.nix
index e444dce..edddaa2 100644
--- a/home/opt/hypr.nix
+++ b/home/opt/hypr.nix
@@ -46,23 +46,28 @@ in {
 
   config = {
     nixpkgs.overlays = [
-      (_: prev: {
-        screenshot = prev.writeScriptBin "screenshot" ''
-          #!${prev.bash}/bin/bash
-          export PATH="${prev.wl-clipboard}/bin:${prev.grim}/bin:${prev.slurp}/bin:$PATH"
-          export PATH="${prev.libnotify}/bin:${prev.tofi}/bin:${prev.systemd}/bin:${prev.satty}/bin:$PATH"
-          shopt -s globstar nullglob
-          source <(systemctl --user show-environment | grep -v PATH=)
-
-          grim -g "$(slurp -o -r -c '#ff0000ff')" - | \
-          satty --filename - --fullscreen --output-filename ~/media/screenshots/satty-$(date '+%Y%m%d-%H:%M:%S').png \
-          --early-exit --initial-tool crop --copy-command wl-copy
-        '';
+      (final: _: {
+        screenshot = final.writeShellApplication {
+          name = "screenshot";
+          runtimeInputs = with final; [wl-clipboard grim slurp libnotify tofi systemd satty];
+          text = ''
+            shopt -s globstar nullglob
+            # shellcheck source=/dev/null
+            source <(systemctl --user show-environment | grep -v PATH=)
+
+            grim -g "$(slurp -o -r -c '#ff0000ff')" - | \
+            satty --filename - --fullscreen --output-filename ~/media/screenshots/satty-"$(date '+%Y%m%d-%H:%M:%S')".png \
+            --early-exit --initial-tool crop --copy-command wl-copy
+          '';
+        };
 
-        zenith-popup = prev.writeScriptBin "zenith-popup" ''
-          #!${prev.stdenv.shell}
-          [ -n "$1" ] && "$1" -e ${escapeShellArg prev.zenith}/bin/zenith
-        '';
+        zenith-popup = final.writeShellApplication {
+          name = "zenith-popup";
+          runtimeInputs = with final; [zenith];
+          text = ''
+            [ -n "$1" ] && "$1" -e ${escapeShellArg final.zenith}/bin/zenith
+          '';
+        };
       })
     ];
 
diff --git a/home/opt/transmission.nix b/home/opt/transmission.nix
index a2e57bf..6af1e88 100644
--- a/home/opt/transmission.nix
+++ b/home/opt/transmission.nix
@@ -5,25 +5,27 @@
   ...
 }: {
   nixpkgs.overlays = [
-    (_: prev: {
-      transmission-notify = prev.writeScriptBin "transmission-notify" ''
-        #!${prev.stdenv.shell}
-        export PATH="${prev.systemd}/bin:$PATH"
-        export PATH="${prev.libnotify}/bin:${prev.gawk}/bin:${prev.transmission_4}/bin:$PATH"
-        source <(systemctl --user show-environment | grep -v PATH)
-        export DBUS_SESSION_BUS_ADDRESS DISPLAY WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
+    (final: _: {
+      transmission-notify = final.writeShellApplication {
+        name = "transmission-notify";
+        runtimeInputs = with final; [systemd libnotify gawk transmission_4];
+        text = ''
+          # shellcheck source=/dev/null
+          source <(systemctl --user show-environment | grep -v PATH)
+          export DBUS_SESSION_BUS_ADDRESS DISPLAY WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
 
-        PERCENTAGE="$( \
-          transmission-remote 127.0.0.1:9091 -t "$TR_TORRENT_ID" -l | \
-          awk -v ID="$TR_TORRENT_ID" '$1 == ID {print $2}' 2>&1 \
-        )"
+          PERCENTAGE="$( \
+            transmission-remote 127.0.0.1:9091 -t "$TR_TORRENT_ID" -l | \
+            awk -v ID="$TR_TORRENT_ID" '$1 == ID {print $2}' 2>&1 \
+          )"
 
-        if [ "$PERCENTAGE" != "100%" ]; then
-          notify-send --app-name "Transmission" --urgency normal "Torrent Added" "Torrent for \"$TR_TORRENT_NAME\" added to transmission"
-        else
-          notify-send --app-name "Transmission" --urgency normal "Torrent Completed" "Torrent for \"$TR_TORRENT_NAME\" completed"
-        fi
-      '';
+          if [ "$PERCENTAGE" != "100%" ]; then
+            notify-send --app-name "Transmission" --urgency normal "Torrent Added" "Torrent for \"$TR_TORRENT_NAME\" added to transmission"
+          else
+            notify-send --app-name "Transmission" --urgency normal "Torrent Completed" "Torrent for \"$TR_TORRENT_NAME\" completed"
+          fi
+        '';
+      };
     })
   ];
 
diff --git a/home/opt/waybar.nix b/home/opt/waybar.nix
index f3f6f8c..b516644 100644
--- a/home/opt/waybar.nix
+++ b/home/opt/waybar.nix
@@ -1,55 +1,72 @@
 {pkgs, ...}: let
-  waybar-dunst = pkgs.writeScriptBin "waybar-dunst" ''
-    #!${pkgs.stdenv.shell}
-    COUNT="$(dunstctl count waiting)"
-    ENABLED=""
-    DISABLED=""
-    if [ "$COUNT" != 0 ]; then
-      DISABLED=" $COUNT"
-    fi
-
-    if dunstctl is-paused | grep -q "false" ; then
-      echo '{"class": "", "text": " '"$ENABLED"' "}'
-    else
-      echo '{"class": "disabled", "text": " '"$DISABLED"' "}'
-    fi
-  '';
-  waybar-nordvpn = pkgs.writeScriptBin "waybar-nordvpn" ''
-    #!${pkgs.stdenv.shell}
-    if [ -d /proc/sys/net/ipv4/conf/nordlynx ]; then
-     echo '{"text": " 󰖂  ", "class": ""}'
-    else
-     echo '{"text": " 󰖂  ", "class": "disconnected"}'
-    fi
-  '';
-  waybar-backup = pkgs.writeScriptBin "waybar-backup" ''
-    #!${pkgs.stdenv.shell}
-    function active() {
-      echo '{"text": "Backing up disk"}'
-    }
-
-    function offline() {
-      echo '{}'
-    }
-
-    function wait() {
-      inotifywait -m "$1" --include "$2" -e create -e delete 2>/dev/null
-    }
-
-    [ -f /var/run/backupdisk.pid ] && active || offline
-    wait /var/run "backupdisk\\.pid" | while read -r line ; do
-      grep -Fq '/var/run DELETE backupdisk.pid' <<< "$line" && offline
-      grep -Fq '/var/run CREATE backupdisk.pid' <<< "$line" && active
-    done
-
-  '';
+  waybar-dunst = final:
+    final.writeShellApplication {
+      name = "waybar-dunst";
+      runtimeInputs = with final; [dunst gnugrep];
+      text = ''
+        COUNT="$(dunstctl count waiting)"
+        ENABLED=""
+        DISABLED=""
+        if [ "$COUNT" != 0 ]; then
+          DISABLED=" $COUNT"
+        fi
+
+        if dunstctl is-paused | grep -q "false" ; then
+          echo '{"class": "", "text": " '"$ENABLED"' "}'
+        else
+          echo '{"class": "disabled", "text": " '"$DISABLED"' "}'
+        fi
+      '';
+    };
+  waybar-nordvpn = final:
+    final.writeShellApplication {
+      name = "waybar-nordvpn";
+      text = ''
+        if [ -d /proc/sys/net/ipv4/conf/nordlynx ]; then
+         echo '{"text": " 󰖂  ", "class": ""}'
+        else
+         echo '{"text": " 󰖂  ", "class": "disconnected"}'
+        fi
+      '';
+    };
+  waybar-backup = final:
+    final.writeShellApplication {
+      name = "waybar-backup";
+      runtimeInputs = with final; [inotify-tools gnugrep];
+      text = ''
+        function active() {
+          echo '{"text": "Backing up disk"}'
+        }
+
+        function offline() {
+          echo '{}'
+        }
+
+        function wait() {
+          inotifywait -m "$1" --include "$2" -e create -e delete 2>/dev/null
+        }
+
+        if [ -f /var/run/backupdisk.pid ]; then
+          active
+        else
+          offline
+        fi
+
+        wait /var/run "backupdisk\\.pid" | while read -r line ; do
+          grep -Fq '/var/run DELETE backupdisk.pid' <<< "$line" && offline
+          grep -Fq '/var/run CREATE backupdisk.pid' <<< "$line" && active
+        done
+      '';
+    };
 in {
   nixpkgs.overlays = [
-    (_: _: {
-      inherit waybar-dunst waybar-nordvpn waybar-backup;
+    (final: _: {
+      waybar-dunst = waybar-dunst final;
+      waybar-nordvpn = waybar-nordvpn final;
+      waybar-backup = waybar-backup final;
     })
   ];
-  home.packages = with pkgs; [waybar waybar-dunst waybar-nordvpn waybar-backup];
+  home.packages = with pkgs; [waybar pkgs.waybar-dunst pkgs.waybar-nordvpn pkgs.waybar-backup];
 
   programs.waybar = {
     enable = true;
diff --git a/host/common/sleep.nix b/host/common/sleep.nix
index 2047c34..b0c1827 100644
--- a/host/common/sleep.nix
+++ b/host/common/sleep.nix
@@ -1,19 +1,25 @@
 {pkgs, ...}: {
   nixpkgs.overlays = [
-    (_: prev: {
-      check-prevent-sleep = prev.writeScriptBin "check-prevent-sleep" ''
-        #!${prev.stdenv.shell}
-        mkdir -p /var/run/prevent-sleep.d
-        chmod 0777 /var/run/prevent-sleep.d
-        COUNT="$(find /var/run/prevent-sleep.d/ -type f | wc -l)"
-        [ "$COUNT" = "0" ] || exit 1
-      '';
+    (final: _: {
+      check-prevent-sleep = final.writeShellApplication {
+        name = "check-prevent-sleep";
+        runtimeInputs = with final; [findutils coreutils-full];
+        text = ''
+          mkdir -p /var/run/prevent-sleep.d
+          chmod 0777 /var/run/prevent-sleep.d
+          COUNT="$(find /var/run/prevent-sleep.d/ -type f | wc -l)"
+          [ "$COUNT" = "0" ] || exit 1
+        '';
+      };
 
-      setup-prevent-sleep = prev.writeScriptBin "setup-prevent-sleep" ''
-        #!${prev.stdenv.shell}
-        mkdir -p /var/run/prevent-sleep.d || :
-        chmod 0777 /var/run/prevent-sleep.d || :
-      '';
+      setup-prevent-sleep = final.writeShellApplication {
+        name = "setup-prevent-sleep";
+        runtimeInputs = with final; [coreutils-full];
+        text = ''
+          mkdir -p /var/run/prevent-sleep.d || :
+          chmod 0777 /var/run/prevent-sleep.d || :
+        '';
+      };
     })
   ];
 
diff --git a/host/opt/backup.nix b/host/opt/backup.nix
index 0e31aa3..12b0c8a 100644
--- a/host/opt/backup.nix
+++ b/host/opt/backup.nix
@@ -23,130 +23,132 @@ in {
 
   config = {
     nixpkgs.overlays = [
-      (_: prev: {
-        my-snapshot = prev.writeScriptBin "snapshot.bash" ''
-          #!${pkgs.stdenv.shell}
-          shopt -s nullglob globstar
-          export PATH="${pkgs.util-linux}/bin:${pkgs.gnugrep}/bin:$PATH"
-          export PATH="${pkgs.btrfs-progs}/bin:${pkgs.rclone}/bin:${pkgs.mktemp}/bin:$PATH"
-
-          if [ "$(id -u)" != 0 ]; then
-            echo "Error: Must run ''${0} as root" >&2
-            exit 1
-          fi
-
-          function cleanup() {
-            [[ -f "$NOSLEEP" ]] && rm "$NOSLEEP" || :
-            if [[ -f "$PIDFILE" ]]; then
-              exec 4>&- || :
-              rm "$PIDFILE" || :
+      (final: _: {
+        my-snapshot = final.writeShellApplication {
+          name = "snapshot.bash";
+          runtimeInputs = with final; [util-linux gnugrep btrfs-progs rclone mktemp];
+          text = ''
+            shopt -s nullglob globstar
+
+            if [ "$(id -u)" != 0 ]; then
+              echo "Error: Must run ''${0} as root" >&2
+              exit 1
             fi
-          }
-          trap cleanup EXIT
 
-          NOSLEEP="$(mktemp --tmpdir=/var/run/prevent-sleep.d)"
-          MNT="$(mktemp -d)"
-          PIDFILE="/var/run/backupdisk.pid"
-          TS="$(date +%Y-%m-%d)"
-          CUTOFF_DATE="$(date -d ${escapeShellArg cfg.deleteOlderThan} +%s)"
-
-          touch "$PIDFILE"
-          exec 4<"$PIDFILE"
-          flock 4
-
-          echo "$$" > "$PIDFILE"
-
-          mkdir "$MNT/nix" "$MNT/backup"
-
-          mount ${escapeShellArg cfg.localDrive} "$MNT/nix"
-          mount ${escapeShellArg cfg.localSnapshotDrive} "$MNT/backup"
-
-          SNAPSHOT_DIR="$MNT/backup/"${escapeShellArg cfg.snapshotPrefix}
-          mkdir -p "$MNT/nix/safe" "$SNAPSHOT_DIR" "$MNT/nix/tmp" "$MNT/backup/tmp"
-
-          for vol in "$MNT/nix/safe/"* ; do
-            [[ "$vol" == "$MNT/nix/safe/*" ]] && break
-            NAME="$(basename "$vol")"
-            [[ -e "$SNAPSHOT_DIR/$NAME.$TS" ]] && continue
+            function cleanup() {
+              [[ -f "$NOSLEEP" ]] && (rm "$NOSLEEP" || :)
+              if [[ -f "$PIDFILE" ]]; then
+                exec 4>&- || :
+                rm "$PIDFILE" || :
+              fi
+            }
+            trap cleanup EXIT
+
+            NOSLEEP="$(mktemp --tmpdir=/var/run/prevent-sleep.d)"
+            MNT="$(mktemp -d)"
+            PIDFILE="/var/run/backupdisk.pid"
+            TS="$(date +%Y-%m-%d)"
+            CUTOFF_DATE="$(date -d ${escapeShellArg cfg.deleteOlderThan} +%s)"
+
+            touch "$PIDFILE"
+            exec 4<"$PIDFILE"
+            flock 4
+
+            echo "$$" > "$PIDFILE"
+
+            mkdir "$MNT/nix" "$MNT/backup"
+
+            mount ${escapeShellArg cfg.localDrive} "$MNT/nix"
+            mount ${escapeShellArg cfg.localSnapshotDrive} "$MNT/backup"
+
+            SNAPSHOT_DIR="$MNT/backup/"${escapeShellArg cfg.snapshotPrefix}
+            mkdir -p "$MNT/nix/safe" "$SNAPSHOT_DIR" "$MNT/nix/tmp" "$MNT/backup/tmp"
+
+            for vol in "$MNT/nix/safe/"* ; do
+              [[ "$vol" == "$MNT/nix/safe/*" ]] && break
+              NAME="$(basename "$vol")"
+              [[ -e "$SNAPSHOT_DIR/$NAME.$TS" ]] && continue
+
+              rm -rf "$MNT/nix/tmp/$NAME"
+              btrfs subvolume snapshot -r "$vol" "$MNT/nix/tmp/$NAME"
+
+              if [[ -d "$SNAPSHOT_DIR/$NAME" ]]; then
+                btrfs send -p "$MNT/nix/tmp/$NAME" "$SNAPSHOT_DIR/$NAME" | btrfs receive -m "$MNT/backup/tmp"
+                btrfs subvolume delete "$MNT/backup/safe/$NAME"
+              else
+                btrfs send "$MNT/nix/tmp/$NAME" | btrfs receive "$MNT/backup/tmp"
+              fi
+
+              btrfs subvolume snapshot -r "$MNT/backup/tmp/$NAME" "$SNAPSHOT_DIR/$NAME"
+              btrfs subvolume snapshot -r "$MNT/backup/tmp/$NAME" "$SNAPSHOT_DIR/$NAME.$TS"
+              btrfs subvolume delete "$MNT/nix/tmp/$NAME"
+            done
+
+            rmdir "$MNT/nix/tmp"
+            umount "$MNT/nix"
+
+            for snap in "$SNAPSHOT_DIR/"*; do
+              [[ "$snap" == "$SNAPSHOT_DIR/*" ]] && break
+              [[ -d "$snap" ]] || continue
+              MTIME="$(date -r "$snap" +%s)"
+              (( MTIME <= CUTOFF_DATE )) && btrfs subvolume delete "$snap"
+            done
+
+            umount "$MNT/backup"
+            rmdir "$MNT/backup" "$MNT/nix" "$MNT"
+
+          '';
+        };
 
-            rm -rf "$MNT/nix/tmp/$NAME"
-            btrfs subvolume snapshot -r "$vol" "$MNT/nix/tmp/$NAME"
+        my-backup = final.writeShellApplication {
+          name = "backup.bash";
+          runtimeInputs = with final; [util-linux gnugrep rclone mktemp];
+          text = ''
+            shopt -s nullglob globstar
 
-            if [[ -d "$SNAPSHOT_DIR/$NAME" ]]; then
-              btrfs send -p "$MNT/nix/tmp/$NAME" "$SNAPSHOT_DIR/$NAME" | btrfs receive -m "$MNT/backup/tmp"
-              btrfs subvolume delete "$MNT/backup/safe/$NAME"
-            else
-              btrfs send "$MNT/nix/tmp/$NAME" | btrfs receive "$MNT/backup/tmp"
+            if [ "$(id -u)" != 0 ]; then
+              echo "Error: Must run ''${0} as root" >&2
+              exit 1
             fi
 
-            btrfs subvolume snapshot -r "$MNT/backup/tmp/$NAME" "$SNAPSHOT_DIR/$NAME"
-            btrfs subvolume snapshot -r "$MNT/backup/tmp/$NAME" "$SNAPSHOT_DIR/$NAME.$TS"
-            btrfs subvolume delete "$MNT/nix/tmp/$NAME"
-          done
-
-          rmdir "$MNT/nix/tmp"
-          umount "$MNT/nix"
-
-          for snap in "$SNAPSHOT_DIR/"*; do
-            [[ "$snap" == "$SNAPSHOT_DIR/*" ]] && break
-            [[ -d "$snap" ]] || continue
-            MTIME="$(date -r "$snap" +%s)"
-            (( MTIME <= CUTOFF_DATE )) && btrfs subvolume delete "$snap"
-          done
-
-          umount "$MNT/backup"
-          rmdir "$MNT/backup" "$MNT/nix" "$MNT"
-
-        '';
-
-        my-backup = prev.writeScriptBin "backup.bash" ''
-          #!${pkgs.stdenv.shell}
-          shopt -s nullglob globstar
-          export PATH="${pkgs.util-linux}/bin:${pkgs.gnugrep}/bin:$PATH"
-          export PATH="${pkgs.rclone}/bin:${pkgs.mktemp}/bin:$PATH"
-
-          if [ "$(id -u)" != 0 ]; then
-            echo "Error: Must run ''${0} as root" >&2
-            exit 1
-          fi
-
-          function cleanup() {
-            [[ -f "$NOSLEEP" ]] && rm "$NOSLEEP" || :
-            if [[ -f "$PIDFILE" ]]; then
-              exec 4>&- || :
-              rm "$PIDFILE" || :
-            fi
-          }
-          trap cleanup EXIT
-
-          NOSLEEP="$(mktemp --tmpdir=/var/run/prevent-sleep.d)"
-          MNT="$(mktemp -d)"
-          BUCKET=${escapeShellArg cfg.bucket}
-          DATE="$(date '+%Y-%m-%d-%H:%M:%S')"
-          PIDFILE="/var/run/backupdisk.pid"
-          SNAPSHOT_DIR="$MNT/"${escapeShellArg cfg.snapshotPrefix}
-
-          touch "$PIDFILE"
-          exec 4<"$PIDFILE"
-          flock 4
-
-          mount ${escapeShellArg cfg.localSnapshotDrive} "$MNT"
-          mkdir -p "$MNT/safe"
-
-          for snap in "$SNAPSHOT_DIR/"*; do
-            [[ "$snap" == "$SNAPSHOT_DIR/*" ]] && break
-            [[ -d "$snap" ]] || continue
-            NAME="$(basename "$snap")"
-            grep --quiet "\\." <<< "$NAME" && continue
-
-            rclone --config ${config.sops.templates."rclone.conf".path}  \
-              sync "$snap" "backblaze:$BUCKET/LATEST/$NAME" --links -P --backup-dir \
-              "backblaze:$BUCKET/$DATE/$NAME" || :
-          done
-
-          umount "$MNT"
-          rmdir "$MNT"
-        '';
+            function cleanup() {
+              [[ -f "$NOSLEEP" ]] && (rm "$NOSLEEP" || :)
+              if [[ -f "$PIDFILE" ]]; then
+                exec 4>&- || :
+                rm "$PIDFILE" || :
+              fi
+            }
+            trap cleanup EXIT
+
+            NOSLEEP="$(mktemp --tmpdir=/var/run/prevent-sleep.d)"
+            MNT="$(mktemp -d)"
+            BUCKET=${escapeShellArg cfg.bucket}
+            DATE="$(date '+%Y-%m-%d-%H:%M:%S')"
+            PIDFILE="/var/run/backupdisk.pid"
+            SNAPSHOT_DIR="$MNT/"${escapeShellArg cfg.snapshotPrefix}
+
+            touch "$PIDFILE"
+            exec 4<"$PIDFILE"
+            flock 4
+
+            mount ${escapeShellArg cfg.localSnapshotDrive} "$MNT"
+            mkdir -p "$MNT/safe"
+
+            for snap in "$SNAPSHOT_DIR/"*; do
+              [[ "$snap" == "$SNAPSHOT_DIR/*" ]] && break
+              [[ -d "$snap" ]] || continue
+              NAME="$(basename "$snap")"
+              grep --quiet "\\." <<< "$NAME" && continue
+
+              rclone --config ${config.sops.templates."rclone.conf".path}  \
+                sync "$snap" "backblaze:$BUCKET/LATEST/$NAME" --links -P --backup-dir \
+                "backblaze:$BUCKET/$DATE/$NAME" || :
+            done
+
+            umount "$MNT"
+            rmdir "$MNT"
+          '';
+        };
       })
     ];