diff --git a/dots/.config/nvim/flake.nix b/dots/.config/nvim/flake.nix
index 3da4ef8..011abf5 100644
--- a/dots/.config/nvim/flake.nix
+++ b/dots/.config/nvim/flake.nix
@@ -174,7 +174,7 @@
 
       packageDefinitions = {
         nvim =
-          { ... }:
+          _:
           {
             settings = {
               suffix-path = true;
diff --git a/flake.nix b/flake.nix
index 8e4bfcb..255078b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -56,7 +56,7 @@
     }@inputs:
     let
       inherit (self) outputs;
-      lib = inputs.nixpkgs.lib;
+      inherit (inputs.nixpkgs) lib;
       utils = import ./utils { inherit lib; };
       hostDirNames = utils.dirNames ./hosts;
       system = "x86_64-linux";
diff --git a/home/hosts/andromache/default.nix b/home/hosts/andromache/default.nix
index 719ac66..b11124c 100644
--- a/home/hosts/andromache/default.nix
+++ b/home/hosts/andromache/default.nix
@@ -27,9 +27,11 @@ in
     ../../modules/shell
   ];
 
-  home.stateVersion = "25.05";
-  home.username = username;
-  home.homeDirectory = "/home/${username}";
+  home = {
+    stateVersion = "25.05";
+    inherit username;
+    homeDirectory = "/home/${username}";
+  };
 
   xdg.userDirs.createDirectories = false;
   xdg.userDirs.download = "${config.home.homeDirectory}/dl";
diff --git a/home/hosts/astyanax/default.nix b/home/hosts/astyanax/default.nix
index fa961d5..9841cfe 100644
--- a/home/hosts/astyanax/default.nix
+++ b/home/hosts/astyanax/default.nix
@@ -23,9 +23,11 @@ in
     ../../modules/shell
   ];
 
-  home.stateVersion = "25.05";
-  home.username = username;
-  home.homeDirectory = "/home/${username}";
+  home = {
+    stateVersion = "25.05";
+    inherit username;
+    homeDirectory = "/home/${username}";
+  };
 
   xdg.userDirs.createDirectories = false;
   xdg.userDirs.download = "${config.home.homeDirectory}/dl";
diff --git a/home/hosts/work/default.nix b/home/hosts/work/default.nix
index 7106ce7..da9b21a 100644
--- a/home/hosts/work/default.nix
+++ b/home/hosts/work/default.nix
@@ -45,12 +45,14 @@ in
 
   nixpkgs.config.allowUnfree = true;
 
-  home.stateVersion = "25.05";
-  home.username = username;
-  home.homeDirectory = "/home/${username}";
+  home = {
+    stateVersion = "25.05";
+    inherit username;
+    homeDirectory = "/home/${username}";
+  };
 
   targets.genericLinux.nixGL = {
-    packages = inputs.nixgl.packages;
+    inherit (inputs.nixgl) packages;
     defaultWrapper = "mesa";
   };
 
diff --git a/home/hosts/work/packages.nix b/home/hosts/work/packages.nix
index bc39ad7..000fc31 100644
--- a/home/hosts/work/packages.nix
+++ b/home/hosts/work/packages.nix
@@ -13,4 +13,4 @@ let
       [ ];
 in
 
-[ ] ++ localPackages
+localPackages
diff --git a/home/modules/shell/bash.nix b/home/modules/shell/bash.nix
index 120a2ed..cf23e30 100644
--- a/home/modules/shell/bash.nix
+++ b/home/modules/shell/bash.nix
@@ -7,7 +7,7 @@
 }:
 let
   cfg = config.shell.bash;
-  username = config.home.username;
+  inherit (config.home) username;
 in
 {
   options.shell.bash = {
diff --git a/hosts/andromache/default.nix b/hosts/andromache/default.nix
index 4470219..2b094f4 100644
--- a/hosts/andromache/default.nix
+++ b/hosts/andromache/default.nix
@@ -27,7 +27,7 @@ in
     ../../modules/desktops/niri
     ../../modules/bluetooth
     ../../modules/keyboard
-    (import ../../modules/networking { hostName = hostName; })
+    (import ../../modules/networking { inherit hostName; })
     ../../modules/users
     ../../modules/audio
     ../../modules/localization
@@ -93,36 +93,37 @@ in
     inputs.nvim.packages.x86_64-linux.nvim
   ];
 
-  services.xserver = {
-    videoDrivers = [ "nvidia" ];
-  };
+  services = {
+    xserver = {
+      videoDrivers = [ "nvidia" ];
+    };
 
-  services.openssh = {
-    enable = true;
-    harden = true;
-  };
+    openssh = {
+      enable = true;
+      harden = true;
+    };
 
-  services.syncthing = {
-    enable = true;
-    openDefaultPorts = true;
-    settings = {
-      devices = {
-        # "device1" = {
-        #   id = "DEVICE-ID-GOES-HERE";
-        # };
-      };
-      folders = {
-        "/home/${username}/sync" = {
-          id = "sync";
-          devices = [ ];
+    syncthing = {
+      enable = true;
+      openDefaultPorts = true;
+      settings = {
+        devices = {
+          # "device1" = {
+          #   id = "DEVICE-ID-GOES-HERE";
+          # };
+        };
+        folders = {
+          "/home/${username}/sync" = {
+            id = "sync";
+            devices = [ ];
+          };
         };
       };
     };
-  };
-
-  services.locate = {
-    enable = true;
-    package = pkgs.plocate;
+    locate = {
+      enable = true;
+      package = pkgs.plocate;
+    };
   };
 
   networking = {
@@ -131,7 +132,7 @@ in
     interfaces = {
       eno1 = {
         wakeOnLan.enable = true;
-        macAddress = wolInterfaces.eno1.macAddress;
+        inherit (wolInterfaces.eno1) macAddress;
       };
     };
     firewall = {
diff --git a/hosts/andromache/hard.nix b/hosts/andromache/hard.nix
index 2171ce2..ec7e381 100644
--- a/hosts/andromache/hard.nix
+++ b/hosts/andromache/hard.nix
@@ -14,19 +14,21 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [
-    "vmd"
-    "xhci_pci"
-    "ahci"
-    "nvme"
-    "usbhid"
-    "usb_storage"
-    "uas"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
+  boot = {
+    initrd.availableKernelModules = [
+      "vmd"
+      "xhci_pci"
+      "ahci"
+      "nvme"
+      "usbhid"
+      "usb_storage"
+      "uas"
+      "sd_mod"
+    ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+  };
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/hosts/astyanax/default.nix b/hosts/astyanax/default.nix
index d10629c..cc0c81c 100644
--- a/hosts/astyanax/default.nix
+++ b/hosts/astyanax/default.nix
@@ -27,7 +27,7 @@ in
     ../../modules/desktops/niri
     ../../modules/bluetooth
     ../../modules/keyboard
-    (import ../../modules/networking { hostName = hostName; })
+    (import ../../modules/networking { inherit hostName; })
     ../../modules/users
     ../../modules/audio
     ../../modules/localization
diff --git a/hosts/astyanax/hard.nix b/hosts/astyanax/hard.nix
index 9c89f61..a78e869 100644
--- a/hosts/astyanax/hard.nix
+++ b/hosts/astyanax/hard.nix
@@ -14,16 +14,18 @@
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [
-    "xhci_pci"
-    "thunderbolt"
-    "nvme"
-    "uas"
-    "sd_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
+  boot = {
+    initrd.availableKernelModules = [
+      "xhci_pci"
+      "thunderbolt"
+      "nvme"
+      "uas"
+      "sd_mod"
+    ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+  };
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/hosts/hecuba/hard.nix b/hosts/hecuba/hard.nix
index 39900cf..3bcc4d5 100644
--- a/hosts/hecuba/hard.nix
+++ b/hosts/hecuba/hard.nix
@@ -14,17 +14,21 @@
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  boot.initrd.availableKernelModules = [
-    "ahci"
-    "xhci_pci"
-    "virtio_pci"
-    "virtio_scsi"
-    "sd_mod"
-    "sr_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
+  boot = {
+    initrd = {
+      availableKernelModules = [
+        "ahci"
+        "xhci_pci"
+        "virtio_pci"
+        "virtio_scsi"
+        "sd_mod"
+        "sr_mod"
+      ];
+      kernelModules = [ ];
+    };
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+  };
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/hosts/vm/default.nix b/hosts/vm/default.nix
index 8cf643c..3685b6f 100644
--- a/hosts/vm/default.nix
+++ b/hosts/vm/default.nix
@@ -18,7 +18,7 @@ in
     ./disk.nix
     ../../modules/boot/bootloader.nix
     ../../modules/keyboard
-    (import ../../modules/networking { hostName = hostName; })
+    (import ../../modules/networking { inherit hostName; })
     ../../modules/users
     ../../modules/audio
     ../../modules/localization
@@ -42,9 +42,11 @@ in
   environment.systemPackages = [ inputs.nvim.packages.x86_64-linux.nvim ];
 
   disko = {
-    devices.disk.main.device = "/dev/vda";
-    devices.disk.main.imageName = "nixos-vm";
-    devices.disk.main.imageSize = "32G";
+    devices.disk.main = {
+      device = "/dev/vda";
+      imageName = "nixos-vm";
+      imageSize = "32G";
+    };
   };
 
   virtualisation.vmVariantWithDisko = {
@@ -59,11 +61,12 @@ in
     };
   };
 
-  services.qemuGuest.enable = true;
-  services.spice-vdagentd.enable = true;
-
-  services.openssh = {
-    enable = true;
-    harden = true;
+  services = {
+    qemuGuest.enable = true;
+    spice-vdagentd.enable = true;
+    openssh = {
+      enable = true;
+      harden = true;
+    };
   };
 }
diff --git a/hosts/vm/hard.nix b/hosts/vm/hard.nix
index 6253294..ee4fdb5 100644
--- a/hosts/vm/hard.nix
+++ b/hosts/vm/hard.nix
@@ -14,16 +14,20 @@
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  boot.initrd.availableKernelModules = [
-    "ahci"
-    "xhci_pci"
-    "virtio_pci"
-    "sr_mod"
-    "virtio_blk"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
+  boot = {
+    initrd = {
+      availableKernelModules = [
+        "ahci"
+        "xhci_pci"
+        "virtio_pci"
+        "sr_mod"
+        "virtio_blk"
+      ];
+      kernelModules = [ ];
+    };
+    kernelModules = [ "kvm-intel" ];
+    extraModulePackages = [ ];
+  };
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/modules/audio/default.nix b/modules/audio/default.nix
index 581fe04..2067c73 100644
--- a/modules/audio/default.nix
+++ b/modules/audio/default.nix
@@ -1,13 +1,15 @@
-{ ... }:
+_:
 
 {
-  services.pulseaudio.enable = false;
   security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
+  services = {
+    pulseaudio.enable = false;
+    pipewire = {
+      enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      pulse.enable = true;
+    };
+    pulseaudio.extraConfig = "load-module module-switch-on-connect";
   };
-  services.pulseaudio.extraConfig = "load-module module-switch-on-connect";
 }
diff --git a/modules/boot/bootloader.nix b/modules/boot/bootloader.nix
index cba18ae..3a4014f 100644
--- a/modules/boot/bootloader.nix
+++ b/modules/boot/bootloader.nix
@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   boot.loader.systemd-boot.enable = true;
diff --git a/modules/common/default.nix b/modules/common/default.nix
index 5656d7a..5574c90 100644
--- a/modules/common/default.nix
+++ b/modules/common/default.nix
@@ -1,4 +1,9 @@
-{ inputs, outputs, dotsPath, ... }:
+{
+  inputs,
+  outputs,
+  dotsPath,
+  ...
+}:
 
 {
   imports = [
@@ -23,15 +28,16 @@
     };
   };
 
-  nix.optimise = {
-    automatic = true;
-    dates = [ "05:00" ];
-  };
-
-  nix.gc = {
-    automatic = true;
-    dates = "weekly";
-    options = "--delete-older-than 30d";
+  nix = {
+    optimise = {
+      automatic = true;
+      dates = [ "05:00" ];
+    };
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
   };
 
   system.autoUpgrade = {
diff --git a/modules/desktops/niri/default.nix b/modules/desktops/niri/default.nix
index b3dda85..be82772 100644
--- a/modules/desktops/niri/default.nix
+++ b/modules/desktops/niri/default.nix
@@ -1,14 +1,16 @@
 {
   programs.niri.enable = true;
 
-  services.dbus.enable = true;
-  services.logind.settings.Login = {
-    HandleLidSwitch = "suspend";
-    IdleAction = "suspend";
-    IdleActionSec = 1800;
-  };
+  services = {
+    dbus.enable = true;
+    logind.settings.Login = {
+      HandleLidSwitch = "suspend";
+      IdleAction = "suspend";
+      IdleActionSec = 1800;
+    };
 
-  services.displayManager.ly = {
-    enable = true;
+    displayManager.ly = {
+      enable = true;
+    };
   };
 }
diff --git a/modules/disko/zfs-encrypted-root.nix b/modules/disko/zfs-encrypted-root.nix
index cf4cb22..9718003 100644
--- a/modules/disko/zfs-encrypted-root.nix
+++ b/modules/disko/zfs-encrypted-root.nix
@@ -11,7 +11,7 @@
       disk = {
         root = {
           type = "disk";
-          device = config.device;
+          inherit (config) device;
           content = {
             type = "gpt";
             partitions = {
diff --git a/modules/localization/default.nix b/modules/localization/default.nix
index 19b601d..45dea14 100644
--- a/modules/localization/default.nix
+++ b/modules/localization/default.nix
@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   time.timeZone = "Europe/Brussels";
diff --git a/modules/networking/default.nix b/modules/networking/default.nix
index 1f5cb40..256b970 100644
--- a/modules/networking/default.nix
+++ b/modules/networking/default.nix
@@ -5,7 +5,7 @@
 
 {
   networking = {
-    hostName = hostName;
+    inherit hostName;
     wireless.iwd.enable = true;
     networkmanager.wifi.backend = "iwd";
     nftables.enable = true;
diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix
index 4ee9e49..7943ee7 100644
--- a/modules/secrets/default.nix
+++ b/modules/secrets/default.nix
@@ -34,56 +34,58 @@ in
         "opencode_api_key".owner = config.users.users.${cfg.username}.name;
       };
 
-      templates."taskrc.d/sync" = {
-        owner = config.users.users.${cfg.username}.name;
-        content = ''
-          sync.server.url=${config.sops.placeholder."taskwarrior_sync_server_url"}
-          sync.server.client_id=${config.sops.placeholder."taskwarrior_sync_server_client_id"}
-          sync.encryption_secret=${config.sops.placeholder."taskwarrior_sync_encryption_secret"}
-        '';
-      };
+      templates = {
+        "taskrc.d/sync" = {
+          owner = config.users.users.${cfg.username}.name;
+          content = ''
+            sync.server.url=${config.sops.placeholder."taskwarrior_sync_server_url"}
+            sync.server.client_id=${config.sops.placeholder."taskwarrior_sync_server_client_id"}
+            sync.encryption_secret=${config.sops.placeholder."taskwarrior_sync_encryption_secret"}
+          '';
+        };
 
-      templates.".gitconfig.email" = {
-        owner = config.users.users.${cfg.username}.name;
-        path = "/home/${cfg.username}/.gitconfig.email";
-        content = ''
-          [user]
-            email = ${config.sops.placeholder."email_personal"}
-        '';
-      };
+        ".gitconfig.email" = {
+          owner = config.users.users.${cfg.username}.name;
+          path = "/home/${cfg.username}/.gitconfig.email";
+          content = ''
+            [user]
+              email = ${config.sops.placeholder."email_personal"}
+          '';
+        };
 
-      templates.".gitconfig.work.email" = {
-        owner = config.users.users.${cfg.username}.name;
-        path = "/home/${cfg.username}/.gitconfig.work.email";
-        content = ''
-          [user]
-            email = ${config.sops.placeholder."email_work"}
-        '';
-      };
+        ".gitconfig.work.email" = {
+          owner = config.users.users.${cfg.username}.name;
+          path = "/home/${cfg.username}/.gitconfig.work.email";
+          content = ''
+            [user]
+              email = ${config.sops.placeholder."email_work"}
+          '';
+        };
 
-      templates."hcloud/cli.toml" = {
-        owner = config.users.users.${cfg.username}.name;
-        path = "/home/${cfg.username}/.config/hcloud/cli.toml";
-        content = ''
-          active_context = "server"
+        "hcloud/cli.toml" = {
+          owner = config.users.users.${cfg.username}.name;
+          path = "/home/${cfg.username}/.config/hcloud/cli.toml";
+          content = ''
+            active_context = "server"
 
-          [[contexts]]
-            name = "server"
-            token = "${config.sops.placeholder."hcloud"}"
-        '';
-      };
+            [[contexts]]
+              name = "server"
+              token = "${config.sops.placeholder."hcloud"}"
+          '';
+        };
 
-      templates."opencode/auth.json" = {
-        owner = config.users.users.${cfg.username}.name;
-        path = "/home/${cfg.username}/.local/share/opencode/auth.json";
-        content = ''
-          {
-            "zai-coding-plan": {
-              "type": "api",
-              "key": "${config.sops.placeholder."opencode_api_key"}"
+        "opencode/auth.json" = {
+          owner = config.users.users.${cfg.username}.name;
+          path = "/home/${cfg.username}/.local/share/opencode/auth.json";
+          content = ''
+            {
+              "zai-coding-plan": {
+                "type": "api",
+                "key": "${config.sops.placeholder."opencode_api_key"}"
+              }
             }
-          }
-        '';
+          '';
+        };
       };
     };
   };
diff --git a/modules/ssh/extract-keys.nix b/modules/ssh/extract-keys.nix
index 603685e..058bf83 100644
--- a/modules/ssh/extract-keys.nix
+++ b/modules/ssh/extract-keys.nix
@@ -1,6 +1,6 @@
 { lib, config, ... }:
 let
-  username = config.ssh.username;
+  inherit (config.ssh) username;
 in
 {
   # auto extract SSH keys
diff --git a/modules/x/default.nix b/modules/x/default.nix
index a434e95..d956a8f 100644
--- a/modules/x/default.nix
+++ b/modules/x/default.nix
@@ -1,4 +1,4 @@
-{ ... }:
+_:
 
 {
   services.xserver.windowManager.xmonad = {