diff --git a/flake.lock b/flake.lock
index 8884f797..c4ae7ba5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736143030,
-        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
+        "lastModified": 1738453229,
+        "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
+        "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
         "type": "github"
       },
       "original": {
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737968762,
-        "narHash": "sha256-xiPARGKwocaMtv+U/rgi+h2g56CZZEmrcl7ldRaslq8=",
+        "lastModified": 1739790043,
+        "narHash": "sha256-4gK4zdNDQ4PyGFs7B6zp9iPIBy9E+bVJiZ0XAmncvgQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e1ae908bcc30af792b0bb0a52e53b03d2577255e",
+        "rev": "c1ea92cdfb85bd7b0995b550581d9fd1c3370bf9",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1737885589,
-        "narHash": "sha256-Zf0hSrtzaM1DEz8//+Xs51k/wdSajticVrATqDrfQjg=",
+        "lastModified": 1739580444,
+        "narHash": "sha256-+/bSz4EAVbqz8/HsIGLroF8aNaO8bLRL7WfACN+24g4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "852ff1d9e153d8875a83602e03fdef8a63f0ecf8",
+        "rev": "8bb37161a0488b89830168b81c48aed11569cb93",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1738059992,
-        "narHash": "sha256-VeNLLucQTlED2cqD3uofh968tm7u7UgwCdY5+jo/BSc=",
+        "lastModified": 1739796551,
+        "narHash": "sha256-XcTK29rOc0WxcSJDHUK8JQege9CzSVVAcjHdswOVFPA=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "c46c836963685acbd2430439f859b60f230b3643",
+        "rev": "827aa6eeaf92cc085f84947f6c32002792b67497",
         "type": "github"
       },
       "original": {
diff --git a/modules/home/feh/default.nix b/modules/home/feh/default.nix
index 3a952a22..d72eed2c 100644
--- a/modules/home/feh/default.nix
+++ b/modules/home/feh/default.nix
@@ -10,4 +10,11 @@ in
   config.programs.feh = lib.mkIf cfg.enable {
     enable = true;
   };
+
+  config.my.home.xdg.mime-apps = lib.mkIf cfg.enable {
+    applications.media.image = {
+      bitmap = [ "feh.desktop" ];
+      vector = [ "feh.desktop" ];
+    };
+  };
 }
diff --git a/modules/home/firefox/default.nix b/modules/home/firefox/default.nix
index 02c74f2d..e1b0e37a 100644
--- a/modules/home/firefox/default.nix
+++ b/modules/home/firefox/default.nix
@@ -77,4 +77,8 @@ in
       };
     };
   };
+
+  config.my.home.xdg.mime-apps = lib.mkIf cfg.enable {
+    applications.editor = [ "firefox.desktop" ];
+  };
 }
diff --git a/modules/home/git/default.nix b/modules/home/git/default.nix
index 1bb22159..c88008fa 100644
--- a/modules/home/git/default.nix
+++ b/modules/home/git/default.nix
@@ -123,11 +123,6 @@ in
         defaultBranch = "main";
       };
 
-      # Local configuration, not-versioned
-      include = {
-        path = "config.local";
-      };
-
       merge = {
         conflictStyle = "zdiff3";
       };
@@ -167,8 +162,8 @@ in
       };
     };
 
-    # Multiple identities
-    includes = [
+    includes = lib.mkAfter [
+      # Multiple identities
       {
         condition = "gitdir:~/git/EPITA/";
         contents = {
@@ -187,6 +182,10 @@ in
           };
         };
       }
+      # Local configuration, not-versioned
+      {
+        path = "config.local";
+      }
     ];
 
     ignores =
diff --git a/modules/home/mail/accounts/default.nix b/modules/home/mail/accounts/default.nix
index 202b9bc5..5216ad5e 100644
--- a/modules/home/mail/accounts/default.nix
+++ b/modules/home/mail/accounts/default.nix
@@ -26,20 +26,7 @@ let
   };
 
   migaduConfig = {
-    imap = {
-      host = "imap.migadu.com";
-      port = 993;
-      tls = {
-        enable = true;
-      };
-    };
-    smtp = {
-      host = "smtp.migadu.com";
-      port = 465;
-      tls = {
-        enable = true;
-      };
-    };
+    flavor = "migadu.com";
   };
 
   gmailConfig = {
diff --git a/modules/home/mail/himalaya/default.nix b/modules/home/mail/himalaya/default.nix
index 849a415a..84eccf59 100644
--- a/modules/home/mail/himalaya/default.nix
+++ b/modules/home/mail/himalaya/default.nix
@@ -20,4 +20,8 @@ in
         '';
     };
   };
+
+  config.my.home.xdg.mime-apps = lib.mkIf cfg.enable {
+    applications.editor = [ "himalaya.desktop" ];
+  };
 }
diff --git a/modules/home/mpv/default.nix b/modules/home/mpv/default.nix
index 8af394cf..1ccd0baf 100644
--- a/modules/home/mpv/default.nix
+++ b/modules/home/mpv/default.nix
@@ -17,5 +17,12 @@ in
         pkgs.mpvScripts.uosc # Nicer UI
       ];
     };
+
+    my.home.xdg.mime-apps = {
+      applications.media = {
+        audio = [ "mpv.desktop" ];
+        video = [ "mpv.desktop" ];
+      };
+    };
   };
 }
diff --git a/modules/home/packages/default.nix b/modules/home/packages/default.nix
index b0f8d674..43f7111e 100644
--- a/modules/home/packages/default.nix
+++ b/modules/home/packages/default.nix
@@ -1,6 +1,7 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, osConfig, ... }:
 let
   cfg = config.my.home.packages;
+  useGlobalPkgs = osConfig.home-manager.useGlobalPkgs or false;
 in
 {
   options.my.home.packages = with lib; {
@@ -29,7 +30,7 @@ in
       tree
     ] ++ cfg.additionalPackages);
 
-    nixpkgs.config = {
+    nixpkgs.config = lib.mkIf (!useGlobalPkgs) {
       inherit (cfg) allowAliases allowUnfree;
     };
   };
diff --git a/modules/home/secrets/github/token.age b/modules/home/secrets/github/token.age
index 1d36ccdc..3e8bb5a8 100644
Binary files a/modules/home/secrets/github/token.age and b/modules/home/secrets/github/token.age differ
diff --git a/modules/home/secrets/secrets.nix b/modules/home/secrets/secrets.nix
index f4743429..27cdb4ee 100644
--- a/modules/home/secrets/secrets.nix
+++ b/modules/home/secrets/secrets.nix
@@ -1,6 +1,6 @@
 # Common secrets
 let
-  keys = import ../../keys;
+  keys = import ../../../keys;
 
   all = builtins.attrValues keys.users;
 in
diff --git a/modules/home/terminal/alacritty/default.nix b/modules/home/terminal/alacritty/default.nix
index daf3e806..35a08c66 100644
--- a/modules/home/terminal/alacritty/default.nix
+++ b/modules/home/terminal/alacritty/default.nix
@@ -48,5 +48,9 @@ in
         };
       };
     };
+
+    my.home.xdg.mime-apps = {
+      applications.terminal = [ "Alacritty.desktop" ];
+    };
   };
 }
diff --git a/modules/home/terminal/termite/default.nix b/modules/home/terminal/termite/default.nix
index e8f67a7d..b4ecdad5 100644
--- a/modules/home/terminal/termite/default.nix
+++ b/modules/home/terminal/termite/default.nix
@@ -49,5 +49,9 @@ in
         color15 = ${whiteBold}
       '';
     };
+
+    my.home.xdg.mime-apps = {
+      applications.terminal = [ "termite.desktop" ];
+    };
   };
 }
diff --git a/modules/home/vim/default.nix b/modules/home/vim/default.nix
index 8e6bd5c6..557588d0 100644
--- a/modules/home/vim/default.nix
+++ b/modules/home/vim/default.nix
@@ -107,4 +107,8 @@ in
   };
 
   config.xdg.configFile = lib.mkIf cfg.enable configFiles;
+
+  config.my.home.xdg.mime-apps = lib.mkIf cfg.enable {
+    applications.editor = [ "nvim.desktop" ];
+  };
 }
diff --git a/modules/home/xdg/default.nix b/modules/home/xdg/default.nix
index 803167fa..e16a4b6f 100644
--- a/modules/home/xdg/default.nix
+++ b/modules/home/xdg/default.nix
@@ -3,6 +3,10 @@ let
   cfg = config.my.home.xdg;
 in
 {
+  imports = [
+    ./mime-apps.nix
+  ];
+
   options.my.home.xdg = with lib; {
     enable = my.mkDisableOption "XDG configuration";
   };
diff --git a/modules/home/xdg/mime-apps.nix b/modules/home/xdg/mime-apps.nix
new file mode 100644
index 00000000..8dd52980
--- /dev/null
+++ b/modules/home/xdg/mime-apps.nix
@@ -0,0 +1,280 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.home.xdg.mime-apps;
+  app = cfg.applications;
+
+  strOrStrList = with lib.types; coercedTo str lib.singleton (listOf str);
+  mkMimeAppOption = kind: lib.mkOption {
+    description = "Application to associate as ${kind}";
+    default = null;
+    type = lib.types.nullOr strOrStrList;
+  };
+in
+{
+  options.my.home.xdg.mime-apps = with lib; {
+    enable = my.mkDisableOption "XDG MIME Applications configuration";
+
+    applications = lib.mapAttrsRecursive (_: mkMimeAppOption) {
+      archive = "archive manager";
+      browser = "internet browser";
+      calendar = "calendar";
+      editor = "text editor";
+      fileManager = "file manager";
+      mail = "mail client";
+      media = {
+        audio = "audio player";
+        document = {
+          comic = "comic book reader";
+          ebook = "ebook reader";
+          pdf = "PDF reader";
+        };
+        image = {
+          bitmap = "bitmap image viewer";
+          vector = "vector image viewer";
+          editor = "image editor";
+        };
+        video = "video player";
+      };
+      office = {
+        database = "database management program";
+        formula = "formula editor";
+        graphics = "graphics editor";
+        presentation = "presentation editor";
+        spreadsheet = "spreadsheet editor";
+        text = "word processor";
+      };
+      terminal = "terminal";
+      torrent = "bittorrent client";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    xdg = {
+      mimeApps = {
+        enable = true;
+        defaultApplications = lib.filterAttrs (_: apps: apps != null) {
+          "application/epub+zip" = app.media.document.ebook;
+          "application/gzip" = app.archive;
+          "application/json" = app.editor;
+          "application/ld+json" = app.editor;
+          "application/mxf " = app.media.video;
+          "application/ogg" = app.media.audio;
+          "application/pdf" = app.media.document.pdf;
+          "application/rss+xml" = app.editor;
+          "application/smil+xml " = app.media.video;
+          "application/vnd.amazon.ebook" = app.media.document.ebook;
+          "application/vnd.apple.mpegurl " = app.media.video;
+          "application/vnd.comicbook+zip" = app.media.document.comic;
+          "application/vnd.comicbook-rar" = app.media.document.comic;
+          "application/vnd.mozilla.xul+xml" = app.browser;
+          "application/vnd.ms-excel" = app.office.spreadsheet;
+          "application/vnd.ms-powerpoint" = app.office.presentation;
+          "application/vnd.ms-word" = app.office.text;
+          "application/vnd.oasis.opendocument.database" = app.office.database;
+          "application/vnd.oasis.opendocument.formula" = app.office.formula;
+          "application/vnd.oasis.opendocument.graphics" = app.office.graphics;
+          "application/vnd.oasis.opendocument.graphics-template" = app.office.graphics;
+          "application/vnd.oasis.opendocument.presentation" = app.office.presentation;
+          "application/vnd.oasis.opendocument.presentation-template" = app.office.presentation;
+          "application/vnd.oasis.opendocument.spreadsheet" = app.office.spreadsheet;
+          "application/vnd.oasis.opendocument.spreadsheet-template" = app.office.spreadsheet;
+          "application/vnd.oasis.opendocument.text" = app.office.text;
+          "application/vnd.oasis.opendocument.text-master" = app.office.text;
+          "application/vnd.oasis.opendocument.text-template" = app.office.text;
+          "application/vnd.oasis.opendocument.text-web" = app.office.text;
+          "application/vnd.openxmlformats-officedocument.presentationml.presentation" = app.office.presentation;
+          "application/vnd.openxmlformats-officedocument.presentationml.template" = app.office.presentation;
+          "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" = app.office.spreadsheet;
+          "application/vnd.openxmlformats-officedocument.spreadsheetml.template" = app.office.spreadsheet;
+          "application/vnd.openxmlformats-officedocument.wordprocessingml.document" = app.office.text;
+          "application/vnd.openxmlformats-officedocument.wordprocessingml.template" = app.office.text;
+          "application/vnd.rar" = app.archive;
+          "application/vnd.stardivision.calc" = app.office.spreadsheet;
+          "application/vnd.stardivision.draw" = app.office.graphics;
+          "application/vnd.stardivision.impress" = app.office.presentation;
+          "application/vnd.stardivision.math" = app.office.formula;
+          "application/vnd.stardivision.writer" = app.office.text;
+          "application/vnd.sun.xml.base" = app.office.database;
+          "application/vnd.sun.xml.calc" = app.office.spreadsheet;
+          "application/vnd.sun.xml.calc.template" = app.office.spreadsheet;
+          "application/vnd.sun.xml.draw" = app.office.graphics;
+          "application/vnd.sun.xml.draw.template" = app.office.graphics;
+          "application/vnd.sun.xml.impress" = app.office.presentation;
+          "application/vnd.sun.xml.impress.template" = app.office.presentation;
+          "application/vnd.sun.xml.math" = app.office.formula;
+          "application/vnd.sun.xml.writer" = app.office.text;
+          "application/vnd.sun.xml.writer.global" = app.office.text;
+          "application/vnd.sun.xml.writer.template" = app.office.text;
+          "application/vnd.wordperfect" = app.office.text;
+          "application/x-7z-compressed" = app.archive;
+          "application/x-arj" = app.archive;
+          "application/x-bittorrent" = app.torrent;
+          "application/x-bzip" = app.archive;
+          "application/x-bzip-compressed-tar" = app.archive;
+          "application/x-bzip2" = app.archive;
+          "application/x-cb7" = app.media.document.comic;
+          "application/x-cbr" = app.media.document.comic;
+          "application/x-cbt" = app.media.document.comic;
+          "application/x-cbz" = app.media.document.comic;
+          "application/x-compress" = app.archive;
+          "application/x-compressed-tar" = app.archive;
+          "application/x-csh" = app.editor;
+          "application/x-cue" = app.media.audio;
+          "application/x-directory" = app.fileManager;
+          "application/x-extension-htm" = app.browser;
+          "application/x-extension-html" = app.browser;
+          "application/x-extension-ics" = app.calendar;
+          "application/x-extension-m4a" = app.media.audio;
+          "application/x-extension-mp4" = app.media.video;
+          "application/x-extension-shtml" = app.browser;
+          "application/x-extension-xht" = app.browser;
+          "application/x-extension-xhtml" = app.browser;
+          "application/x-fictionbook" = app.media.document.ebook;
+          "application/x-fictionbook+xml" = app.media.document.ebook;
+          "application/x-flac" = app.media.audio;
+          "application/x-gzip" = app.archive;
+          "application/x-lha" = app.archive;
+          "application/x-lhz" = app.archive;
+          "application/x-lzop" = app.archive;
+          "application/x-matroska" = app.media.video;
+          "application/x-netshow-channel" = app.media.video;
+          "application/x-quicktime-media-link" = app.media.video;
+          "application/x-quicktimeplayer" = app.media.video;
+          "application/x-rar" = app.archive;
+          "application/x-sh" = app.editor;
+          "application/x-shellscript" = app.editor;
+          "application/x-shorten " = app.media.audio;
+          "application/x-smil" = app.media.video;
+          "application/x-tar" = app.archive;
+          "application/x-tarz" = app.archive;
+          "application/x-wine-extension-ini" = app.editor;
+          "application/x-zip-compressed" = app.archive;
+          "application/x-zoo" = app.archive;
+          "application/xhtml+xml" = app.browser;
+          "application/xml" = app.editor;
+          "application/zip" = app.archive;
+          "audio/*" = app.media.video;
+          "image/*" = app.media.image.bitmap;
+          "image/svg+xml" = app.media.image.vector;
+          "image/x-compressed-xcf" = app.media.image.editor;
+          "image/x-fits" = app.media.image.editor;
+          "image/x-psd" = app.media.image.editor;
+          "image/x-xcf" = app.media.image.editor;
+          "inode/directory" = app.fileManager;
+          "message/rfc822" = app.mail;
+          "text/*" = app.editor;
+          "text/calendar" = app.calendar;
+          "text/html" = app.browser;
+          "text/plain" = app.editor;
+          "video/*" = app.media.video;
+          "x-scheme-handler/about" = app.browser;
+          "x-scheme-handler/chrome" = app.browser;
+          "x-scheme-handler/file" = app.fileManager;
+          "x-scheme-handler/ftp" = app.browser;
+          "x-scheme-handler/http" = app.browser;
+          "x-scheme-handler/https" = app.browser;
+          "x-scheme-handler/mailto" = app.mail;
+          "x-scheme-handler/mid" = app.mail;
+          "x-scheme-handler/terminal" = app.terminal;
+          "x-scheme-handler/unknown" = app.browser;
+          "x-scheme-handler/webcal" = app.calendar;
+          "x-scheme-handler/webcals" = app.calendar;
+          "x-www-browser" = app.browser;
+
+          # FIXME: relevant? https://bbs.archlinux.org/viewtopic.php?id=243125
+
+          # FIXME: shouldn't be necessary then
+          # "audio/AMR" = app.media.audio;
+          # "audio/aac" = app.media.audio;
+          # "audio/ac3" = app.media.audio;
+          # "audio/flac" = app.media.audio;
+          # "audio/mp2" = app.media.audio;
+          # "audio/mp4" = app.media.audio;
+          # "audio/mpeg" = app.media.audio;
+          # "audio/ogg" = app.media.audio;
+          # "audio/vnd.dts" = app.media.audio;
+          # "audio/vnd.dts.hd" = app.media.audio;
+          # "audio/vnd.rn-realaudio" = app.media.audio;
+          # "audio/webm" = app.media.audio;
+          # "audio/x-adpcm" = app.media.audio;
+          # "audio/x-aiff" = app.media.audio;
+          # "audio/x-ape" = app.media.audio;
+          # "audio/x-matroska" = app.media.audio;
+          # "audio/x-mpegurl" = app.media.audio;
+          # "audio/x-ms-asx" = app.media.audio;
+          # "audio/x-ms-wma" = app.media.audio;
+          # "audio/x-musepack" = app.media.audio;
+          # "audio/x-scpls" = app.media.audio;
+          # "audio/x-tta" = app.media.audio;
+          # "audio/x-vorbis+ogg" = app.media.audio;
+          # "audio/x-wav" = app.media.audio;
+          # "audio/x-wavpack" = app.media.audio;
+          # "image/bmp" = app.media.image.bitmap;
+          # "image/gif" = app.media.image.bitmap;
+          # "image/heif" = app.media.image.bitmap;
+          # "image/jpeg" = app.media.image.bitmap;
+          # "image/jpg" = app.media.image.bitmap;
+          # "image/pjpeg" = app.media.image.bitmap;
+          # "image/png" = app.media.image.bitmap;
+          # "image/tiff" = app.media.image.bitmap;
+          # "image/vnd.zbrush.pcx" = app.media.image.bitmap;
+          # "image/webp" = app.media.image.bitmap;
+          # "image/x-icb" = app.media.image.bitmap;
+          # "image/x-ico" = app.media.image.bitmap;
+          # "image/x-pcx" = app.media.image.bitmap;
+          # "image/x-portable-anymap" = app.media.image.bitmap;
+          # "image/x-portable-bitmap" = app.media.image.bitmap;
+          # "image/x-portable-graymap" = app.media.image.bitmap;
+          # "image/x-portable-pixmap" = app.media.image.bitmap;
+          # "image/x-tga" = app.media.image.bitmap;
+          # "image/x-xbitmap" = app.media.image.bitmap;
+          # "image/x-xpixmap" = app.media.image.bitmap;
+          # "image/x-xwindowdump" = app.media.image.bitmap;
+          # "text/tcl" = app.editor;
+          # "text/x-c++hdr" = app.editor;
+          # "text/x-c++src" = app.editor;
+          # "text/x-chdr" = app.editor;
+          # "text/x-csrc" = app.editor;
+          # "text/x-java" = app.editor;
+          # "text/x-makefile" = app.editor;
+          # "text/x-moc" = app.editor;
+          # "text/x-pascal" = app.editor;
+          # "text/x-tex" = app.editor;
+          # "video/3gpp" = app.media.video;
+          # "video/3gpp2" = app.media.video;
+          # "video/dv" = app.media.video;
+          # "video/mp2t" = app.media.video;
+          # "video/mp4" = app.media.video;
+          # "video/mpeg" = app.media.video;
+          # "video/ogg" = app.media.video;
+          # "video/quicktime" = app.media.video;
+          # "video/vnd.mpegurl" = app.media.video;
+          # "video/vnd.rn-realvideo" = app.media.video;
+          # "video/webm" = app.media.video;
+          # "video/x-flic" = app.media.video;
+          # "video/x-flv" = app.media.video;
+          # "video/x-matroska" = app.media.video;
+          # "video/x-ms-wmv" = app.media.video;
+          # "video/x-msvideo" = app.media.video;
+          # "video/x-ogm+ogg" = app.media.video;
+          # "video/x-theora+ogg" = app.media.video;
+
+          # FIXME: kind of weird formats, not quite adapted to attribute name
+          # "application/eps" = app.media.document.pdf
+          # "application/oxps" = app.media.document.pdf
+          # "application/postscript" = app.media.document.pdf
+          # "application/x-eps" = app.media.document.pdf
+          # "image/eps" = app.media.document.pdf
+          # "image/vnd.djvu" = app.media.document.pdf
+          # "image/vnd.djvu+multipage" = app.media.document.pdf
+          # "image/x-eps" = app.media.document.pdf
+
+          # FIXME: additionally interesting, but not necessary
+          # "x-scheme-handler/discord" = [ "discord.desktop" ];
+          # "x-scheme-handler/msteams" = [ "teams.desktop" ];
+          # "x-scheme-handler/slack" = [ "slack.desktop" ];
+        };
+      };
+    };
+  };
+}
diff --git a/modules/home/zathura/default.nix b/modules/home/zathura/default.nix
index 61625420..7a47e828 100644
--- a/modules/home/zathura/default.nix
+++ b/modules/home/zathura/default.nix
@@ -17,4 +17,12 @@ in
       "statusbar-home-tilde" = true;
     };
   };
+
+  config.my.home.xdg.mime-apps = lib.mkIf cfg.enable {
+    applications.media.document = {
+      comic = [ "org.pwmt.zathura.desktop" ];
+      ebook = [ "org.pwmt.zathura.desktop" ];
+      pdf = [ "org.pwmt.zathura.desktop" ];
+    };
+  };
 }
diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index 651f3f82..3992385f 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -14,6 +14,7 @@
     ./forgejo
     ./gitea
     ./grocy
+    ./homebox
     ./indexers
     ./jellyfin
     ./komga
diff --git a/modules/nixos/services/homebox/default.nix b/modules/nixos/services/homebox/default.nix
new file mode 100644
index 00000000..d79e3314
--- /dev/null
+++ b/modules/nixos/services/homebox/default.nix
@@ -0,0 +1,42 @@
+# Home inventory made easy
+{ config, lib, ... }:
+let
+  cfg = config.my.services.homebox;
+in
+{
+  options.my.services.homebox = with lib; {
+    enable = mkEnableOption "Homebox home inventory";
+
+    port = mkOption {
+      type = types.port;
+      default = 7745;
+      example = 8080;
+      description = "Internal port for webui";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.homebox = {
+      enable = true;
+
+      settings = {
+        # FIXME: mailer?
+        HBOX_WEB_PORT = toString cfg.port;
+      };
+    };
+
+    my.services.nginx.virtualHosts = {
+      homebox = {
+        inherit (cfg) port;
+      };
+    };
+
+    my.services.backup = {
+      paths = [
+        config.services.homebox.settings.HBOX_STORAGE_DATA
+      ];
+    };
+
+    # NOTE: unfortunately homebox does not log connection failures for fail2ban
+  };
+}
diff --git a/modules/nixos/services/nginx/default.nix b/modules/nixos/services/nginx/default.nix
index cb276041..1e9e38a8 100644
--- a/modules/nixos/services/nginx/default.nix
+++ b/modules/nixos/services/nginx/default.nix
@@ -253,7 +253,6 @@ in
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
-      recommendedZstdSettings = true;
 
       virtualHosts =
         let
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 4aa0de71..e25d9cfd 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -96,15 +96,5 @@ in
     # Sonarr for shows
     (mkFullConfig "sonarr")
     (mkFail2Ban "sonarr")
-
-    # HACK: until https://github.com/NixOS/nixpkgs/issues/360592 is resolved
-    (lib.mkIf cfg.sonarr.enable {
-      nixpkgs.config.permittedInsecurePackages = [
-        "aspnetcore-runtime-6.0.36"
-        "aspnetcore-runtime-wrapped-6.0.36"
-        "dotnet-sdk-6.0.428"
-        "dotnet-sdk-wrapped-6.0.428"
-      ];
-    })
   ]);
 }
diff --git a/pkgs/lohr/default.nix b/pkgs/lohr/default.nix
index b89ccff9..aeb13b1a 100644
--- a/pkgs/lohr/default.nix
+++ b/pkgs/lohr/default.nix
@@ -10,7 +10,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-dunQgtap+XCK5LoSyOqIY/6p6HizBeiyPWNuCffwjDU=";
   };
 
-  cargoHash = "sha256-EUhyrhPe+mUgMmm4o+bxRIiSNReJRfw+/O1fPr8r7lo=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-R3/N/43+bGx6acE/rhBcrk6kS5zQu8NJ1sVvKJJkK9w=";
 
   meta = with lib; {
     description = "Git mirroring daemon";