diff --git a/flake.lock b/flake.lock
index 8884f79..b7ca708 100644
--- a/flake.lock
+++ b/flake.lock
@@ -73,11 +73,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736143030,
-        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
+        "lastModified": 1738453229,
+        "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
+        "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
         "type": "github"
       },
       "original": {
@@ -136,11 +136,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737968762,
-        "narHash": "sha256-xiPARGKwocaMtv+U/rgi+h2g56CZZEmrcl7ldRaslq8=",
+        "lastModified": 1739314552,
+        "narHash": "sha256-ggVf2BclyIW3jexc/uvgsgJH4e2cuG6Nyg54NeXgbFI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e1ae908bcc30af792b0bb0a52e53b03d2577255e",
+        "rev": "83bd3a26ac0526ae04fa74df46738bb44b89dcdd",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1737885589,
-        "narHash": "sha256-Zf0hSrtzaM1DEz8//+Xs51k/wdSajticVrATqDrfQjg=",
+        "lastModified": 1739214665,
+        "narHash": "sha256-26L8VAu3/1YRxS8MHgBOyOM8xALdo6N0I04PgorE7UM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "852ff1d9e153d8875a83602e03fdef8a63f0ecf8",
+        "rev": "64e75cd44acf21c7933d61d7721e812eac1b5a0a",
         "type": "github"
       },
       "original": {
@@ -177,11 +177,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1738059992,
-        "narHash": "sha256-VeNLLucQTlED2cqD3uofh968tm7u7UgwCdY5+jo/BSc=",
+        "lastModified": 1739229047,
+        "narHash": "sha256-sSTgA86wdk8d544c2+gzrfvVPHQF4mbsomvLOW2thn0=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "c46c836963685acbd2430439f859b60f230b3643",
+        "rev": "8348d89f30598a73fee7efb4b5d34c3de201e71b",
         "type": "github"
       },
       "original": {
diff --git a/modules/home/mail/accounts/default.nix b/modules/home/mail/accounts/default.nix
index 202b9bc..5216ad5 100644
--- a/modules/home/mail/accounts/default.nix
+++ b/modules/home/mail/accounts/default.nix
@@ -26,20 +26,7 @@ let
   };
 
   migaduConfig = {
-    imap = {
-      host = "imap.migadu.com";
-      port = 993;
-      tls = {
-        enable = true;
-      };
-    };
-    smtp = {
-      host = "smtp.migadu.com";
-      port = 465;
-      tls = {
-        enable = true;
-      };
-    };
+    flavor = "migadu.com";
   };
 
   gmailConfig = {
diff --git a/modules/home/secrets/github/token.age b/modules/home/secrets/github/token.age
index 1d36ccd..3e8bb5a 100644
Binary files a/modules/home/secrets/github/token.age and b/modules/home/secrets/github/token.age differ
diff --git a/modules/home/secrets/secrets.nix b/modules/home/secrets/secrets.nix
index f474342..27cdb4e 100644
--- a/modules/home/secrets/secrets.nix
+++ b/modules/home/secrets/secrets.nix
@@ -1,6 +1,6 @@
 # Common secrets
 let
-  keys = import ../../keys;
+  keys = import ../../../keys;
 
   all = builtins.attrValues keys.users;
 in
diff --git a/modules/nixos/services/default.nix b/modules/nixos/services/default.nix
index 651f3f8..3992385 100644
--- a/modules/nixos/services/default.nix
+++ b/modules/nixos/services/default.nix
@@ -14,6 +14,7 @@
     ./forgejo
     ./gitea
     ./grocy
+    ./homebox
     ./indexers
     ./jellyfin
     ./komga
diff --git a/modules/nixos/services/homebox/default.nix b/modules/nixos/services/homebox/default.nix
new file mode 100644
index 0000000..d79e331
--- /dev/null
+++ b/modules/nixos/services/homebox/default.nix
@@ -0,0 +1,42 @@
+# Home inventory made easy
+{ config, lib, ... }:
+let
+  cfg = config.my.services.homebox;
+in
+{
+  options.my.services.homebox = with lib; {
+    enable = mkEnableOption "Homebox home inventory";
+
+    port = mkOption {
+      type = types.port;
+      default = 7745;
+      example = 8080;
+      description = "Internal port for webui";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.homebox = {
+      enable = true;
+
+      settings = {
+        # FIXME: mailer?
+        HBOX_WEB_PORT = toString cfg.port;
+      };
+    };
+
+    my.services.nginx.virtualHosts = {
+      homebox = {
+        inherit (cfg) port;
+      };
+    };
+
+    my.services.backup = {
+      paths = [
+        config.services.homebox.settings.HBOX_STORAGE_DATA
+      ];
+    };
+
+    # NOTE: unfortunately homebox does not log connection failures for fail2ban
+  };
+}
diff --git a/modules/nixos/services/nginx/default.nix b/modules/nixos/services/nginx/default.nix
index cb27604..1e9e38a 100644
--- a/modules/nixos/services/nginx/default.nix
+++ b/modules/nixos/services/nginx/default.nix
@@ -253,7 +253,6 @@ in
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedTlsSettings = true;
-      recommendedZstdSettings = true;
 
       virtualHosts =
         let
diff --git a/modules/nixos/services/servarr/default.nix b/modules/nixos/services/servarr/default.nix
index 4aa0de7..e25d9cf 100644
--- a/modules/nixos/services/servarr/default.nix
+++ b/modules/nixos/services/servarr/default.nix
@@ -96,15 +96,5 @@ in
     # Sonarr for shows
     (mkFullConfig "sonarr")
     (mkFail2Ban "sonarr")
-
-    # HACK: until https://github.com/NixOS/nixpkgs/issues/360592 is resolved
-    (lib.mkIf cfg.sonarr.enable {
-      nixpkgs.config.permittedInsecurePackages = [
-        "aspnetcore-runtime-6.0.36"
-        "aspnetcore-runtime-wrapped-6.0.36"
-        "dotnet-sdk-6.0.428"
-        "dotnet-sdk-wrapped-6.0.428"
-      ];
-    })
   ]);
 }
diff --git a/pkgs/lohr/default.nix b/pkgs/lohr/default.nix
index b89ccff..aeb13b1 100644
--- a/pkgs/lohr/default.nix
+++ b/pkgs/lohr/default.nix
@@ -10,7 +10,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-dunQgtap+XCK5LoSyOqIY/6p6HizBeiyPWNuCffwjDU=";
   };
 
-  cargoHash = "sha256-EUhyrhPe+mUgMmm4o+bxRIiSNReJRfw+/O1fPr8r7lo=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-R3/N/43+bGx6acE/rhBcrk6kS5zQu8NJ1sVvKJJkK9w=";
 
   meta = with lib; {
     description = "Git mirroring daemon";