diff --git a/flake.lock b/flake.lock
index 2f2ccbb..ec43468 100644
--- a/flake.lock
+++ b/flake.lock
@@ -11,11 +11,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1690228878,
-        "narHash": "sha256-9Xe7JV0krp4RJC9W9W9WutZVlw6BlHTFMiUP/k48LQY=",
+        "lastModified": 1689334118,
+        "narHash": "sha256-djk5AZv1yU84xlKFaVHqFWvH73U7kIRstXwUAnDJPsk=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "d8c973fd228949736dedf61b7f8cc1ece3236792",
+        "rev": "0d8c5325fc81daf00532e3e26c6752f7bcde1143",
         "type": "github"
       },
       "original": {
@@ -131,11 +131,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1690476848,
-        "narHash": "sha256-PSmzyuEbMxEn2uwwLYUN2l1psoJXb7jm/kfHD12Sq0k=",
+        "lastModified": 1689891262,
+        "narHash": "sha256-Pc4wDczbdgd6QXKJIXprgxe7L9AVDsoAkMnvm5vmpUU=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "8d243f7da13d6ee32f722a3f1afeced150b6d4da",
+        "rev": "ee5673246de0254186e469935909e821b8f4ec15",
         "type": "github"
       },
       "original": {
@@ -147,11 +147,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1690367991,
-        "narHash": "sha256-2VwOn1l8y6+cu7zjNE8MgeGJNNz1eat1HwHrINeogFA=",
+        "lastModified": 1689850295,
+        "narHash": "sha256-fUYf6WdQlhd2H+3aR8jST5dhFH1d0eE22aes8fNIfyk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c9cf0708f00fbe553319258e48ca89ff9a413703",
+        "rev": "5df4d78d54f7a34e9ea1f84a22b4fd9baebc68d0",
         "type": "github"
       },
       "original": {
@@ -163,11 +163,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1690541304,
-        "narHash": "sha256-EypV1o52D9SdHWyH3Wf6RLdDiDnKIqqXiUROrtN2KyQ=",
+        "lastModified": 1689968828,
+        "narHash": "sha256-5qA6R/cBeLsS09ZMRKzhJq74nOGWEgGYpjdbKXDnCow=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "03f02d6f7b5c284fe6ed12f86debb21429ca124c",
+        "rev": "876b9498f36a394fcf8472f62ecf6685585c0509",
         "type": "github"
       },
       "original": {
@@ -192,11 +192,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1690464206,
-        "narHash": "sha256-38V4kmOh6ikpfGiAS+Kt2H/TA2DubSqE66veP/jmB4Q=",
+        "lastModified": 1689668210,
+        "narHash": "sha256-XAATwDkaUxH958yXLs1lcEOmU6pSEIkatY3qjqk8X0E=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "9289996dcac62fd45836db7c07b87d2521eb526d",
+        "rev": "eb433bff05b285258be76513add6f6c57b441775",
         "type": "github"
       },
       "original": {
diff --git a/home/bitwarden/default.nix b/home/bitwarden/default.nix
deleted file mode 100644
index c709f7b..0000000
--- a/home/bitwarden/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.home.bitwarden;
-in
-{
-  options.my.home.bitwarden = with lib; {
-    enable = my.mkDisableOption "bitwarden configuration";
-
-    pinentry = mkOption {
-      type = types.str;
-      default = "tty";
-      example = "gtk2";
-      description = "Which pinentry interface to use";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    programs.rbw = {
-      enable = true;
-
-      settings = {
-        email = lib.my.mkMailAddress "bruno" "belanyi.fr";
-        inherit (cfg) pinentry;
-      };
-    };
-  };
-}
diff --git a/home/default.nix b/home/default.nix
index 8ba3a8d..6b6ad36 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -4,7 +4,6 @@
     ./aliases
     ./atuin
     ./bat
-    ./bitwarden
     ./bluetooth
     ./calibre
     ./comma
diff --git a/home/mail/accounts/default.nix b/home/mail/accounts/default.nix
index e7663d8..f513605 100644
--- a/home/mail/accounts/default.nix
+++ b/home/mail/accounts/default.nix
@@ -8,7 +8,7 @@ let
     realName = lib.mkDefault "Bruno BELANYI";
     userName = lib.mkDefault (mkMailAddress address domain);
     passwordCommand =
-      lib.mkDefault [ (lib.getExe pkgs.ambroisie.rbw-pass) "Mail" passName ];
+      lib.mkDefault [ "${pkgs.ambroisie.bw-pass}/bin/bw-pass" "Mail" passName ];
 
     address = mkMailAddress address domain;
     aliases = builtins.map (lib.flip mkMailAddress domain) aliases;
diff --git a/home/mail/himalaya/default.nix b/home/mail/himalaya/default.nix
index 849a415..c2d3b05 100644
--- a/home/mail/himalaya/default.nix
+++ b/home/mail/himalaya/default.nix
@@ -9,7 +9,7 @@ in
     settings = {
       notify-cmd =
         let
-          notify-send = lib.getExe pkgs.libnotify;
+          notify-send = "${pkgs.libnotify}/bin/notify-send";
         in
         pkgs.writeScript "mail-notifier" ''
           SENDER="$1"
diff --git a/home/wm/default.nix b/home/wm/default.nix
index 6a615e5..fb9ecee 100644
--- a/home/wm/default.nix
+++ b/home/wm/default.nix
@@ -47,8 +47,8 @@ in
 
       command = mkOption {
         type = types.str;
-        default = "${lib.getExe pkgs.i3lock} -n -c 000000";
-        example = "\${lib.getExe pkgs.i3lock} -n -i lock.png";
+        default = "${pkgs.i3lock}/bin/i3lock -n -c 000000";
+        example = "\${pkgs.i3lock}/bin/i3lock -n -i lock.png";
         description = "Locker command to run";
       };
 
diff --git a/home/wm/i3/default.nix b/home/wm/i3/default.nix
index d1dbe2c..c7a728a 100644
--- a/home/wm/i3/default.nix
+++ b/home/wm/i3/default.nix
@@ -27,13 +27,13 @@ let
   genMovementBindings = f: addVimKeyBindings (lib.my.genAttrs' movementKeys f);
 
   # Used in multiple scripts to show messages through keybindings
-  notify-send = lib.getExe pkgs.libnotify;
+  notify-send = "${pkgs.libnotify}/bin/notify-send";
 
   # Screen backlight management
-  changeBacklight = lib.getExe pkgs.ambroisie.change-backlight;
+  changeBacklight = "${pkgs.ambroisie.change-backlight}/bin/change-backlight";
 
   # Audio and volume management
-  changeAudio = lib.getExe pkgs.ambroisie.change-audio;
+  changeAudio = "${pkgs.ambroisie.change-audio}/bin/change-audio";
 
   # Lock management
   toggleXautolock =
@@ -61,8 +61,8 @@ in
       ambroisie.dragger # drag-and-drop from the CLI
       ambroisie.i3-get-window-criteria # little helper for i3 configuration
       arandr # Used by a mapping
+      pamixer # Used by a mapping
       playerctl # Used by a mapping
-      xdotool # Used by 'rofi-rbw', in a mapping
     ];
 
     xsession.windowManager.i3 = {
@@ -189,7 +189,6 @@ in
             "${modifier}+d" = "exec rofi -show drun -disable-history";
             "${modifier}+Shift+d" = "exec rofi -show run -disable-history";
             "${modifier}+p" = "exec --no-startup-id flameshot gui";
-            "${modifier}+Ctrl+p" = "exec ${lib.getExe pkgs.rofi-rbw}";
             "${modifier}+Shift+p" = "exec rofi -show emoji";
             "${modifier}+b" =
               let
diff --git a/home/wm/screen-lock/default.nix b/home/wm/screen-lock/default.nix
index 3b2ead6..95060b8 100644
--- a/home/wm/screen-lock/default.nix
+++ b/home/wm/screen-lock/default.nix
@@ -5,7 +5,7 @@ let
   notficationCmd =
     let
       duration = toString (cfg.notify.delay * 1000);
-      notifyCmd = "${lib.getExe pkgs.libnotify} -u critical -t ${duration}";
+      notifyCmd = "${pkgs.libnotify}/bin/notify-send -u critical -t ${duration}";
     in
     # Needs to be surrounded by quotes for systemd to launch it correctly
     ''"${notifyCmd} -- 'Locking in ${toString cfg.notify.delay} seconds'"'';
diff --git a/hosts/nixos/aramis/home.nix b/hosts/nixos/aramis/home.nix
index 66a0892..6d66384 100644
--- a/hosts/nixos/aramis/home.nix
+++ b/hosts/nixos/aramis/home.nix
@@ -1,8 +1,6 @@
 { pkgs, ... }:
 {
   my.home = {
-    # Use graphical pinentry
-    bitwarden.pinentry = "gtk2";
     # Ebook library
     calibre.enable = true;
     # Some amount of social life
diff --git a/modules/services/drone/runner-docker/default.nix b/modules/services/drone/runner-docker/default.nix
index e53c608..6ccb5fe 100644
--- a/modules/services/drone/runner-docker/default.nix
+++ b/modules/services/drone/runner-docker/default.nix
@@ -2,6 +2,7 @@
 let
   cfg = config.my.services.drone;
   hasRunner = (name: builtins.elem name cfg.runners);
+  dockerPkg = pkgs.drone-runner-docker;
 in
 {
   config = lib.mkIf (cfg.enable && hasRunner "docker") {
@@ -24,7 +25,7 @@ in
         EnvironmentFile = [
           cfg.sharedSecretFile
         ];
-        ExecStart = lib.getExe pkgs.drone-runner-docker;
+        ExecStart = "${dockerPkg}/bin/drone-runner-docker";
         User = "drone-runner-docker";
         Group = "drone-runner-docker";
       };
diff --git a/modules/services/drone/runner-exec/default.nix b/modules/services/drone/runner-exec/default.nix
index a9bb563..f0dddb9 100644
--- a/modules/services/drone/runner-exec/default.nix
+++ b/modules/services/drone/runner-exec/default.nix
@@ -2,6 +2,7 @@
 let
   cfg = config.my.services.drone;
   hasRunner = (name: builtins.elem name cfg.runners);
+  execPkg = pkgs.drone-runner-exec;
 in
 {
   config = lib.mkIf (cfg.enable && hasRunner "exec") {
@@ -52,7 +53,7 @@ in
         EnvironmentFile = [
           cfg.sharedSecretFile
         ];
-        ExecStart = lib.getExe pkgs.drone-runner-exec;
+        ExecStart = "${execPkg}/bin/drone-runner-exec";
         User = "drone-runner-exec";
         Group = "drone-runner-exec";
       };
diff --git a/modules/services/flood/default.nix b/modules/services/flood/default.nix
index ff5d941..ae8e219 100644
--- a/modules/services/flood/default.nix
+++ b/modules/services/flood/default.nix
@@ -30,7 +30,7 @@ in
 
       serviceConfig = {
         ExecStart = lib.concatStringsSep " " [
-          (lib.getExe pkgs.flood)
+          "${pkgs.flood}/bin/flood"
           "--port ${builtins.toString cfg.port}"
           "--rundir /var/lib/${cfg.stateDir}"
         ];
diff --git a/modules/services/lohr/default.nix b/modules/services/lohr/default.nix
index 245567c..f43bc40 100644
--- a/modules/services/lohr/default.nix
+++ b/modules/services/lohr/default.nix
@@ -4,6 +4,8 @@ let
   cfg = config.my.services.lohr;
   settingsFormat = pkgs.formats.yaml { };
 
+  lohrPkg = pkgs.ambroisie.lohr;
+
   lohrStateDirectory = "lohr";
   lohrHome = "/var/lib/lohr/";
 in
@@ -78,7 +80,7 @@ in
           let
             configFile = settingsFormat.generate "lohr-config.yaml" cfg.setting;
           in
-          "${lib.getExe pkgs.ambroisie.lohr} --config ${configFile}";
+          "${lohrPkg}/bin/lohr --config ${configFile}";
         StateDirectory = lohrStateDirectory;
         WorkingDirectory = lohrHome;
         User = "lohr";
diff --git a/modules/services/nginx/sso/default.nix b/modules/services/nginx/sso/default.nix
index cbb35d5..13292ec 100644
--- a/modules/services/nginx/sso/default.nix
+++ b/modules/services/nginx/sso/default.nix
@@ -60,7 +60,7 @@ in
         WorkingDirectory = "/var/lib/nginx-sso";
         # The files to be merged might not have the correct permissions
         ExecStartPre = ''+${pkgs.writeScript "merge-nginx-sso-config" ''
-          #!${lib.getExe pkgs.bash}
+          #!${pkgs.bash}/bin/bash
           rm -f '${confPath}'
           ${utils.genJqSecretsReplacementSnippet cfg.configuration confPath}
 
@@ -70,7 +70,7 @@ in
         ''
         }'';
         ExecStart = lib.mkForce ''
-          ${lib.getExe pkg} \
+          ${pkg}/bin/nginx-sso \
             --config ${confPath} \
             --frontend-dir ${pkg}/share/frontend
         '';
diff --git a/modules/services/woodpecker/agent-exec/default.nix b/modules/services/woodpecker/agent-exec/default.nix
index 68510d7..d7adc4e 100644
--- a/modules/services/woodpecker/agent-exec/default.nix
+++ b/modules/services/woodpecker/agent-exec/default.nix
@@ -33,7 +33,7 @@ in
       restartIfChanged = false;
 
       path = with pkgs; [
-        woodpecker-plugin-git
+        ambroisie.woodpecker-plugin-git
         bash
         coreutils
         git
diff --git a/pkgs/default.nix b/pkgs/default.nix
index ed27dc9..4a84b9c 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -26,8 +26,6 @@ pkgs.lib.makeScope pkgs.newScope (pkgs: {
 
   osc52 = pkgs.callPackage ./osc52 { };
 
-  rbw-pass = pkgs.callPackage ./rbw-pass { };
-
   unbound-zones-adblock = pkgs.callPackage ./unbound-zones-adblock { };
 
   unified-hosts-lists = pkgs.callPackage ./unified-hosts-lists { };
@@ -44,5 +42,7 @@ pkgs.lib.makeScope pkgs.newScope (pkgs: {
 
   woodpecker-frontend = pkgs.callPackage ./woodpecker/frontend.nix { };
 
+  woodpecker-plugin-git = pkgs.callPackage ./woodpecker-plugin-git { };
+
   woodpecker-server = pkgs.callPackage ./woodpecker/server.nix { };
 })
diff --git a/pkgs/ff2mpv-go/default.nix b/pkgs/ff2mpv-go/default.nix
index fdd9201..dcdb7f3 100644
--- a/pkgs/ff2mpv-go/default.nix
+++ b/pkgs/ff2mpv-go/default.nix
@@ -12,7 +12,7 @@ buildGoModule rec {
   vendorHash = null;
 
   postPatch = ''
-    sed -i -e 's,"mpv","${lib.getExe mpv}",' ff2mpv.go
+    sed -i -e 's,"mpv","${mpv}/bin/mpv",' ff2mpv.go
   '';
 
   postInstall = ''
diff --git a/pkgs/rbw-pass/default.nix b/pkgs/rbw-pass/default.nix
deleted file mode 100644
index 7f0286b..0000000
--- a/pkgs/rbw-pass/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ lib, coreutils, makeWrapper, rbw, rofi, stdenvNoCC }:
-stdenvNoCC.mkDerivation rec {
-  pname = "rbw-pass";
-  version = "0.1.0";
-
-  src = ./rbw-pass;
-
-  nativeBuildInputs = [
-    makeWrapper
-  ];
-
-  dontUnpack = true;
-
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp $src $out/bin/${pname}
-    chmod a+x $out/bin/${pname}
-  '';
-
-  wrapperPath = lib.makeBinPath [
-    rbw
-    coreutils
-    rofi
-  ];
-
-  fixupPhase = ''
-    patchShebangs $out/bin/${pname}
-    wrapProgram $out/bin/${pname} --prefix PATH : "${wrapperPath}"
-  '';
-
-  meta = with lib; {
-    description = "A simple script to query a password from rbw";
-    homepage = "https://git.belanyi.fr/ambroisie/nix-config";
-    license = with licenses; [ mit ];
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ ambroisie ];
-  };
-}
diff --git a/pkgs/rbw-pass/rbw-pass b/pkgs/rbw-pass/rbw-pass
deleted file mode 100755
index 90e916c..0000000
--- a/pkgs/rbw-pass/rbw-pass
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/usr/bin/env bash
-
-usage() {
-    printf '%s\n' "Usage: bw-pass [directory name] <account name>" >&2
-}
-
-error_out() {
-    printf '%s\n' "$1" >&2
-    rofi -dmenu -no-fixed-num-lines -p "$1"
-    exit 1
-}
-
-ensure_logged_in() {
-    rbw login
-}
-
-query_password() {
-    # Either use with `query_password <directory> <account name>
-    # Or `query_password <account name>` when the account has no directory
-
-    local FOLDER_ARGS=()
-    local PASSWORD
-
-    # FIXME: no way to enforce filering by "no folder"
-    if [ $# -eq 2 ]; then
-        FOLDER_ARGS+=(--folder "$1")
-        shift
-    fi
-    PASSWORD="$(rbw get "${FOLDER_ARGS[@]}" "$1")"
-
-    if [ -z "$PASSWORD" ]; then
-        error_out "Did not find password for '$1'"
-    fi
-    printf '%s\n' "$PASSWORD"
-}
-
-if [ $# -lt 1 ] || [ $# -gt 2 ]; then
-    usage
-    exit 1
-fi
-
-ensure_logged_in
-query_password "$@"
diff --git a/pkgs/unbound-zones-adblock/default.nix b/pkgs/unbound-zones-adblock/default.nix
index f8d89b1..824a7d6 100644
--- a/pkgs/unbound-zones-adblock/default.nix
+++ b/pkgs/unbound-zones-adblock/default.nix
@@ -10,7 +10,7 @@ stdenvNoCC.mkDerivation {
   installPhase =
     let
       gawkCmd = lib.concatStringsSep " " [
-        (lib.getExe gawk)
+        ''${gawk}/bin/awk''
         '''{sub(/\r$/,"")}''
         ''{sub(/^127\.0\.0\.1/,"0.0.0.0")}''
         ''BEGIN { OFS = "" }''
diff --git a/pkgs/woodpecker-plugin-git/default.nix b/pkgs/woodpecker-plugin-git/default.nix
new file mode 100644
index 0000000..8411216
--- /dev/null
+++ b/pkgs/woodpecker-plugin-git/default.nix
@@ -0,0 +1,37 @@
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:
+buildGoModule rec {
+  pname = "woodpecker-plugin-git";
+  version = "2.0.3";
+
+  src = fetchFromGitHub {
+    owner = "woodpecker-ci";
+    repo = "plugin-git";
+    rev = "v${version}";
+    hash = "sha256-KU/A3V7KS8R1nAZoJJwkDc9C8y3t148kUzGnkeYtFjs=";
+  };
+
+  vendorHash = "sha256-63Ly/9yIJu2K/DwOfGs9pYU3fokbs2senZkl3MJ1UIY=";
+
+  patches = [
+    # https://github.com/woodpecker-ci/plugin-git/pull/67
+    (fetchpatch {
+      name = "do-not-overwrite-command-env.patch";
+      url = "https://github.com/woodpecker-ci/plugin-git/commit/970cc63a9b212872deac565c6292feb3f4cf4b51.patch";
+      hash = "sha256-izu0X7j+OyNbrOkksf+7VF3KiKVylVv2o00xaX/b1Rg=";
+    })
+  ];
+
+  CGO_ENABLED = "0";
+
+  # Checks fail because they require network access.
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Woodpecker plugin for cloning Git repositories.";
+    homepage = "https://woodpecker-ci.org/";
+    license = licenses.asl20;
+    mainProgram = "pluging-git";
+    maintainers = with maintainers; [ thehedgeh0g ];
+    platforms = platforms.all;
+  };
+}