diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 6b979f30..25d5a28b 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -2,3 +2,5 @@
 62a605b7c5ce7f9334dd946ef3de8fedfb4cdfaa
 # Enabled strict formatting with nixfmt
 ba4f3ffb1956acd35a2d4a71a8775d2f520497d1
+# Switched to `nix-ast-lint`
+8581934d6669224eed540123af826deec67b400c
diff --git a/checks/default.nix b/checks/default.nix
index 14c3e99f..80cbba26 100644
--- a/checks/default.nix
+++ b/checks/default.nix
@@ -11,19 +11,11 @@ in
 
     checkInputs = lib.attrValues {
       inherit (pkgs) deadnix nixfmt-rfc-style;
-
-      statix = pkgs.statix.overrideAttrs (old: {
-        patches = old.patches ++ [
-          (pkgs.fetchpatch {
-            url = "https://github.com/oppiliappan/statix/commit/925dec39bb705acbbe77178b4d658fe1b752abbb.patch";
-            hash = "sha256-0wacO6wuYJ4ufN9PGucRVJucFdFFNF+NoHYIrLXsCWs=";
-          })
-        ];
-      });
+      inherit (flake-inputs.nix-ast-lint.packages.x86_64-linux) nix-ast-lint;
     };
 
     script = ''
-      statix check **/*.nix
+      nix-ast-lint --error --off=empty-let-in
       deadnix --fail **/*.nix
       nixfmt --check --strict **/*.nix
     '';
diff --git a/flake.lock b/flake.lock
index 03019b89..593e97ff 100644
--- a/flake.lock
+++ b/flake.lock
@@ -162,6 +162,24 @@
         "type": "github"
       }
     },
+    "nix-ast-lint": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1768472416,
+        "narHash": "sha256-SWAY3QviGbp4MN1/RlQOeh3VfSD2/8o8wwvISHXe2oo=",
+        "rev": "e5acfd1d234fcd6b6997e25dc9d830d023a2d025",
+        "type": "tarball",
+        "url": "https://codeberg.org/api/v1/repos/tlater/nix-ast-lint/archive/e5acfd1d234fcd6b6997e25dc9d830d023a2d025.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://codeberg.org/tlater/nix-ast-lint/archive/main.tar.gz"
+      }
+    },
     "nix-flatpak": {
       "locked": {
         "lastModified": 1767983141,
@@ -282,6 +300,7 @@
         "famedly-nixos": "famedly-nixos",
         "flint": "flint",
         "home-manager": "home-manager",
+        "nix-ast-lint": "nix-ast-lint",
         "nix-flatpak": "nix-flatpak",
         "nix-gaming": "nix-gaming",
         "nix-webapps": "nix-webapps",
diff --git a/flake.nix b/flake.nix
index d46ab365..4c08632c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -39,6 +39,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    nix-ast-lint = {
+      url = "https://codeberg.org/tlater/nix-ast-lint/archive/main.tar.gz";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     flint = {
       url = "github:NotAShelf/flint";
       inputs.nixpkgs.follows = "nixpkgs";
diff --git a/home-config/desktop/mime.nix b/home-config/desktop/mime.nix
index 6f58de56..e18996bb 100644
--- a/home-config/desktop/mime.nix
+++ b/home-config/desktop/mime.nix
@@ -1,96 +1,98 @@
 {
-  xdg.mime.enable = true;
-  xdg.mimeApps = {
-    enable = true;
-    defaultApplications = {
-      # Set feh as the default for all image types
-      "image/bmp" = "feh.desktop";
-      "image/g3fax" = "feh.desktop";
-      "image/gif" = "feh.desktop";
-      "image/x-fits" = "feh.desktop";
-      "image/x-pcx" = "feh.desktop";
-      "image/x-portable-anymap" = "feh.desktop";
-      "image/x-portable-bitmap" = "feh.desktop";
-      "image/x-portable-graymap" = "feh.desktop";
-      "image/x-portable-pixmap" = "feh.desktop";
-      "image/x-psd" = "feh.desktop";
-      "image/x-sgi" = "feh.desktop";
-      "image/x-tga" = "feh.desktop";
-      "image/x-xbitmap" = "feh.desktop";
-      "image/x-xwindowdump" = "feh.desktop";
-      "image/x-xcf" = "feh.desktop";
-      "image/x-compressed-xcf" = "feh.desktop";
-      "image/tiff" = "feh.desktop";
-      "image/jpeg" = "feh.desktop";
-      "image/x-psp" = "feh.desktop";
-      "application/postscript" = "feh.desktop";
-      "image/png" = "feh.desktop";
-      "image/x-icon" = "feh.desktop";
-      "image/x-xpixmap" = "feh.desktop";
-      "image/x-exr" = "feh.desktop";
-      "image/x-webp" = "feh.desktop";
-      "image/heif" = "feh.desktop";
-      "image/heic" = "feh.desktop";
-      "image/svg+xml" = "feh.desktop";
-      "application/pdf" = "feh.desktop";
-      "image/x-wmf" = "feh.desktop";
-      "image/jp2" = "feh.desktop";
-      "image/x-xcursor" = "feh.desktop";
+  xdg = {
+    mime.enable = true;
+    mimeApps = {
+      enable = true;
+      defaultApplications = {
+        # Set feh as the default for all image types
+        "image/bmp" = "feh.desktop";
+        "image/g3fax" = "feh.desktop";
+        "image/gif" = "feh.desktop";
+        "image/x-fits" = "feh.desktop";
+        "image/x-pcx" = "feh.desktop";
+        "image/x-portable-anymap" = "feh.desktop";
+        "image/x-portable-bitmap" = "feh.desktop";
+        "image/x-portable-graymap" = "feh.desktop";
+        "image/x-portable-pixmap" = "feh.desktop";
+        "image/x-psd" = "feh.desktop";
+        "image/x-sgi" = "feh.desktop";
+        "image/x-tga" = "feh.desktop";
+        "image/x-xbitmap" = "feh.desktop";
+        "image/x-xwindowdump" = "feh.desktop";
+        "image/x-xcf" = "feh.desktop";
+        "image/x-compressed-xcf" = "feh.desktop";
+        "image/tiff" = "feh.desktop";
+        "image/jpeg" = "feh.desktop";
+        "image/x-psp" = "feh.desktop";
+        "application/postscript" = "feh.desktop";
+        "image/png" = "feh.desktop";
+        "image/x-icon" = "feh.desktop";
+        "image/x-xpixmap" = "feh.desktop";
+        "image/x-exr" = "feh.desktop";
+        "image/x-webp" = "feh.desktop";
+        "image/heif" = "feh.desktop";
+        "image/heic" = "feh.desktop";
+        "image/svg+xml" = "feh.desktop";
+        "application/pdf" = "feh.desktop";
+        "image/x-wmf" = "feh.desktop";
+        "image/jp2" = "feh.desktop";
+        "image/x-xcursor" = "feh.desktop";
 
-      # Set emacsclient as the default for all text types
-      "application/rtf" = "emacsclient.desktop";
-      "application/vnd.mozilla.xul+xml" = "emacsclient.desktop";
-      "application/xhtml+xml" = "emacsclient.desktop";
-      "application/xml" = "emacsclient.desktop";
-      "application/x-shellscript" = "emacsclient.desktop";
-      "application/x-wine-extension-ini" = "emacsclient.desktop";
-      "application/zip" = "emacsclient.desktop";
-      "text/english" = "emacsclient.desktop";
-      "text/html" = "emacsclient.desktop";
-      "text/markdown" = "emacsclient.desktop";
-      "text/plain" = "emacsclient.desktop";
-      "text/x-log" = "emacsclient.desktop";
-      "text/x-makefile" = "emacsclient.desktop";
-      "text/x-c++hdr" = "emacsclient.desktop";
-      "text/x-c++src" = "emacsclient.desktop";
-      "text/x-chdr" = "emacsclient.desktop";
-      "text/x-csrc" = "emacsclient.desktop";
-      "text/x-java" = "emacsclient.desktop";
-      "text/x-moc" = "emacsclient.desktop";
-      "text/x-pascal" = "emacsclient.desktop";
-      "text/x-tcl" = "emacsclient.desktop";
-      "text/x-tex" = "emacsclient.desktop";
-      "text/xml" = "emacsclient.desktop";
-      "text/x-c" = "emacsclient.desktop";
-      "text/x-c++" = "emacsclient.desktop";
+        # Set emacsclient as the default for all text types
+        "application/rtf" = "emacsclient.desktop";
+        "application/vnd.mozilla.xul+xml" = "emacsclient.desktop";
+        "application/xhtml+xml" = "emacsclient.desktop";
+        "application/xml" = "emacsclient.desktop";
+        "application/x-shellscript" = "emacsclient.desktop";
+        "application/x-wine-extension-ini" = "emacsclient.desktop";
+        "application/zip" = "emacsclient.desktop";
+        "text/english" = "emacsclient.desktop";
+        "text/html" = "emacsclient.desktop";
+        "text/markdown" = "emacsclient.desktop";
+        "text/plain" = "emacsclient.desktop";
+        "text/x-log" = "emacsclient.desktop";
+        "text/x-makefile" = "emacsclient.desktop";
+        "text/x-c++hdr" = "emacsclient.desktop";
+        "text/x-c++src" = "emacsclient.desktop";
+        "text/x-chdr" = "emacsclient.desktop";
+        "text/x-csrc" = "emacsclient.desktop";
+        "text/x-java" = "emacsclient.desktop";
+        "text/x-moc" = "emacsclient.desktop";
+        "text/x-pascal" = "emacsclient.desktop";
+        "text/x-tcl" = "emacsclient.desktop";
+        "text/x-tex" = "emacsclient.desktop";
+        "text/xml" = "emacsclient.desktop";
+        "text/x-c" = "emacsclient.desktop";
+        "text/x-c++" = "emacsclient.desktop";
 
-      # Use firefox for http/s
-      "x-scheme-handler/http" = "librewolf.desktop";
-      "x-scheme-handler/https" = "librewolf.desktop";
-    };
+        # Use firefox for http/s
+        "x-scheme-handler/http" = "librewolf.desktop";
+        "x-scheme-handler/https" = "librewolf.desktop";
+      };
 
-    # xdg-open ignores these, but let's unregister all the wine cruft
-    # anyway
-    associations = {
-      removed = {
-        "application/vnd.ms-htmlhelp" = "wine-extension-chm.desktop";
-        "image/gif" = [ "wine-extension-gif.desktop" ];
-        "application/winhlp" = "wine-extension-hlp.desktop";
-        "application/x-wine-extension-ini" = "wine-extension-ini.desktop";
-        "image/jpeg" = [
-          "wine-extension-jfif.desktop"
-          "wine-extension-jpe.desktop"
-        ];
-        "application/x-wine-extension-msp" = "wine-extension-msp.desktop";
-        "application/pdf" = [ "wine-extension-pdf.desktop" ];
-        "image/png" = [ "wine-extension-png.desktop" ];
-        "application/rtf" = "wine-extension-rtf.desktop";
-        "text/plain" = "wine-extension-txt.desktop";
-        "application/x-mswinurl" = "wine-extension-url.desktop";
-        "application/x-wine-extension-vbs" = "wine-extension-vbs.desktop";
-        "application/x-mswrite" = "wine-extension-wri.desktop";
-        "application/xml" = "wine-extension-xml.desktop";
-        "text/html" = [ "wine-extension-htm.desktop" ];
+      # xdg-open ignores these, but let's unregister all the wine cruft
+      # anyway
+      associations = {
+        removed = {
+          "application/vnd.ms-htmlhelp" = "wine-extension-chm.desktop";
+          "image/gif" = [ "wine-extension-gif.desktop" ];
+          "application/winhlp" = "wine-extension-hlp.desktop";
+          "application/x-wine-extension-ini" = "wine-extension-ini.desktop";
+          "image/jpeg" = [
+            "wine-extension-jfif.desktop"
+            "wine-extension-jpe.desktop"
+          ];
+          "application/x-wine-extension-msp" = "wine-extension-msp.desktop";
+          "application/pdf" = [ "wine-extension-pdf.desktop" ];
+          "image/png" = [ "wine-extension-png.desktop" ];
+          "application/rtf" = "wine-extension-rtf.desktop";
+          "text/plain" = "wine-extension-txt.desktop";
+          "application/x-mswinurl" = "wine-extension-url.desktop";
+          "application/x-wine-extension-vbs" = "wine-extension-vbs.desktop";
+          "application/x-mswrite" = "wine-extension-wri.desktop";
+          "application/xml" = "wine-extension-xml.desktop";
+          "text/html" = [ "wine-extension-htm.desktop" ];
+        };
       };
     };
   };
diff --git a/home-config/shell/default.nix b/home-config/shell/default.nix
index e436b35e..42678b43 100644
--- a/home-config/shell/default.nix
+++ b/home-config/shell/default.nix
@@ -2,9 +2,9 @@
 {
   imports = [ ./nushell.nix ];
 
-  xdg = {
-    configFile."zellij".source = ../dotfiles/zellij;
-    configFile."dashrc".source = ../dotfiles/dashrc;
+  xdg.configFile = {
+    "zellij".source = ../dotfiles/zellij;
+    "dashrc".source = ../dotfiles/dashrc;
   };
 
   home = {
diff --git a/home-config/xdg-settings.nix b/home-config/xdg-settings.nix
index f851a444..ef510864 100644
--- a/home-config/xdg-settings.nix
+++ b/home-config/xdg-settings.nix
@@ -10,14 +10,6 @@ let
   inherit (config) xdg;
 in
 {
-  home = {
-    activation.xdg-dir-prep = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-      $DRY_RUN_CMD mkdir $VERBOSE_ARG -p '${xdg.cacheHome}/less'
-    '';
-
-    preferXdgDirectories = true;
-  };
-
   xdg.userDirs = {
     enable = true;
     # Work around firefox creating a "Desktop" directory
@@ -34,48 +26,56 @@ in
     };
   };
 
-  home.sessionVariables = {
-    _JAVA_OPTIONS = concatStringsSep " " [
-      "-Djava.util.prefs.userRoot='${xdg.configHome}'/java"
-      "-Djavafx.cachedir='${xdg.cacheHome}/openjfx'"
-      "-Dorg.lwjgl.glfw.libname='${pkgs.glfw3-minecraft}/lib/libglfw.so'"
-    ];
-    LESSKEY = "${xdg.cacheHome}/less/key";
-    LESSHISTFILE = "${xdg.cacheHome}/less/history";
-    PYLINTHOME = "${xdg.cacheHome}/pylint";
-    CARGO_HOME = "${xdg.cacheHome}/cargo";
-    RUSTUP_HOME = "${xdg.dataHome}/rustup";
-    XCOMPOSECACHE = "${xdg.cacheHome}/X11/xcompose";
-    XCOMPOSEFILE = "${xdg.configHome}/X11/xcompose";
-    MAILCAPS = "${xdg.configHome}/mailcap";
-    IPYTHONDIR = "${xdg.dataHome}/ipython";
-    JUPYTER_CONFIG_DIR = "${xdg.dataHome}/ipython";
-    HISTFILE = "${xdg.dataHome}/histfile";
-    RLWRAP_HOME = "${xdg.dataHome}/rlwrap";
-    CUDA_CACHE_PATH = "${xdg.dataHome}/cuda";
+  home = {
+    activation.xdg-dir-prep = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+      $DRY_RUN_CMD mkdir $VERBOSE_ARG -p '${xdg.cacheHome}/less'
+    '';
+
+    preferXdgDirectories = true;
 
-    # See, this is exactly why things should follow the spec. I have
-    # no intention of using gradle ever, but occasionally I need to
-    # build software that uses it.
-    #
-    # Now I need to deal with gradle puking directories all over my
-    # file system, or have a permanent configuration option here for
-    # software I don't even use.
-    #
-    # Grmbl.
-    GRADLE_USER_HOME = "${xdg.cacheHome}/gradle";
+    sessionVariables = {
+      _JAVA_OPTIONS = concatStringsSep " " [
+        "-Djava.util.prefs.userRoot='${xdg.configHome}'/java"
+        "-Djavafx.cachedir='${xdg.cacheHome}/openjfx'"
+        "-Dorg.lwjgl.glfw.libname='${pkgs.glfw3-minecraft}/lib/libglfw.so'"
+      ];
+      LESSKEY = "${xdg.cacheHome}/less/key";
+      LESSHISTFILE = "${xdg.cacheHome}/less/history";
+      PYLINTHOME = "${xdg.cacheHome}/pylint";
+      CARGO_HOME = "${xdg.cacheHome}/cargo";
+      RUSTUP_HOME = "${xdg.dataHome}/rustup";
+      XCOMPOSECACHE = "${xdg.cacheHome}/X11/xcompose";
+      XCOMPOSEFILE = "${xdg.configHome}/X11/xcompose";
+      MAILCAPS = "${xdg.configHome}/mailcap";
+      IPYTHONDIR = "${xdg.dataHome}/ipython";
+      JUPYTER_CONFIG_DIR = "${xdg.dataHome}/ipython";
+      HISTFILE = "${xdg.dataHome}/histfile";
+      RLWRAP_HOME = "${xdg.dataHome}/rlwrap";
+      CUDA_CACHE_PATH = "${xdg.dataHome}/cuda";
 
-    NPM_CONFIG_USERCONFIG = writeText "npmrc" ''
-      prefix=${xdg.cacheHome}/npm
-      cache=${xdg.cacheHome}/npm
-      tmp=$XDG_RUNTIME_DIR/npm
-      init-module=${xdg.configHome}/npm/config/npm-init.js
-    '';
+      # See, this is exactly why things should follow the spec. I have
+      # no intention of using gradle ever, but occasionally I need to
+      # build software that uses it.
+      #
+      # Now I need to deal with gradle puking directories all over my
+      # file system, or have a permanent configuration option here for
+      # software I don't even use.
+      #
+      # Grmbl.
+      GRADLE_USER_HOME = "${xdg.cacheHome}/gradle";
 
-    PYTHONSTARTUP = "${./dotfiles/bin/history.py}";
+      NPM_CONFIG_USERCONFIG = writeText "npmrc" ''
+        prefix=${xdg.cacheHome}/npm
+        cache=${xdg.cacheHome}/npm
+        tmp=$XDG_RUNTIME_DIR/npm
+        init-module=${xdg.configHome}/npm/config/npm-init.js
+      '';
 
-    EM_CONFIG = "${xdg.configHome}/emscripten/config";
-    EM_CACHE = "${xdg.cacheHome}/emscripten/cache";
-    EM_PORTS = "${xdg.dataHome}/emscripten/cache";
+      PYTHONSTARTUP = "${./dotfiles/bin/history.py}";
+
+      EM_CONFIG = "${xdg.configHome}/emscripten/config";
+      EM_CACHE = "${xdg.cacheHome}/emscripten/cache";
+      EM_PORTS = "${xdg.dataHome}/emscripten/cache";
+    };
   };
 }
diff --git a/lib/pkgs.nix b/lib/pkgs.nix
index 98baed62..ece539dc 100644
--- a/lib/pkgs.nix
+++ b/lib/pkgs.nix
@@ -15,7 +15,7 @@ rec {
       interpreter = lib.concatStringsSep " " [
         (lib.getExe nushell)
         "--no-config-file"
-        "--plugins [${lib.concatStringsSep " " (map (p: lib.getExe p) plugins)}]"
+        "--plugins [${lib.concatStringsSep " " (map lib.getExe plugins)}]"
       ];
 
       makeWrapperArgs = [
diff --git a/lib/pure.nix b/lib/pure.nix
index 2e266a90..b4ea5de1 100644
--- a/lib/pure.nix
+++ b/lib/pure.nix
@@ -17,21 +17,19 @@
       If a string is given, it is used as the mountpoint, and a set of
       standard mount options are set.
   */
-  mapSubvolumes =
-    subvolumes:
-    lib.mapAttrs (
-      _name: options:
-      if (lib.types.attrs.check options) then
-        options
-      else
-        {
-          mountpoint = options;
-          mountOptions = [
-            "compress=zstd"
-            "noatime"
-          ];
-        }
-    ) subvolumes;
+  mapSubvolumes = lib.mapAttrs (
+    _name: options:
+    if (lib.types.attrs.check options) then
+      options
+    else
+      {
+        mountpoint = options;
+        mountOptions = [
+          "compress=zstd"
+          "noatime"
+        ];
+      }
+  );
 
   /**
     Specifies the system for all (legacy)?[Pp]ackages in a flake input attrset.
@@ -47,7 +45,7 @@
   flattenFlakeInputs =
     inputs: system:
     lib.mapAttrs (
-      _: input:
+      _:
 
       lib.mapAttrs (
         name: output:
@@ -63,6 +61,6 @@
           output.${system}
         else
           output
-      ) input
+      )
     ) inputs;
 }
diff --git a/nixos-config/desktop/greeter/default.nix b/nixos-config/desktop/greeter/default.nix
index b4ee6332..c7646b4b 100644
--- a/nixos-config/desktop/greeter/default.nix
+++ b/nixos-config/desktop/greeter/default.nix
@@ -38,12 +38,14 @@ let
   '';
 in
 {
-  services.xserver.displayManager.lightdm.enable = false;
+  services = {
+    xserver.displayManager.lightdm.enable = false;
 
-  services.greetd = {
-    enable = true;
-    settings.default_session = {
-      command = lib.getExe launch-gtkgreet;
+    greetd = {
+      enable = true;
+      settings.default_session = {
+        command = lib.getExe launch-gtkgreet;
+      };
     };
   };
 
diff --git a/nixos-config/dev.nix b/nixos-config/dev.nix
index 64e498d4..495301f5 100644
--- a/nixos-config/dev.nix
+++ b/nixos-config/dev.nix
@@ -14,20 +14,6 @@ in
   # Also set up a static IP address of 192.168.9.2/24, with a gateway
   # of 192.168.9.1.
 
-  # Add bridge network to connect VMs to
-  networking.networkmanager.ensureProfiles.profiles.bridge = {
-    connection = {
-      id = bridgeName;
-      type = "bridge";
-      interface-name = bridgeName;
-    };
-
-    ipv4 = {
-      method = "manual";
-      address1 = "192.168.9.1/24";
-    };
-  };
-
   # Enable qemu-bridge-helper for setting up bridged networking in VMs
   security.wrappers.qemu-bridge-helper = {
     setuid = true;
@@ -51,17 +37,34 @@ in
     groups.qemu = { };
   };
 
-  # # Set up firewall to forward requests to the internet from the
-  # # bridge network
+  # Set up firewall to forward requests to the internet from the
+  # bridge network
   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-  networking.nftables.tables.dev-nat = {
-    family = "inet";
-    content = ''
-      chain postrouting {
-        type nat hook postrouting priority 100;
-        ip saddr 192.168.9.0/24 oifname bond0 masquerade
-      }
-    '';
+
+  networking = {
+    # Add bridge network to connect VMs to
+    networkmanager.ensureProfiles.profiles.bridge = {
+      connection = {
+        id = bridgeName;
+        type = "bridge";
+        interface-name = bridgeName;
+      };
+
+      ipv4 = {
+        method = "manual";
+        address1 = "192.168.9.1/24";
+      };
+    };
+
+    nftables.tables.dev-nat = {
+      family = "inet";
+      content = ''
+        chain postrouting {
+          type nat hook postrouting priority 100;
+          ip saddr 192.168.9.0/24 oifname bond0 masquerade
+        }
+      '';
+    };
   };
 
   # Add local DNS zone for VMs
diff --git a/nixos-config/hosts/yui/networking.nix b/nixos-config/hosts/yui/networking.nix
index 84c1a075..959034b5 100644
--- a/nixos-config/hosts/yui/networking.nix
+++ b/nixos-config/hosts/yui/networking.nix
@@ -9,7 +9,7 @@
     ];
 
     firewall.allowedUDPPorts = [ 25565 ];
-  };
 
-  networking.networkmanager.ensureProfiles.profiles.bond.bond.primary = "eno1";
+    networkmanager.ensureProfiles.profiles.bond.bond.primary = "eno1";
+  };
 }
diff --git a/nixos-config/networking/default.nix b/nixos-config/networking/default.nix
index 6dace2b1..6a0ae57a 100644
--- a/nixos-config/networking/default.nix
+++ b/nixos-config/networking/default.nix
@@ -38,7 +38,7 @@
           name = ".";
           forward-tls-upstream = true;
           forward-addr = lib.flatten (
-            lib.mapAttrsToList (domain: ips: map (ip: "${ip}@853#${domain}") ips) {
+            lib.mapAttrsToList (domain: map (ip: "${ip}@853#${domain}")) {
               "dns.quad9.net" = [
                 "9.9.9.9"
                 "149.112.112.112"
diff --git a/nixos-config/networking/personal.nix b/nixos-config/networking/personal.nix
index 4ff7d14d..88b3d097 100644
--- a/nixos-config/networking/personal.nix
+++ b/nixos-config/networking/personal.nix
@@ -3,10 +3,10 @@
   networking = {
     nftables.enable = true;
 
-    networkmanager = {
-      ensureProfiles.environmentFiles = [ config.sops.secrets.wireless-env.path ];
+    networkmanager.ensureProfiles = {
+      environmentFiles = [ config.sops.secrets.wireless-env.path ];
 
-      ensureProfiles.profiles = {
+      profiles = {
         bond = {
           connection = {
             id = "bond";