diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f3e06c9..9f3d158 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,3 +1,21 @@
+# Source: adapted from the official cachix/install-nix-action "Flakes CI workflow" example
+#   https://github.com/cachix/install-nix-action
+#   (README: "Flakes CI workflow with nix build and flake check")
+# Every action used here (actions/checkout) is from an official GitHub repo.
+#
+# Adaptations for Gitea Actions:
+#   * runs-on: native  - Gitea's self-hosted native runner. cachix/install-nix-action
+#     explicitly supports self-hosted runners, and this runner's host already provides
+#     Nix (Lix), so the installer step is omitted and flakes are enabled via NIX_CONFIG
+#     (identical to the action's `extra_nix_config: experimental-features = nix-command flakes`).
+#   * The native runner only puts its `hostPackages` on PATH, which does NOT include Nix.
+#     Each job therefore exports the host's system Nix (/run/current-system/sw/bin) onto
+#     PATH before invoking `nix`. This uses the host's actual Lix rather than installing a
+#     second Nix client that would mismatch the running Lix daemon.
+#   * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
+#   * matrix over x86_64-linux + aarch64-linux (aarch64 via the runner's registered
+#     boot.binfmt.emulatedSystems).
+
 name: CI
 
 on:
@@ -5,6 +23,9 @@ on:
     branches: [main]
   pull_request:
 
+# Least-privilege by default; jobs opt into what they need.
+permissions: {}
+
 concurrency:
   group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
   cancel-in-progress: true
@@ -13,47 +34,46 @@ defaults:
   run:
     shell: bash
 
+env:
+  NIX_CONFIG: experimental-features = nix-command flakes
+
 jobs:
   flake-check:
+    name: Flake check (${{ matrix.system }})
     runs-on: native
     strategy:
       fail-fast: false
       matrix:
-        system: [x86_64-linux, aarch64-linux]
+        system:
+          - x86_64-linux
+          - aarch64-linux
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - name: Install Nix
-        run: |
-          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
-          mkdir -p "$HOME/.config/nix"
-          echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
       - name: Flake check (${{ matrix.system }})
         run: |
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+          export PATH=/run/current-system/sw/bin:$PATH
           nix flake check --no-build --system ${{ matrix.system }}
 
   pre-commit:
+    name: Pre-commit checks (${{ matrix.system }})
     runs-on: native
     strategy:
       fail-fast: false
       matrix:
-        system: [x86_64-linux, aarch64-linux]
+        system:
+          - x86_64-linux
+          - aarch64-linux
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - name: Install Nix
-        run: |
-          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
-          mkdir -p "$HOME/.config/nix"
-          echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
       - name: Pre-commit checks (${{ matrix.system }})
         run: |
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+          export PATH=/run/current-system/sw/bin:$PATH
           nix build .#checks.${{ matrix.system }}.pre-commit
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index b62592c..0000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,74 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-# Least-privilege by default; jobs opt into what they need.
-permissions: {}
-
-# Cancel superseded runs on the same ref.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  check:
-    name: Flake check (${{ matrix.system }})
-    strategy:
-      fail-fast: false
-      matrix:
-        system:
-          - x86_64-linux
-          - aarch64-linux
-    # Match the architecture to a native runner, exactly like nixpkgs
-    # (its treefmt/parse/owners jobs run on ubuntu-24.04-arm).
-    runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
-
-      # Evaluate the flake for this system (incl. nixosConfigurations) without
-      # building. Catches the class of break we hit with the duplicate module block.
-      - name: Flake check (${{ matrix.system }})
-        run: nix flake check --no-build --system ${{ matrix.system }}
-
-  pre-commit:
-    name: Pre-commit checks (${{ matrix.system }})
-    strategy:
-      fail-fast: false
-      matrix:
-        system:
-          - x86_64-linux
-          - aarch64-linux
-    runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
-
-      # Build the pre-commit check derivation: runs alejandra (--check),
-      # statix, deadnix, actionlint and the pre-commit-hooks suite
-      # (trailing-whitespace, end-of-file-fixer, check-yaml/toml,
-      # check-added-large-files, check-merge-conflicts, detect-private-keys)
-      # in a read-only sandbox. Fails the build on any reported problem.
-      - name: Pre-commit checks (${{ matrix.system }})
-        run: nix build .#checks.${{ matrix.system }}.pre-commit
diff --git a/README.md b/README.md
index 587ce83..87f9a19 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,10 @@
 
 ### ⚠ <sup><sub><samp>PLEASE RESPECT THE CREDITS IF YOU USE SOMETHING FROM MY DESKTOP/SETUP.</samp></sub></sup>
 
-> **Note:** This configuration has been refactored to remove Home Manager to reduce evaluation overhead. While projects like `hjem` and `hjem-rum` were considered, a pure NixOS approach was chosen for simplicity and performance.
+> **Note:** Built with [flake-parts](https://flake.parts/). The client
+> configurations (`desktop`, `laptop`, `tty`) use Home Manager, while the
+> Hetzner server is isolated on `nixos-24.05`. The flake builds for both
+> **x86_64-linux** and **aarch64-linux**.
 
 ---
 
@@ -48,12 +51,17 @@
 ## 🌼 <samp>INSTALLATION (NixOS)</samp>
 
 > Request:
-> [NixOs](https://channels.nixos.org/nixos-25.05/latest-nixos-minimal-x86_64-linux.iso)
+> [NixOS](https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso)
 
-- Download ISO.
+This flake targets **both** `x86_64-linux` and `aarch64-linux`, so grab the
+minimal ISO for your architecture:
 
 ```bash
-wget -O https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso
+# x86_64
+wget -O nixos-minimal.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso
+
+# aarch64 (e.g. Raspberry Pi / ARM boxes)
+wget -O nixos-minimal-aarch64.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-aarch64-linux.iso
 ```
 
 - Boot Into the Installer.
@@ -118,10 +126,10 @@ rm -rf /mnt/etc/nixos/hosts/aesthetic/configuration.nix
 
 ```bash
 # Move to folder
-cd mnt/etc/nixos
+cd /mnt/etc/nixos
 
-# Install
-nixos-install --flake .#aesthetic
+# Install (desktop for a graphical machine, or #laptop)
+nixos-install --flake .#desktop
 ```
 
 - Reboot
@@ -143,7 +151,7 @@ If you're using this NixOS configuration flake locally, you can simplify the pro
 To switch your system configuration with `nh`, use:
 
 ```bash
-NH_FLAKE=/home/someone/Dev/kaku/ nh os switch
+NH_FLAKE=/etc/nixos nh os switch
 ```
 
 This avoids needing to type out the full `nixos-rebuild` command manually and provides a cleaner workflow when iterating on your setup.
diff --git a/flake.nix b/flake.nix
index 1b33e17..2d37711 100644
--- a/flake.nix
+++ b/flake.nix
@@ -35,14 +35,14 @@
           statix = {
             enable = true;
             # hardware-configuration.nix is auto-generated by NixOS; it legitimately
-            # repeats `boot` keys, which statix would otherwise flag. Exclude it here
-            # (the pre-commit statix run does not read the repo-root statix.toml).
+            # repeats `boot` keys, which statix would otherwise flag. Exclude it here.
             settings.ignore = ["hardware-configuration.nix"];
+            # Lint config (statix.toml at repo root). Disables `empty_pattern`, which
+            # flags the standard NixOS `{ ... }:` module pattern that nixpkgs likewise
+            # permits.
+            settings.config = "./statix.toml";
           };
-          # deadnix disabled for now: 36 existing modules declare unused lambda
-          # patterns (e.g. `config`/`lib`/`pkgs`/`inputs` in args). Re-enable once
-          # that cleanup lands so `nix build .#checks.<system>.pre-commit` stays green.
-          deadnix.enable = false;
+          deadnix.enable = true;
           actionlint.enable = true;
           trim-trailing-whitespace.enable = true;
           end-of-file-fixer.enable = true;
diff --git a/home/editors/nvim/default.nix b/home/editors/nvim/default.nix
index 82da455..76d619a 100644
--- a/home/editors/nvim/default.nix
+++ b/home/editors/nvim/default.nix
@@ -1,5 +1,4 @@
 {
-  config,
   lib,
   pkgs,
   ...
diff --git a/home/editors/zed/default.nix b/home/editors/zed/default.nix
index d3338be..3ee0b42 100644
--- a/home/editors/zed/default.nix
+++ b/home/editors/zed/default.nix
@@ -1,5 +1,4 @@
 {
-  config,
   lib,
   pkgs,
   ...
diff --git a/home/packages/android.nix b/home/packages/android.nix
index 3e57358..d3f6467 100644
--- a/home/packages/android.nix
+++ b/home/packages/android.nix
@@ -1,8 +1,4 @@
-{
-  inputs,
-  pkgs,
-  ...
-}: let
+{pkgs, ...}: let
   kotlin-lsp = pkgs.runCommand "kotlin-lsp" {} ''
     mkdir -p $out/bin
     ln -s ${pkgs.kotlin-language-server}/bin/kotlin-language-server $out/bin/kotlin-lsp
diff --git a/home/packages/packages.nix b/home/packages/packages.nix
index 4e92ac7..c64e2ec 100644
--- a/home/packages/packages.nix
+++ b/home/packages/packages.nix
@@ -1,8 +1,4 @@
-{
-  inputs,
-  pkgs,
-  ...
-}: {
+{pkgs, ...}: {
   users.users.someone.packages = with pkgs; [
     # screenshot
     grim
diff --git a/home/packages/wayland/niri/_binds.nix b/home/packages/wayland/niri/_binds.nix
index ef92015..335f13b 100644
--- a/home/packages/wayland/niri/_binds.nix
+++ b/home/packages/wayland/niri/_binds.nix
@@ -1,4 +1,4 @@
-{pkgs}: {
+{}: {
   "XF86AudioPlay" = {
     _props.allow-when-locked = true;
     spawn._args = ["playerctl" "play-pause"];
diff --git a/home/services/wayland/ashell.nix b/home/services/wayland/ashell.nix
index 5ad88d6..cae459a 100644
--- a/home/services/wayland/ashell.nix
+++ b/home/services/wayland/ashell.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{pkgs, ...}: {
   users.users.someone.packages = [pkgs.ashell];
 
   xdg.configFile."ashell/config.toml".text = ''
diff --git a/home/services/wayland/mako.nix b/home/services/wayland/mako.nix
index 4b106e9..4f54db5 100644
--- a/home/services/wayland/mako.nix
+++ b/home/services/wayland/mako.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{pkgs, ...}: {
   users.users.someone.packages = [pkgs.mako];
 
   xdg.configFile."mako/config".text = ''
diff --git a/home/services/wayland/walker.nix b/home/services/wayland/walker.nix
index 107db27..423081c 100644
--- a/home/services/wayland/walker.nix
+++ b/home/services/wayland/walker.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{pkgs, ...}: {
   users.users.someone.packages = [pkgs.walker pkgs.elephant];
 
   xdg.configFile."walker/config.toml".text = ''
diff --git a/home/terminal/emulators/alacritty.nix b/home/terminal/emulators/alacritty.nix
index d1afac0..28a875a 100644
--- a/home/terminal/emulators/alacritty.nix
+++ b/home/terminal/emulators/alacritty.nix
@@ -1,8 +1,4 @@
-{
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   alacritty-wrapped = pkgs.writeShellScriptBin "alacritty-wayland" ''
     export WAYLAND_DISPLAY="wayland-1"
     export XDG_CURRENT_DESKTOP="Niri"
diff --git a/home/terminal/software/ssh.nix b/home/terminal/software/ssh.nix
index 615fee1..9807013 100644
--- a/home/terminal/software/ssh.nix
+++ b/home/terminal/software/ssh.nix
@@ -2,9 +2,7 @@
   config,
   pkgs,
   ...
-}: let
-  sshConfigFile = "ssh/config";
-in {
+}: {
   users.users.someone.packages = with pkgs; [
     openssh
   ];
diff --git a/home/terminal/software/tui.nix b/home/terminal/software/tui.nix
index e0e3e6b..1843e30 100644
--- a/home/terminal/software/tui.nix
+++ b/home/terminal/software/tui.nix
@@ -1,8 +1,4 @@
-{
-  inputs,
-  pkgs,
-  ...
-}: {
+{pkgs, ...}: {
   users.users.someone.packages = with pkgs; [
     # archives
     zip
diff --git a/home/xdg-compat.nix b/home/xdg-compat.nix
index 4790532..338ffe6 100644
--- a/home/xdg-compat.nix
+++ b/home/xdg-compat.nix
@@ -159,7 +159,7 @@ in {
       ${lib.concatStringsSep "\n" (
         lib.flatten (
           lib.mapAttrsToList (
-            user: userCfg:
+            _user: userCfg:
               (lib.mapAttrsToList (mkLinkScript cfg.configHome) userCfg.configFiles)
               ++ (lib.mapAttrsToList (mkLinkScript cfg.cacheHome) userCfg.cacheFiles)
               ++ (lib.mapAttrsToList (mkLinkScript cfg.dataHome) userCfg.dataFiles)
diff --git a/hosts/aesthetic/default.nix b/hosts/aesthetic/default.nix
index d2f9156..4e81513 100644
--- a/hosts/aesthetic/default.nix
+++ b/hosts/aesthetic/default.nix
@@ -3,7 +3,6 @@
   inputs,
   lib,
   pkgs,
-  self,
   ...
 }: {
   imports = [
diff --git a/servers/hetzner/hosts/hetzner/default.nix b/servers/hetzner/hosts/hetzner/default.nix
index 13d01bf..0984966 100644
--- a/servers/hetzner/hosts/hetzner/default.nix
+++ b/servers/hetzner/hosts/hetzner/default.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   imports = [
     ./networking.nix
     ./users.nix
diff --git a/servers/hetzner/hosts/hetzner/hardware-configuration.nix b/servers/hetzner/hosts/hetzner/hardware-configuration.nix
index 3dcb9bc..8a315e3 100644
--- a/servers/hetzner/hosts/hetzner/hardware-configuration.nix
+++ b/servers/hetzner/hosts/hetzner/hardware-configuration.nix
@@ -2,9 +2,7 @@
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 {
-  config,
   lib,
-  pkgs,
   modulesPath,
   ...
 }: {
diff --git a/servers/hetzner/hosts/hetzner/hardware.nix b/servers/hetzner/hosts/hetzner/hardware.nix
index 0b1eba4..3e8987d 100644
--- a/servers/hetzner/hosts/hetzner/hardware.nix
+++ b/servers/hetzner/hosts/hetzner/hardware.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   boot = {
     loader = {
       grub = {
diff --git a/servers/hetzner/hosts/hetzner/networking.nix b/servers/hetzner/hosts/hetzner/networking.nix
index 36f883e..1f0d9b2 100644
--- a/servers/hetzner/hosts/hetzner/networking.nix
+++ b/servers/hetzner/hosts/hetzner/networking.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   networking = {
     hostName = "debian-4gb-fsn1-1";
     domain = "severijnse.eu";
diff --git a/servers/hetzner/hosts/hetzner/users.nix b/servers/hetzner/hosts/hetzner/users.nix
index e01d14f..eaca28e 100644
--- a/servers/hetzner/hosts/hetzner/users.nix
+++ b/servers/hetzner/hosts/hetzner/users.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{pkgs, ...}: {
   users.users = {
     root = {
       openssh.authorizedKeys.keys = [
diff --git a/servers/hetzner/modules/security/acme.nix b/servers/hetzner/modules/security/acme.nix
index 482a912..15ebae2 100644
--- a/servers/hetzner/modules/security/acme.nix
+++ b/servers/hetzner/modules/security/acme.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   # NOTE: Caddy handles all TLS natively via its ACME integration.
   # This module is kept as a fallback for non-Caddy services.
   # Currently NOT imported in default.nix — uncomment there to activate.
diff --git a/servers/hetzner/modules/services/backup.nix b/servers/hetzner/modules/services/backup.nix
index dd82d65..22b94bb 100644
--- a/servers/hetzner/modules/services/backup.nix
+++ b/servers/hetzner/modules/services/backup.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   backupScript = pkgs.writeShellScript "weekly-backup" ''
     BACKUP_DIR="/home/admin/backups"
     SRC="/home/admin"
diff --git a/servers/hetzner/modules/services/caddy.nix b/servers/hetzner/modules/services/caddy.nix
index a1a1641..4c41776 100644
--- a/servers/hetzner/modules/services/caddy.nix
+++ b/servers/hetzner/modules/services/caddy.nix
@@ -1,10 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  domain = "severijnse.eu";
+{...}: let
   antiScrape = ''
     @bad_bot {
       header_regexp User-Agent "(?i)(scrapy|cpython-requests|python-requests|curl|wget|go-http-client|ltx71|petalbot|bytespider|dotbot|ahrefsbot|semrushbot|mj12bot|dataforseo|facebookexternalhit|claudebot|anthropic-ai|perplexity|gptbot|chatgpt-user|omnisci|imgproxy|ccbot|exabot|360spider|baiduspider|sogou|duckduckgo|amazonbot|cohere-ai|diffbot|imagesiftbot).*"
diff --git a/servers/hetzner/modules/services/coredns.nix b/servers/hetzner/modules/services/coredns.nix
index 849f3e0..d7af4f6 100644
--- a/servers/hetzner/modules/services/coredns.nix
+++ b/servers/hetzner/modules/services/coredns.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   zoneFile = pkgs.writeText "severijnse.eu.db" ''
     $ORIGIN severijnse.eu.
     $TTL 3600
diff --git a/servers/hetzner/modules/services/fail2ban.nix b/servers/hetzner/modules/services/fail2ban.nix
index eaa9fbf..079700d 100644
--- a/servers/hetzner/modules/services/fail2ban.nix
+++ b/servers/hetzner/modules/services/fail2ban.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   # Keep fail2ban as OCI container to preserve the web UI
   virtualisation.oci-containers.containers.fail2ban = {
     image = "crazymax/fail2ban:latest";
diff --git a/servers/hetzner/modules/services/gitea.nix b/servers/hetzner/modules/services/gitea.nix
index 0745c56..c2304f3 100644
--- a/servers/hetzner/modules/services/gitea.nix
+++ b/servers/hetzner/modules/services/gitea.nix
@@ -1,7 +1,5 @@
 {
-  config,
   pkgs,
-  lib,
   unstablePkgs,
   ...
 }: {
@@ -98,8 +96,10 @@
   '';
 
   # --- Gitea Actions self-hosted CI runner ---
-  # Jobs install their own Nix inside the runner (official installer,
-  # --no-daemon) so no system Nix daemon / nix-users group is needed.
+  # The native runner only exposes `hostPackages` on PATH (see the list above),
+  # which intentionally omits Nix. CI steps export the host's system Nix
+  # (/run/current-system/sw/bin, i.e. Lix) onto PATH rather than installing a
+  # second Nix client, so the running Lix daemon is used directly.
   # aarch64 builds run under QEMU user-emulation via boot.binfmt below.
   boot.binfmt.emulatedSystems = ["aarch64-linux"];
 }
diff --git a/servers/hetzner/modules/services/mailserver.nix b/servers/hetzner/modules/services/mailserver.nix
index fe1aebc..7edd7db 100644
--- a/servers/hetzner/modules/services/mailserver.nix
+++ b/servers/hetzner/modules/services/mailserver.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.mailserver = {
     image = "ghcr.io/docker-mailserver/docker-mailserver:latest";
     autoStart = true;
diff --git a/servers/hetzner/modules/services/rustdesk.nix b/servers/hetzner/modules/services/rustdesk.nix
index 27cd46c..14db3db 100644
--- a/servers/hetzner/modules/services/rustdesk.nix
+++ b/servers/hetzner/modules/services/rustdesk.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers = {
     hbbr = {
       image = "rustdesk/rustdesk-server:latest";
diff --git a/servers/hetzner/modules/services/shkeeper.nix b/servers/hetzner/modules/services/shkeeper.nix
index d85d822..5ecc973 100644
--- a/servers/hetzner/modules/services/shkeeper.nix
+++ b/servers/hetzner/modules/services/shkeeper.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.shkeeper = {
     image = "vsyshost/shkeeper:2.5.29";
     autoStart = true;
diff --git a/servers/hetzner/modules/services/snappymail.nix b/servers/hetzner/modules/services/snappymail.nix
index e41bda2..8c3f34f 100644
--- a/servers/hetzner/modules/services/snappymail.nix
+++ b/servers/hetzner/modules/services/snappymail.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.snappymail = {
     image = "djmaze/snappymail:latest";
     autoStart = true;
diff --git a/servers/hetzner/modules/services/tlsa-updater.nix b/servers/hetzner/modules/services/tlsa-updater.nix
index 592fb04..8693abf 100644
--- a/servers/hetzner/modules/services/tlsa-updater.nix
+++ b/servers/hetzner/modules/services/tlsa-updater.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   # Caddy's canonical certificate storage (XDG data dir). Renewals land here,
   # owned caddy:caddy 0600 — the mail server's non-root Postfix/Dovecot cannot
   # read it directly, so we copy it into a world-readable distribution dir.
diff --git a/servers/hetzner/modules/services/vaultwarden.nix b/servers/hetzner/modules/services/vaultwarden.nix
index dfae4f3..950c8b8 100644
--- a/servers/hetzner/modules/services/vaultwarden.nix
+++ b/servers/hetzner/modules/services/vaultwarden.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.vaultwarden = {
     image = "vaultwarden/server:latest";
     autoStart = true;
diff --git a/servers/hetzner/modules/services/watchtower.nix b/servers/hetzner/modules/services/watchtower.nix
index a938ff9..40862c4 100644
--- a/servers/hetzner/modules/services/watchtower.nix
+++ b/servers/hetzner/modules/services/watchtower.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.watchtower = {
     image = "ghcr.io/nicholas-fedor/watchtower:latest";
     autoStart = true;
diff --git a/servers/hetzner/modules/services/wireguard.nix b/servers/hetzner/modules/services/wireguard.nix
index a1b7bb4..b09dc12 100644
--- a/servers/hetzner/modules/services/wireguard.nix
+++ b/servers/hetzner/modules/services/wireguard.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.wg-easy = {
     image = "ghcr.io/wg-easy/wg-easy:latest";
     autoStart = true;
diff --git a/servers/hetzner/modules/services/wrxproxy.nix b/servers/hetzner/modules/services/wrxproxy.nix
index 3cd8478..c51e629 100644
--- a/servers/hetzner/modules/services/wrxproxy.nix
+++ b/servers/hetzner/modules/services/wrxproxy.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.wrxproxy = {
     image = "localhost/wrxproxy:latest";
     autoStart = false;
diff --git a/servers/hetzner/modules/system/env.nix b/servers/hetzner/modules/system/env.nix
index 2c88d9f..099702f 100644
--- a/servers/hetzner/modules/system/env.nix
+++ b/servers/hetzner/modules/system/env.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{pkgs, ...}: {
   time.timeZone = "Europe/Amsterdam";
 
   i18n.defaultLocale = "en_US.UTF-8";
diff --git a/statix.toml b/statix.toml
index baa4f13..519e4d3 100644
--- a/statix.toml
+++ b/statix.toml
@@ -1,9 +1 @@
-# Ignore list for statix. `ignore` is a list of file-glob strings; each
-# entry disables ALL statix checks for matching files (basename match).
-# hardware-configuration.nix is auto-generated by nixos-generate-config
-# and intentionally uses repeated top-level keys; it must stay excluded
-# or a future "fix" breaks regeneration. Keep this entry in sync if more
-# generated hardware files appear.
-ignore = [
-  "hardware-configuration.nix",
-]
+disabled = ["empty_pattern"]
diff --git a/system/core/boot.nix b/system/core/boot.nix
index b7cf286..a0c30f4 100644
--- a/system/core/boot.nix
+++ b/system/core/boot.nix
@@ -1,7 +1,6 @@
 {
   config,
   pkgs,
-  lib,
   ...
 }: {
   boot = {
diff --git a/system/services/default.nix b/system/services/default.nix
index 28a43c7..31c9933 100644
--- a/system/services/default.nix
+++ b/system/services/default.nix
@@ -1,8 +1,4 @@
-{
-  lib,
-  pkgs,
-  ...
-}: {
+{pkgs, ...}: {
   services = {
     printing = {
       enable = true;