{
  self,
  inputs,
  ...
}: let
  # shorten paths
  inherit (inputs.nixpkgs.lib) nixosSystem;
  # Server uses its own pinned 24.05 nixpkgs (kept isolated from the laptop's unstable)
  nixosSystem24 = inputs.nixos-24-05.lib.nixosSystem;
  unstablePkgs = import inputs.nixpkgs-unstable {system = "x86_64-linux";};
  mod = "${self}/system";
  home = "${self}/home";

  # get the basic config to build on top of
  inherit (import "${self}/system") tty desktop laptop;

  # get these into the module system
  specialArgs = {inherit inputs self;};

  # shared modules for all configurations (personal + work)
  sharedModules = [
    ./aesthetic
    "${mod}/services/gnome-services.nix"
    "${mod}/core/limine.nix"
    "${home}"
    "${self}/work"
    inputs.sops-nix.nixosModules.sops
  ];
in {
  flake.nixosConfigurations = {
    # TTY: desktop headless (no GUI)
    tty = nixosSystem {
      inherit specialArgs;
      modules = tty ++ sharedModules;
    };

    # Desktop: desktop with GUI
    desktop = nixosSystem {
      inherit specialArgs;
      modules = desktop ++ sharedModules;
    };

    # Laptop: laptop with GUI + battery + bluetooth
    laptop = nixosSystem {
      inherit specialArgs;
      modules =
        laptop
        ++ sharedModules
        ++ [
          "${mod}/services/location.nix"
        ];
    };

    # Laptop UEFI: explicit UEFI boot mode
    laptop-uefi = nixosSystem {
      inherit specialArgs;
      modules =
        laptop
        ++ sharedModules
        ++ [
          "${mod}/services/location.nix"
          ({...}: {
            boot.loader.limine.bootMode = "uefi";
          })
        ];
    };

    # Laptop BIOS: explicit BIOS boot mode
    laptop-bios = nixosSystem {
      inherit specialArgs;
      modules =
        laptop
        ++ sharedModules
        ++ [
          "${mod}/services/location.nix"
          ({...}: {
            boot.loader.limine.bootMode = "bios";
            boot.loader.limine.biosDevice = "/dev/nvme0n1";
          })
        ];
    };

    # Laptop work: laptop profile + work modules (himmelblau, cisco, mdatp)
    laptop-work = nixosSystem {
      inherit specialArgs;
      modules =
        laptop
        ++ sharedModules
        ++ [
          "${mod}/services/location.nix"
          {
            work.cisco.enable = true;
            work.himmelblau.enable = true;
            work.mdatp.enable = true;
          }
        ];
    };

    # Server: severijnse.eu (Hetzner) — fully isolated under servers/hetzner/.
    # Uses nixos-24.05 + disko + sops-nix and does NOT inherit the laptop's shared modules.
    hetzner = nixosSystem24 {
      system = "x86_64-linux";
      specialArgs = {
        inherit inputs self unstablePkgs;
      };
      modules = [
        inputs.disko.nixosModules.disko
        inputs.sops-nix.nixosModules.sops
        "${self}/servers/hetzner/hosts/hetzner/hardware-configuration.nix"
        "${self}/servers/hetzner/hosts/hetzner/default.nix"
      ];
    };
  };
}