diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
new file mode 100644
index 0000000..3d8bc9f
--- /dev/null
+++ b/.git-blame-ignore-revs
@@ -0,0 +1,2 @@
+# nixfmt reformat
+2231d2fc3fb4dc140c5f3257523dcdb513ac4dea
diff --git a/devenv.nix b/devenv.nix
index e515280..f173bdb 100644
--- a/devenv.nix
+++ b/devenv.nix
@@ -15,8 +15,10 @@
 
   scripts = {
     lint.exec = ''
+      set -e
       statix check .
-      deadnix --fail .
+      # hardware-configuration.nix is generated; statix skips it via statix.toml
+      deadnix --fail --exclude hosts/*/hardware-configuration.nix -- .
     '';
     fmt.exec = ''
       nixfmt $(git ls-files '*.nix')
diff --git a/flake.nix b/flake.nix
index be2e4a0..37cba33 100644
--- a/flake.nix
+++ b/flake.nix
@@ -17,29 +17,38 @@
     };
   };
 
-  outputs = { self, nixpkgs, home-manager, nixvim, ... }@inputs:
-  let
-    mkHost = hostName: nixpkgs.lib.nixosSystem {
-      system = "x86_64-linux";
-      specialArgs = { inherit inputs; };
-      modules = [
-        ./hosts/${hostName}/hardware-configuration.nix
-        ./hosts/${hostName}/configuration.nix
-        home-manager.nixosModules.home-manager
-        {
-          home-manager.extraSpecialArgs = { inherit inputs; };
-          home-manager.users.aaron.imports = [
-            nixvim.homeModules.nixvim
-            ./users/aaron/home.nix
+  outputs =
+    {
+      nixpkgs,
+      home-manager,
+      nixvim,
+      ...
+    }@inputs:
+    let
+      mkHost =
+        hostName:
+        nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          specialArgs = { inherit inputs; };
+          modules = [
+            ./hosts/${hostName}/hardware-configuration.nix
+            ./hosts/${hostName}/configuration.nix
+            home-manager.nixosModules.home-manager
+            {
+              home-manager.extraSpecialArgs = { inherit inputs; };
+              home-manager.users.aaron.imports = [
+                nixvim.homeModules.nixvim
+                ./users/aaron/home.nix
+              ];
+            }
           ];
-        }
-      ];
+        };
+    in
+    {
+      nixosConfigurations = {
+        default = mkHost "default";
+        neon = mkHost "neon";
+        argon = mkHost "argon";
+      };
     };
-  in {
-    nixosConfigurations = {
-      default = mkHost "default";
-      neon    = mkHost "neon";
-      argon   = mkHost "argon";
-    };
-  };
 }
diff --git a/hosts/argon/configuration.nix b/hosts/argon/configuration.nix
index 57be3a3..76a37d3 100644
--- a/hosts/argon/configuration.nix
+++ b/hosts/argon/configuration.nix
@@ -1,5 +1,3 @@
-{ config, pkgs, inputs, ... }:
-
 {
   imports = [
     ../../modules/nixos/appimage.nix
@@ -34,4 +32,3 @@
   # install state version
   system.stateVersion = "25.11"; # Don't change
 }
-
diff --git a/hosts/argon/hardware-configuration.nix b/hosts/argon/hardware-configuration.nix
index 8518772..cb58a66 100644
--- a/hosts/argon/hardware-configuration.nix
+++ b/hosts/argon/hardware-configuration.nix
@@ -1,38 +1,54 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ "dm-crypt dm-mod" ];
   boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    { device = "/dev/mapper/lvmroot-root";
-      fsType = "ext4";
-    };
+  fileSystems."/" = {
+    device = "/dev/mapper/lvmroot-root";
+    fsType = "ext4";
+  };
 
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/AC1C-20EB";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-
-  fileSystems."/home" =
-    { device = "/dev/mapper/lvmroot-home";
-      fsType = "ext4";
-    };
-
-  swapDevices =
-    [ { device = "/dev/mapper/lvmroot-swap"; }
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/AC1C-20EB";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
     ];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/mapper/lvmroot-home";
+    fsType = "ext4";
+  };
+
+  swapDevices = [
+    { device = "/dev/mapper/lvmroot-swap"; }
+  ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
diff --git a/hosts/default/configuration.nix b/hosts/default/configuration.nix
index 86182ac..10ddc47 100644
--- a/hosts/default/configuration.nix
+++ b/hosts/default/configuration.nix
@@ -1,10 +1,13 @@
 # 0x29a nixos conifg
 
-{ pkgs, lib, ... }:
+{ pkgs, ... }:
 
 {
   # use flakes
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
 
   # configure bootloader
   boot.loader.systemd-boot.enable = false;
@@ -29,7 +32,7 @@
   services.qemuGuest.enable = true;
 
   # networking
-  networking.hostName = "nixos"; 
+  networking.hostName = "nixos";
   networking.networkmanager.enable = true;
 
   # time zone.
@@ -60,9 +63,10 @@
 
     windowManager.qtile = {
       enable = true;
-      extraPackages = python3Packages: with python3Packages; [
-        qtile-extras
-      ];
+      extraPackages =
+        python3Packages: with python3Packages; [
+          qtile-extras
+        ];
     };
   };
 
@@ -71,8 +75,8 @@
 
   # enable sound
   services.pipewire = {
-     enable = true;
-     pulse.enable = true;
+    enable = true;
+    pulse.enable = true;
   };
 
   # define a user account
@@ -97,7 +101,10 @@
     autosuggestions.enable = true;
     ohMyZsh = {
       enable = true;
-      plugins = [ "git" "sudo" ];
+      plugins = [
+        "git"
+        "sudo"
+      ];
       theme = "agnoster";
     };
   };
@@ -116,8 +123,8 @@
   # Some programs need SUID wrappers
   programs.mtr.enable = true;
   programs.gnupg.agent = {
-     enable = true;
-     enableSSHSupport = true;
+    enable = true;
+    enableSSHSupport = true;
   };
 
   # enable the OpenSSH daemon
@@ -130,4 +137,3 @@
   # install state version
   system.stateVersion = "25.05"; # Don't change
 }
-
diff --git a/hosts/default/hardware-configuration.nix b/hosts/default/hardware-configuration.nix
index 3c86116..42645ca 100644
--- a/hosts/default/hardware-configuration.nix
+++ b/hosts/default/hardware-configuration.nix
@@ -1,36 +1,56 @@
 # 0x29a nixos hardware configuration
 
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
 
   # boot and initrd configs
-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
-  boot.initrd.kernelModules = [ "dm-snapshot" "cryptd" ];
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [
+    "dm-snapshot"
+    "cryptd"
+  ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
   boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
 
   # file systems
-  fileSystems."/" =
-    { device = "/dev/disk/by-label/nixroot";
-      fsType = "ext4";
-    };
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-label/nixboot";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-  fileSystems."/home" =
-    { device = "/dev/disk/by-label/nixhome";
-      fsType = "ext4";
-    };
-  swapDevices =
-    [ { device = "/dev/disk/by-label/nixswap"; }
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixroot";
+    fsType = "ext4";
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/nixboot";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
     ];
+  };
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/nixhome";
+    fsType = "ext4";
+  };
+  swapDevices = [
+    { device = "/dev/disk/by-label/nixswap"; }
+  ];
 
   # enable dhcp on all interfaces
   networking.useDHCP = lib.mkDefault true;
diff --git a/hosts/default/home.nix b/hosts/default/home.nix
index 04a20fb..9ebc116 100644
--- a/hosts/default/home.nix
+++ b/hosts/default/home.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # user config
@@ -50,12 +50,16 @@
     syntaxHighlighting.enable = true;
     oh-my-zsh = {
       enable = true;
-      plugins = [ "git" "sudo" "python" "ansible" ];
+      plugins = [
+        "git"
+        "sudo"
+        "python"
+        "ansible"
+      ];
       theme = "agnoster";
     };
   };
 
-
   ## deploy qtile config
   #home.file."qtile-config" = {
   #  target = ".config/qtile/config.py";
diff --git a/hosts/neon/configuration.nix b/hosts/neon/configuration.nix
index 4e8d6c2..2e2a06d 100644
--- a/hosts/neon/configuration.nix
+++ b/hosts/neon/configuration.nix
@@ -1,5 +1,3 @@
-{ config, pkgs, inputs, ... }:
-
 {
   imports = [
     ../../modules/nixos/appimage.nix
@@ -31,4 +29,3 @@
   # install state version
   system.stateVersion = "25.11"; # Don't change
 }
-
diff --git a/hosts/neon/hardware-configuration.nix b/hosts/neon/hardware-configuration.nix
index 31a19c1..ee79eda 100644
--- a/hosts/neon/hardware-configuration.nix
+++ b/hosts/neon/hardware-configuration.nix
@@ -1,39 +1,57 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
-  boot.initrd.kernelModules = [ "dm-snapshot" "cryptd" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+    "rtsx_pci_sdmmc"
+  ];
+  boot.initrd.kernelModules = [
+    "dm-snapshot"
+    "cryptd"
+  ];
   boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-label/nixcrypt";
 
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    { device = "/dev/disk/by-label/nixroot";
-      fsType = "ext4";
-    };
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixroot";
+    fsType = "ext4";
+  };
 
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-label/nixboot";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-
-  fileSystems."/home" =
-    { device = "/dev/disk/by-label/nixhome";
-      fsType = "ext4";
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-label/nixswap"; }
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/nixboot";
+    fsType = "vfat";
+    options = [
+      "fmask=0022"
+      "dmask=0022"
     ];
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-label/nixhome";
+    fsType = "ext4";
+  };
+
+  swapDevices = [
+    { device = "/dev/disk/by-label/nixswap"; }
+  ];
 
   networking.useDHCP = lib.mkDefault true;
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
diff --git a/modules/home-manager/fonts.nix b/modules/home-manager/fonts.nix
index e915395..5e76bee 100644
--- a/modules/home-manager/fonts.nix
+++ b/modules/home-manager/fonts.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, inputs, ... }:
+{ pkgs, ... }:
 
 {
   # user fonts
diff --git a/modules/home-manager/ghostty.nix b/modules/home-manager/ghostty.nix
index 079837b..83f5c9d 100644
--- a/modules/home-manager/ghostty.nix
+++ b/modules/home-manager/ghostty.nix
@@ -1,5 +1,3 @@
-{ config, pkgs, inputs, ... }:
-
 {
   programs.ghostty = {
     enable = true;
diff --git a/modules/home-manager/git.nix b/modules/home-manager/git.nix
index e6f5b74..8a3364b 100644
--- a/modules/home-manager/git.nix
+++ b/modules/home-manager/git.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, inputs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   email = "aaron@0x29a.ch";
@@ -14,16 +19,19 @@ in
 {
   # gitea verifies signatures against the account keys, this teaches the local
   # git the same trust so `git log --show-signature` resolves as well
-  xdg.configFile."git/allowed_signers".text =
-    lib.concatMapStrings (key: "${email} ${key}\n") signingKeys;
+  xdg.configFile."git/allowed_signers".text = lib.concatMapStrings (
+    key: "${email} ${key}\n"
+  ) signingKeys;
 
   programs.git = {
     enable = true;
     settings = {
-      push = { autoSetupRemote = true; };
+      push = {
+        autoSetupRemote = true;
+      };
       user = {
-        name  = "aaron";
-        email = email;
+        name = "aaron";
+        inherit email;
       };
       gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
     };
diff --git a/modules/home-manager/nixvim.nix b/modules/home-manager/nixvim.nix
index 93e6702..e5fa692 100644
--- a/modules/home-manager/nixvim.nix
+++ b/modules/home-manager/nixvim.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, inputs, ... }:
+{ pkgs, inputs, ... }:
 
 {
   programs.nixvim = {
@@ -57,7 +57,7 @@
       servers.pyright.enable = true;
       servers.ruff.enable = true;
       keymaps.lspBuf = {
-        "<leader>K"  = "hover";
+        "<leader>K" = "hover";
         "<leader>gd" = "definition";
         "<leader>gr" = "references";
         "<leader>f" = "format";
@@ -67,7 +67,11 @@
     };
     plugins.treesitter = {
       enable = true;
-      settings.ensure_installed = [ "markdown" "markdown_inline" "typst" ];
+      settings.ensure_installed = [
+        "markdown"
+        "markdown_inline"
+        "typst"
+      ];
     };
     plugins.typst-preview = {
       enable = true;
@@ -87,7 +91,11 @@
       enable = true;
       settings = {
         # render in normal mode, raw source in insert
-        render_modes = [ "n" "c" "t"];
+        render_modes = [
+          "n"
+          "c"
+          "t"
+        ];
         pipe_table.preset = "round";
         heading.width = "block";
         file_types = [ "markdown" ];
diff --git a/modules/home-manager/noctalia.nix b/modules/home-manager/noctalia.nix
index 24ee89a..f3d625b 100644
--- a/modules/home-manager/noctalia.nix
+++ b/modules/home-manager/noctalia.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, inputs, ... }:
+{ pkgs, inputs, ... }:
 
 {
   # Noctalia v5 shell, managed via home-manager's built-in programs.noctalia module.
@@ -12,7 +12,7 @@
     # Use the package from the noctalia flake rather than nixpkgs.
     package = inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default;
 
-    # settings is rendered to ~/.config/noctalia/config.toml 
+    # settings is rendered to ~/.config/noctalia/config.toml
     settings = {
       # theme / colors
       theme = {
@@ -73,9 +73,22 @@
           radius = 0;
           scale = 1.2;
           widget_spacing = 20;
-          start = [ "control-center" "cpu" "ram" "temp" "active_window" ];
+          start = [
+            "control-center"
+            "cpu"
+            "ram"
+            "temp"
+            "active_window"
+          ];
           center = [ "workspaces" ];
-          end = [ "tray" "bluetooth" "notifications" "volume" "network" "clock" ];
+          end = [
+            "tray"
+            "bluetooth"
+            "notifications"
+            "volume"
+            "network"
+            "clock"
+          ];
         };
       };
 
@@ -103,7 +116,11 @@
 
       # idle behavior
       idle = {
-        behavior_order = [ "screen-off" "lock" "lock-and-suspend" ];
+        behavior_order = [
+          "screen-off"
+          "lock"
+          "lock-and-suspend"
+        ];
         behavior = {
           "screen-off" = {
             enabled = true;
diff --git a/modules/home-manager/programs.nix b/modules/home-manager/programs.nix
index f7f7b41..679a92e 100644
--- a/modules/home-manager/programs.nix
+++ b/modules/home-manager/programs.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, inputs, ... }:
+{ config, pkgs, ... }:
 
 {
   # user packages
diff --git a/modules/home-manager/shell.nix b/modules/home-manager/shell.nix
index ccde820..1859f1b 100644
--- a/modules/home-manager/shell.nix
+++ b/modules/home-manager/shell.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ lib, ... }:
 
 {
   # configure z-shell to use omz with some plugins
@@ -9,7 +9,11 @@
     oh-my-zsh = {
       enable = true;
       # add git and agents as plugins
-      plugins = [ "git" "ssh-agent" "gpg-agent" ];
+      plugins = [
+        "git"
+        "ssh-agent"
+        "gpg-agent"
+      ];
       # everything here lands before `source $ZSH/oh-my-zsh.sh`
       extraConfig = ''
         # make omz faster on large repositories
diff --git a/modules/home-manager/styling.nix b/modules/home-manager/styling.nix
index 889bf0f..2a03ff5 100644
--- a/modules/home-manager/styling.nix
+++ b/modules/home-manager/styling.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, inputs, ... }:
+{ pkgs, ... }:
 
 {
   # set gtk theme
@@ -6,8 +6,8 @@
     enable = true;
     theme = {
       name = "Adwaita-dark";
-        package = pkgs.gnome-themes-extra;
-      };
+      package = pkgs.gnome-themes-extra;
+    };
     gtk3.extraConfig.gtk-application-prefer-dark-theme = 1;
     gtk4.theme = null;
     gtk4.extraConfig.gtk-application-prefer-dark-theme = 1;
diff --git a/modules/home-manager/tmux.nix b/modules/home-manager/tmux.nix
index fffa489..fd74183 100644
--- a/modules/home-manager/tmux.nix
+++ b/modules/home-manager/tmux.nix
@@ -1,5 +1,3 @@
-{ config, pkgs, inputs, ... }:
-
 let
   # Powerline separators, U+E0B0..U+E0B3.
   #
diff --git a/modules/nixos/appimage.nix b/modules/nixos/appimage.nix
index f466063..d475331 100644
--- a/modules/nixos/appimage.nix
+++ b/modules/nixos/appimage.nix
@@ -1,5 +1,3 @@
-{ config, lib, pkgs, ... }:
-
 {
   # AppImages ship a squashfs payload that the bundled runtime mounts through
   # libfuse.so.2 at startup. nix-ld resolves the ELF interpreter but not that
diff --git a/modules/nixos/astro.nix b/modules/nixos/astro.nix
index a82dd1c..1c9d126 100644
--- a/modules/nixos/astro.nix
+++ b/modules/nixos/astro.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ lib, pkgs, ... }:
 
 let
   # Siril's Python plugins (sirilpy) run in a venv that pip-installs foreign
@@ -36,30 +36,35 @@ let
       wrapProgram $out/bin/siril \
         --prefix PATH : /etc/siril/bin \
         --prefix QT_PLUGIN_PATH : ${pkgs.adwaita-qt6}/lib/qt-6/plugins \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath (with pkgs; [
-          stdenv.cc.cc.lib   # libstdc++ / libgcc_s / libgomp  (numpy etc.)
-          zlib
-          zstd               # libzstd.so.1                     (PyQt6)
-          libGL              # libGL.so.1                       (PyQt6)
-          # PyQt6 (VeraLux) — Qt bundles xcb support so it needs these even
-          # on Wayland; libxkbcommon is the keymap lib used by Wayland too.
-          glib
-          fontconfig
-          freetype
-          dbus
-          libxkbcommon
-          # Qt platform plugins: the wayland plugin (libqwayland.so) needs the
-          # wayland client libs; the xcb fallback needs libxcb-cursor.so.0.
-          wayland            # libwayland-client/cursor/egl       (wayland plugin)
-          libxcb-cursor      # libxcb-cursor.so.0                 (xcb plugin)
-          libx11
-          libxcb
-          libxcb-util
-          libxcb-wm
-          libxcb-image
-          libxcb-keysyms
-          libxcb-render-util
-        ])}
+        --prefix LD_LIBRARY_PATH : ${
+          lib.makeLibraryPath (
+            with pkgs;
+            [
+              stdenv.cc.cc.lib # libstdc++ / libgcc_s / libgomp  (numpy etc.)
+              zlib
+              zstd # libzstd.so.1                     (PyQt6)
+              libGL # libGL.so.1                       (PyQt6)
+              # PyQt6 (VeraLux) — Qt bundles xcb support so it needs these even
+              # on Wayland; libxkbcommon is the keymap lib used by Wayland too.
+              glib
+              fontconfig
+              freetype
+              dbus
+              libxkbcommon
+              # Qt platform plugins: the wayland plugin (libqwayland.so) needs the
+              # wayland client libs; the xcb fallback needs libxcb-cursor.so.0.
+              wayland # libwayland-client/cursor/egl       (wayland plugin)
+              libxcb-cursor # libxcb-cursor.so.0                 (xcb plugin)
+              libx11
+              libxcb
+              libxcb-util
+              libxcb-wm
+              libxcb-image
+              libxcb-keysyms
+              libxcb-render-util
+            ]
+          )
+        }
     '';
   };
 in
@@ -84,7 +89,7 @@ in
   # run it. Its own opencv/onnxruntime libs are found via the bundled ./lib.
   programs.nix-ld.enable = true;
   programs.nix-ld.libraries = with pkgs; [
-    stdenv.cc.cc.lib   # libstdc++ / libgcc_s
+    stdenv.cc.cc.lib # libstdc++ / libgcc_s
     zlib
   ];
 }
diff --git a/modules/nixos/audio.nix b/modules/nixos/audio.nix
index 99627e2..7a2450d 100644
--- a/modules/nixos/audio.nix
+++ b/modules/nixos/audio.nix
@@ -1,9 +1,7 @@
-{ config, lib, pkgs, ... }:
-
 {
   # enable sound through pipewire
   services.pipewire = {
-     enable = true;
-     pulse.enable = true;
+    enable = true;
+    pulse.enable = true;
   };
 }
diff --git a/modules/nixos/bootloader.nix b/modules/nixos/bootloader.nix
index dc6f623..0afe135 100644
--- a/modules/nixos/bootloader.nix
+++ b/modules/nixos/bootloader.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # set bootloader to systemd
@@ -9,7 +9,7 @@
 
   # enable systemd initrd
   boot.initrd.systemd.enable = true;
-  
+
   # plymouth
   boot.plymouth = {
     enable = true;
@@ -17,7 +17,10 @@
   };
 
   # kernel options
-  boot.kernelParams = [ "quiet" "acpi.debug_level=0" ];
+  boot.kernelParams = [
+    "quiet"
+    "acpi.debug_level=0"
+  ];
   boot.kernelPackages = pkgs.linuxPackages_latest;
   boot.consoleLogLevel = 2;
 
diff --git a/modules/nixos/calibre.nix b/modules/nixos/calibre.nix
index c42df9b..5e42588 100644
--- a/modules/nixos/calibre.nix
+++ b/modules/nixos/calibre.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # install calibre for ebook management and kobo syncing
diff --git a/modules/nixos/certificates.nix b/modules/nixos/certificates.nix
index b5d0615..cc90cb5 100644
--- a/modules/nixos/certificates.nix
+++ b/modules/nixos/certificates.nix
@@ -1,5 +1,3 @@
-{ config, lib, pkgs, ... }:
-
 let
   caddyRootCA = ''
     -----BEGIN CERTIFICATE-----
diff --git a/modules/nixos/claudecode.nix b/modules/nixos/claudecode.nix
index 1135868..c1b1097 100644
--- a/modules/nixos/claudecode.nix
+++ b/modules/nixos/claudecode.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   environment.systemPackages = with pkgs; [
diff --git a/modules/nixos/docker.nix b/modules/nixos/docker.nix
index c9ea036..1307a73 100644
--- a/modules/nixos/docker.nix
+++ b/modules/nixos/docker.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ...}:
+{ pkgs, ... }:
 
 {
   # add docker group to user
@@ -8,7 +8,10 @@
     enable = true;
     # Customize Docker daemon settings
     daemon.settings = {
-      dns = [ "1.1.1.1" "8.8.8.8" ];
+      dns = [
+        "1.1.1.1"
+        "8.8.8.8"
+      ];
       log-driver = "journald";
       registry-mirrors = [ "https://mirror.gcr.io" ];
       storage-driver = "overlay2";
diff --git a/modules/nixos/drives.nix b/modules/nixos/drives.nix
index 6cc1df2..d7a3dce 100644
--- a/modules/nixos/drives.nix
+++ b/modules/nixos/drives.nix
@@ -1,5 +1,3 @@
-{ config, lib, pkgs, ... }:
-
 # Add encrypted drives to argon
 
 {
diff --git a/modules/nixos/gnupg.nix b/modules/nixos/gnupg.nix
index 6e1233c..ff8d3bc 100644
--- a/modules/nixos/gnupg.nix
+++ b/modules/nixos/gnupg.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, pkgs, ... }:
 
 {
   # enable gnupg agent
diff --git a/modules/nixos/gnuradio.nix b/modules/nixos/gnuradio.nix
index 4f859b6..c7a3fc3 100644
--- a/modules/nixos/gnuradio.nix
+++ b/modules/nixos/gnuradio.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # install gnuradio companion along with it's osmocom library
diff --git a/modules/nixos/graphics.nix b/modules/nixos/graphics.nix
index 668a0e9..ade9567 100644
--- a/modules/nixos/graphics.nix
+++ b/modules/nixos/graphics.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # enable amd GPU acceleration (mesa, vulkan, egl)
@@ -11,7 +11,7 @@
   environment.systemPackages = with pkgs; [
     amdgpu_top
   ];
-  
+
   # add amdgpu to the initrd for plymouth
   hardware.amdgpu.initrd.enable = true;
 }
diff --git a/modules/nixos/greetd.nix b/modules/nixos/greetd.nix
index cca87ec..6c62f0b 100644
--- a/modules/nixos/greetd.nix
+++ b/modules/nixos/greetd.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # greetd display manager with tuigreet
diff --git a/modules/nixos/locales.nix b/modules/nixos/locales.nix
index 2e81af9..f2b0fd9 100644
--- a/modules/nixos/locales.nix
+++ b/modules/nixos/locales.nix
@@ -1,5 +1,3 @@
-{ config, lib, pkgs, ... }:
-
 {
   # set the time zone
   time.timeZone = "Europe/Zurich";
diff --git a/modules/nixos/networking.nix b/modules/nixos/networking.nix
index 04d716e..e30d243 100644
--- a/modules/nixos/networking.nix
+++ b/modules/nixos/networking.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # user networkmanager
@@ -13,7 +13,7 @@
 
   # enable bluetooth
   hardware.bluetooth.enable = true;
-  
+
   # Add network-related packages
   environment.systemPackages = with pkgs; [
     wireguard-tools
diff --git a/modules/nixos/niri.nix b/modules/nixos/niri.nix
index 844c002..41b6ceb 100644
--- a/modules/nixos/niri.nix
+++ b/modules/nixos/niri.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # just enable and install niri
diff --git a/modules/nixos/noctalia.nix b/modules/nixos/noctalia.nix
index c1809b4..1e66649 100644
--- a/modules/nixos/noctalia.nix
+++ b/modules/nixos/noctalia.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ pkgs, inputs, ... }:
 {
   # install noctalia and helper packages
   environment.systemPackages = with pkgs; [
diff --git a/modules/nixos/openssh.nix b/modules/nixos/openssh.nix
index 7b55b1d..207224a 100644
--- a/modules/nixos/openssh.nix
+++ b/modules/nixos/openssh.nix
@@ -1,5 +1,3 @@
-{ config, lib, pkgs, ... }:
-
 {
   # enable the openssh daemon
   services.openssh = {
diff --git a/modules/nixos/packages.nix b/modules/nixos/packages.nix
index 4a40962..62b0cf7 100644
--- a/modules/nixos/packages.nix
+++ b/modules/nixos/packages.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # system packages
diff --git a/modules/nixos/protonvpn.nix b/modules/nixos/protonvpn.nix
index e2737af..c8dc1fe 100644
--- a/modules/nixos/protonvpn.nix
+++ b/modules/nixos/protonvpn.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # protonvpn uses wireguard tunnels, which break strict reverse path filtering
diff --git a/modules/nixos/sddm.nix b/modules/nixos/sddm.nix
index 4666015..ff01042 100644
--- a/modules/nixos/sddm.nix
+++ b/modules/nixos/sddm.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # enable sddm and use astronaut theme
diff --git a/modules/nixos/services.nix b/modules/nixos/services.nix
index 6cd2ae1..cb716d2 100644
--- a/modules/nixos/services.nix
+++ b/modules/nixos/services.nix
@@ -1,5 +1,3 @@
-{ config, lib, pkgs, ... }:
-
 {
   # list of enabled services on the system
   services = {
diff --git a/modules/nixos/settings.nix b/modules/nixos/settings.nix
index 7ef1993..b09a9a3 100644
--- a/modules/nixos/settings.nix
+++ b/modules/nixos/settings.nix
@@ -1,17 +1,18 @@
-{ config, lib, pkgs, ... }:
-
 {
   nix = {
     # nix settings
     settings = {
       # enable flakes and nix-command
-      experimental-features = [ "nix-command" "flakes" ];
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
       # auto-optimize my nix-store
       auto-optimise-store = true;
       # use all cores
-      max-jobs = "auto";  
+      max-jobs = "auto";
       # use all available cores per job
-      cores = 0;          
+      cores = 0;
       # add trusted substituters (binary caches)
       substituters = [
         "https://cache.nixos.org"
@@ -23,7 +24,7 @@
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       ];
     };
-    
+
     # enable automatic garbage collection
     gc = {
       automatic = true;
@@ -31,9 +32,12 @@
       options = "--delete-older-than 7d";
     };
   };
-  
+
   # add trusted users (able to modify the nix store)
-  nix.settings.trusted-users = [ "root" "@wheel" ];
+  nix.settings.trusted-users = [
+    "root"
+    "@wheel"
+  ];
 
   # allow unfree packages (steam, protonvpn, discord, etc.)
   nixpkgs.config.allowUnfree = true;
diff --git a/modules/nixos/steam.nix b/modules/nixos/steam.nix
index 6e9d450..88671e2 100644
--- a/modules/nixos/steam.nix
+++ b/modules/nixos/steam.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # enable steam and open firewall
diff --git a/modules/nixos/thunar.nix b/modules/nixos/thunar.nix
index d020ac3..f52061a 100644
--- a/modules/nixos/thunar.nix
+++ b/modules/nixos/thunar.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # Enable Thunar
diff --git a/modules/nixos/users.nix b/modules/nixos/users.nix
index 91aba98..bd952dd 100644
--- a/modules/nixos/users.nix
+++ b/modules/nixos/users.nix
@@ -1,11 +1,15 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # create users
   users.users.aaron = {
     isNormalUser = true;
     group = "users";
-    extraGroups = [ "wheel" "networkmanager" "dialout" ];
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+      "dialout"
+    ];
     shell = pkgs.zsh;
   };
 
diff --git a/modules/nixos/vial.nix b/modules/nixos/vial.nix
index d66cd9d..5ffef76 100644
--- a/modules/nixos/vial.nix
+++ b/modules/nixos/vial.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   # Vial-capable keyboards (lily58 pro r2g) expose a second, non-keyboard raw
diff --git a/statix.toml b/statix.toml
new file mode 100644
index 0000000..ec20aea
--- /dev/null
+++ b/statix.toml
@@ -0,0 +1,8 @@
+# statix configuration (run via `lint` in the devenv)
+
+# Flat assignments like `boot.loader = ...; boot.plymouth = ...;` are the
+# preferred style in this repo, so don't ask for them to be merged.
+disabled = [ "repeated_keys" ]
+
+# Generated by nixos-generate-config, not maintained by hand.
+ignore = [ "hosts/*/hardware-configuration.nix" ]
diff --git a/users/aaron/home.nix b/users/aaron/home.nix
index 96309f9..22caf6c 100644
--- a/users/aaron/home.nix
+++ b/users/aaron/home.nix
@@ -1,5 +1,3 @@
-{ config, pkgs, ... }:
-
 {
   imports = [
     ../../modules/home-manager/fonts.nix