diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 8d6cfb9..40835e3 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -9,4 +9,4 @@ jobs:
       - uses: actions/checkout@v4
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
-      - run: nix --accept-flake-config flake check
+      - run: nix flake check
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index ec548ca..6be46bc 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -21,10 +21,10 @@ jobs:
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
       - run: |
-          nix --accept-flake-config build .#program-docs
+          nix build .#program-docs
           mkdir docs
           cp -r result docs/programs
-          nix --accept-flake-config build .#nixos-manual
+          nix build .#nixos-manual
           cp -r result docs/nixos-modules
       - uses: actions/upload-pages-artifact@v3
         with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b3ff3d..7d3f515 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [6.1.0](https://github.com/molybdenumsoftware/pr-tracker/compare/v6.0.0...v6.1.0) (2025-01-08)
+
+
+### Features
+
+* **flake:** no experimental features ([e324e34](https://github.com/molybdenumsoftware/pr-tracker/commit/e324e3499bdb620af8b7228a2e85ba3fde69a24e))
+
 ## [6.0.0](https://github.com/molybdenumsoftware/pr-tracker/compare/v5.1.0...v6.0.0) (2024-12-31)
 
 
diff --git a/Cargo.lock b/Cargo.lock
index b1b07ad..63ae1b1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -451,7 +451,7 @@ dependencies = [
 
 [[package]]
 name = "db-context"
-version = "6.0.0"
+version = "6.1.0"
 dependencies = [
  "camino",
  "fragile-child",
@@ -670,7 +670,7 @@ dependencies = [
 
 [[package]]
 name = "fragile-child"
-version = "6.0.0"
+version = "6.1.0"
 
 [[package]]
 name = "futures"
@@ -2478,7 +2478,7 @@ checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "pr-tracker-api"
-version = "6.0.0"
+version = "6.1.0"
 dependencies = [
  "anyhow",
  "camino",
@@ -2501,7 +2501,7 @@ dependencies = [
 
 [[package]]
 name = "pr-tracker-api-config"
-version = "6.0.0"
+version = "6.1.0"
 dependencies = [
  "camino",
  "confique",
@@ -2510,7 +2510,7 @@ dependencies = [
 
 [[package]]
 name = "pr-tracker-fetcher"
-version = "6.0.0"
+version = "6.1.0"
 dependencies = [
  "anyhow",
  "camino",
@@ -2539,7 +2539,7 @@ dependencies = [
 
 [[package]]
 name = "pr-tracker-fetcher-config"
-version = "6.0.0"
+version = "6.1.0"
 dependencies = [
  "camino",
  "confique",
@@ -2548,7 +2548,7 @@ dependencies = [
 
 [[package]]
 name = "pr-tracker-store"
-version = "6.0.0"
+version = "6.1.0"
 dependencies = [
  "derive_more",
  "futures",
@@ -3655,7 +3655,7 @@ checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
 [[package]]
 name = "util"
-version = "6.0.0"
+version = "6.1.0"
 dependencies = [
  "db-context",
  "futures",
diff --git a/Cargo.toml b/Cargo.toml
index 91a6f76..57f7993 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,4 +28,4 @@ authors = ["Molybdenum Software"]
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/molybdenumsoftware/pr-tracker"
-version = "6.0.0"
+version = "6.1.0"
diff --git a/attrsToURLParams.nix b/attrsToURLParams.nix
index 6c900bb..15fecc2 100644
--- a/attrsToURLParams.nix
+++ b/attrsToURLParams.nix
@@ -3,8 +3,10 @@
   concatStringsSep,
   escapeURL,
   ...
-}: attrs: let
+}:
+attrs:
+let
   pairs = map (param: "${escapeURL param.name}=${escapeURL param.value}") (attrsToList attrs);
   params = concatStringsSep "&" pairs;
 in
-  params
+params
diff --git a/filterOptions.nix b/filterOptions.nix
index bbfe691..4b41dc1 100644
--- a/filterOptions.nix
+++ b/filterOptions.nix
@@ -3,23 +3,26 @@
   isOption,
   traceVal,
   ...
-}: predicate: options: let
+}:
+predicate: options:
+let
   inherit (builtins) isAttrs;
 
-  recurse = path: options:
-    concatMapAttrs
-    (
-      name: value: let
-        newPath = path ++ [name];
+  recurse =
+    path: options:
+    concatMapAttrs (
+      name: value:
+      let
+        newPath = path ++ [ name ];
       in
-        if !(isAttrs value)
-        then {${name} = value;}
-        else if !(isOption value)
-        then {${name} = recurse newPath value;}
-        else if predicate newPath value
-        then {${name} = value;}
-        else {}
-    )
-    options;
+      if !(isAttrs value) then
+        { ${name} = value; }
+      else if !(isOption value) then
+        { ${name} = recurse newPath value; }
+      else if predicate newPath value then
+        { ${name} = value; }
+      else
+        { }
+    ) options;
 in
-  recurse [] options
+recurse [ ] options
diff --git a/flake.lock b/flake.lock
index 78305b9..9ccae6a 100644
--- a/flake.lock
+++ b/flake.lock
@@ -207,16 +207,17 @@
         ]
       },
       "locked": {
-        "lastModified": 1735539383,
-        "narHash": "sha256-ihz2mnZU+Z2KZJkBHC3wabvWGVt8vlDfvY1M64KOHEc=",
+        "lastModified": 1735824621,
+        "narHash": "sha256-j75ZftbrZTgbB0jz6pqqgTnKiUyPMLXwDaRjK38r7PA=",
         "owner": "yusdacra",
         "repo": "nix-cargo-integration",
-        "rev": "8f6c50da99e9832e6d64133c24eafd74b567480f",
+        "rev": "9f7e28da21e6e62006588c9486256e2064fdb8f5",
         "type": "github"
       },
       "original": {
         "owner": "yusdacra",
         "repo": "nix-cargo-integration",
+        "rev": "9f7e28da21e6e62006588c9486256e2064fdb8f5",
         "type": "github"
       }
     },
@@ -319,11 +320,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1735525800,
-        "narHash": "sha256-pcN8LAL021zdC99a9F7iEiFCI1wmrE4DpIYUgKpB/jY=",
+        "lastModified": 1736216977,
+        "narHash": "sha256-EMueGrzBpryM8mgOyoyJ7DdNRRk09ug1ggcLLp0WrCQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "10faa81b4c0135a04716cbd1649260d82b2890cd",
+        "rev": "bbe7e4e7a70d235db4bbdcabbf8a2f6671881dd7",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index f4b5518..4306c04 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,9 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
 
-    nci.url = "github:yusdacra/nix-cargo-integration";
+    # TODO: unpin once upstream issue with clippy is resolved.
+    # nci.url = "github:yusdacra/nix-cargo-integration";
+    nci.url = "github:yusdacra/nix-cargo-integration/9f7e28da21e6e62006588c9486256e2064fdb8f5";
     nci.inputs.nixpkgs.follows = "nixpkgs";
     nci.inputs.parts.follows = "flake-parts";
     nci.inputs.treefmt.follows = "treefmt-nix";
@@ -22,28 +24,30 @@
     treefmt-nix.url = "github:numtide/treefmt-nix";
   };
 
-  outputs = inputs:
-    inputs.flake-parts.lib.mkFlake {inherit inputs;} ({inputs, ...}: {
-      systems = import inputs.systems;
-      imports = [
-        ./modules/api
-        ./modules/db-context.nix
-        ./modules/dev-shell.nix
-        ./modules/fetcher
-        ./modules/filter-options.nix
-        ./modules/formatting.nix
-        ./modules/integration-tests
-        ./modules/nci.nix
-        ./modules/nixos-manual
-        ./modules/nixos-modules-lib.nix
-        ./modules/private-nixos-modules
-        ./modules/program-docs.nix
-        ./modules/release
-        ./modules/store.nix
-        ./modules/util.nix
-        ./modules/git-hooks.nix
-      ];
-    });
-
-  nixConfig.extra-experimental-features = ["pipe-operators" "no-url-literals"];
+  outputs =
+    inputs:
+    inputs.flake-parts.lib.mkFlake { inherit inputs; } (
+      { inputs, ... }:
+      {
+        systems = import inputs.systems;
+        imports = [
+          ./modules/api
+          ./modules/db-context.nix
+          ./modules/dev-shell.nix
+          ./modules/fetcher
+          ./modules/filter-options.nix
+          ./modules/formatting.nix
+          ./modules/integration-tests
+          ./modules/nci.nix
+          ./modules/nixos-manual
+          ./modules/nixos-modules-lib.nix
+          ./modules/private-nixos-modules
+          ./modules/program-docs.nix
+          ./modules/release
+          ./modules/store.nix
+          ./modules/util.nix
+          ./modules/git-hooks.nix
+        ];
+      }
+    );
 }
diff --git a/modules/api/default.nix b/modules/api/default.nix
index bcd5bc9..6e9f917 100644
--- a/modules/api/default.nix
+++ b/modules/api/default.nix
@@ -1,31 +1,37 @@
 {
-  imports = [./nixos-module.nix];
+  imports = [ ./nixos-module.nix ];
 
-  perSystem = {
-    self',
-    config,
-    ...
-  }: {
-    nci.crates = {
-      pr-tracker-api.drvConfig.mkDerivation.meta.mainProgram = "pr-tracker-api";
-      pr-tracker-api-config.excludeFromProjectDocs = false;
+  perSystem =
+    {
+      self',
+      config,
+      ...
+    }:
+    {
+      nci = {
+        crates = {
+          pr-tracker-api.drvConfig.mkDerivation.meta.mainProgram = "pr-tracker-api";
+          pr-tracker-api-config.includeInProjectDocs = true;
+        };
+        projects.default.fileset = ../../crates/api-config/PORT.md;
+      };
+      packages.api = config.nci.outputs.pr-tracker-api.packages.release;
+      checks = {
+        "packages/api" = self'.packages.api;
+        "packages/api/clippy" =
+          (config.nci.outputs.pr-tracker-api.clippy.extendModules {
+            modules = [
+              {
+                rust-crane = {
+                  buildFlags = [
+                    "--all-targets"
+                    "--all-features"
+                  ];
+                  depsDrv.mkDerivation.buildPhase = ":";
+                };
+              }
+            ];
+          }).config.public;
+      };
     };
-    packages.api = config.nci.outputs.pr-tracker-api.packages.release;
-    checks = {
-      "packages/api" = self'.packages.api;
-      "packages/api/clippy" =
-        (config.nci.outputs.pr-tracker-api.clippy.extendModules {
-          modules = [
-            {
-              rust-crane = {
-                buildFlags = ["--all-targets" "--all-features"];
-                depsDrv.mkDerivation.buildPhase = ":";
-              };
-            }
-          ];
-        })
-        .config
-        .public;
-    };
-  };
 }
diff --git a/modules/api/nixos-module.nix b/modules/api/nixos-module.nix
index a4af1b1..46b7ff1 100644
--- a/modules/api/nixos-module.nix
+++ b/modules/api/nixos-module.nix
@@ -3,82 +3,89 @@
   moduleLocation,
   privateNixosModules,
   ...
-}: {
-  flake.nixosModules.api = {
-    lib,
-    pkgs,
-    config,
-    options,
-    ...
-  }: let
-    attrsToURLParams = import ../../attrsToURLParams.nix lib;
-    nixosModuleLib = mkNixosModuleLib {inherit options config;};
+}:
+{
+  flake.nixosModules.api =
+    {
+      lib,
+      pkgs,
+      config,
+      options,
+      ...
+    }:
+    let
+      attrsToURLParams = import ../../attrsToURLParams.nix lib;
+      nixosModuleLib = mkNixosModuleLib { inherit options config; };
 
-    cfg = config.services.pr-tracker.api;
-  in {
-    # https://github.com/NixOS/nixpkgs/issues/215496
-    key = "${moduleLocation}#api";
-    _file = "${moduleLocation}#api";
+      cfg = config.services.pr-tracker.api;
+    in
+    {
+      # https://github.com/NixOS/nixpkgs/issues/215496
+      key = "${moduleLocation}#api";
+      _file = "${moduleLocation}#api";
 
-    imports = [
-      privateNixosModules.db
-    ];
+      imports = [
+        privateNixosModules.db
+      ];
 
-    options.services.pr-tracker.api.enable = lib.mkEnableOption "pr-tracker-api";
-    options.services.pr-tracker.api.package = nixosModuleLib.mkPackageOption "api";
+      options.services.pr-tracker.api.enable = lib.mkEnableOption "pr-tracker-api";
+      options.services.pr-tracker.api.package = nixosModuleLib.mkPackageOption "api";
 
-    options.services.pr-tracker.api.user = lib.mkOption {
-      type = lib.types.str;
-      description = nixosModuleLib.userDescription;
-      default = "pr-tracker-api";
-    };
+      options.services.pr-tracker.api.user = lib.mkOption {
+        type = lib.types.str;
+        description = nixosModuleLib.userDescription;
+        default = "pr-tracker-api";
+      };
 
-    options.services.pr-tracker.api.group = lib.mkOption {
-      type = lib.types.str;
-      description = nixosModuleLib.groupDescription;
-      default = "pr-tracker-api";
-    };
+      options.services.pr-tracker.api.group = lib.mkOption {
+        type = lib.types.str;
+        description = nixosModuleLib.groupDescription;
+        default = "pr-tracker-api";
+      };
 
-    options.services.pr-tracker.api.port = lib.mkOption {
-      type = lib.types.port;
-      description = builtins.readFile ../../crates/api-config/PORT.md;
-    };
+      options.services.pr-tracker.api.port = lib.mkOption {
+        type = lib.types.port;
+        description = builtins.readFile ../../crates/api-config/PORT.md;
+      };
 
-    options.services.pr-tracker.api.db = nixosModuleLib.db;
+      options.services.pr-tracker.api.db = nixosModuleLib.db;
 
-    config = lib.mkIf cfg.enable {
-      users.groups.${cfg.group} = {};
-      users.users.${cfg.user} = {
-        group = cfg.group;
-        isSystemUser = true;
-      };
+      config = lib.mkIf cfg.enable {
+        users.groups.${cfg.group} = { };
+        users.users.${cfg.user} = {
+          group = cfg.group;
+          isSystemUser = true;
+        };
 
-      systemd.services.pr-tracker-api.description = "pr-tracker-api";
+        systemd.services.pr-tracker-api.description = "pr-tracker-api";
 
-      systemd.services.pr-tracker-api.wantedBy = ["multi-user.target"];
-      systemd.services.pr-tracker-api.after = ["network.target"] ++ lib.optional cfg.db.isLocal "postgresql.service";
-      systemd.services.pr-tracker-api.bindsTo = lib.optional cfg.db.isLocal "postgresql.service";
+        systemd.services.pr-tracker-api.wantedBy = [ "multi-user.target" ];
+        systemd.services.pr-tracker-api.after = [
+          "network.target"
+        ] ++ lib.optional cfg.db.isLocal "postgresql.service";
+        systemd.services.pr-tracker-api.bindsTo = lib.optional cfg.db.isLocal "postgresql.service";
 
-      systemd.services.pr-tracker-api.script = let
-        databaseUrl = "postgresql://?${attrsToURLParams cfg.db.urlParams}";
+        systemd.services.pr-tracker-api.script =
+          let
+            databaseUrl = "postgresql://?${attrsToURLParams cfg.db.urlParams}";
 
-        passwordFile = lib.optional (cfg.db.passwordFile != null) ''
-          PASSWORD=$(${lib.getExe pkgs.urlencode} --encode-set component < ${cfg.db.passwordFile})
-          PR_TRACKER_API_DATABASE_URL="$PR_TRACKER_API_DATABASE_URL&password=$PASSWORD"
-        '';
-      in
-        lib.concatStringsSep "\n" (
-          [
-            "export PR_TRACKER_API_DATABASE_URL=${lib.escapeShellArg databaseUrl}"
-            "export PR_TRACKER_API_PORT=${lib.escapeShellArg (toString cfg.port)}"
-          ]
-          ++ passwordFile
-          ++ ["exec ${lib.getExe cfg.package}"]
-        );
-      systemd.services.pr-tracker-api.serviceConfig.User = cfg.user;
-      systemd.services.pr-tracker-api.serviceConfig.Group = cfg.group;
-      systemd.services.pr-tracker-api.serviceConfig.Type = "notify";
-      systemd.services.pr-tracker-api.serviceConfig.Restart = "always";
+            passwordFile = lib.optional (cfg.db.passwordFile != null) ''
+              PASSWORD=$(${lib.getExe pkgs.urlencode} --encode-set component < ${cfg.db.passwordFile})
+              PR_TRACKER_API_DATABASE_URL="$PR_TRACKER_API_DATABASE_URL&password=$PASSWORD"
+            '';
+          in
+          lib.concatStringsSep "\n" (
+            [
+              "export PR_TRACKER_API_DATABASE_URL=${lib.escapeShellArg databaseUrl}"
+              "export PR_TRACKER_API_PORT=${lib.escapeShellArg (toString cfg.port)}"
+            ]
+            ++ passwordFile
+            ++ [ "exec ${lib.getExe cfg.package}" ]
+          );
+        systemd.services.pr-tracker-api.serviceConfig.User = cfg.user;
+        systemd.services.pr-tracker-api.serviceConfig.Group = cfg.group;
+        systemd.services.pr-tracker-api.serviceConfig.Type = "notify";
+        systemd.services.pr-tracker-api.serviceConfig.Restart = "always";
+      };
     };
-  };
 }
diff --git a/modules/db-context.nix b/modules/db-context.nix
index 2994a0f..c0fca1a 100644
--- a/modules/db-context.nix
+++ b/modules/db-context.nix
@@ -1,8 +1,11 @@
-{lib, ...}: {
-  perSystem = {pkgs, ...}: {
-    nci.projects.default.drvConfig.env = {
-      POSTGRESQL_INITDB = lib.getExe' pkgs.postgresql "initdb";
-      POSTGRESQL_POSTGRES = lib.getExe' pkgs.postgresql "postgres";
+{ lib, ... }:
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      nci.projects.default.drvConfig.env = {
+        POSTGRESQL_INITDB = lib.getExe' pkgs.postgresql "initdb";
+        POSTGRESQL_POSTGRES = lib.getExe' pkgs.postgresql "postgres";
+      };
     };
-  };
 }
diff --git a/modules/dev-shell.nix b/modules/dev-shell.nix
index 8d5c0f7..aa9777b 100644
--- a/modules/dev-shell.nix
+++ b/modules/dev-shell.nix
@@ -1,9 +1,12 @@
-{inputs, ...}: {
+{ inputs, ... }:
+{
   imports = [
     inputs.devshell.flakeModule
   ];
-  perSystem = {config, ...}: {
-    nci.projects.default.numtideDevshell = "default";
-    checks.devshell = config.devShells.default;
-  };
+  perSystem =
+    { config, ... }:
+    {
+      nci.projects.default.numtideDevshell = "default";
+      checks.devshell = config.devShells.default;
+    };
 }
diff --git a/modules/fetcher/default.nix b/modules/fetcher/default.nix
index eb75b65..dbd7fe4 100644
--- a/modules/fetcher/default.nix
+++ b/modules/fetcher/default.nix
@@ -1,40 +1,52 @@
-{inputs, ...}: {
-  imports = [./nixos-module.nix];
+{ inputs, ... }:
+{
+  imports = [ ./nixos-module.nix ];
 
-  perSystem = {
-    self',
-    config,
-    pkgs,
-    lib,
-    ...
-  }: {
-    nci = {
-      projects.default.drvConfig.env = {
-        GITHUB_GRAPHQL_SCHEMA = "${inputs.github-graphql-schema}/schema.graphql";
-        GIT = lib.getExe pkgs.git;
-      };
-      crates = {
-        pr-tracker-fetcher.drvConfig.mkDerivation.meta.mainProgram = "pr-tracker-fetcher";
-        pr-tracker-fetcher-config.excludeFromProjectDocs = false;
+  perSystem =
+    {
+      self',
+      config,
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      nci = {
+        projects.default = {
+          drvConfig.env = {
+            GITHUB_GRAPHQL_SCHEMA = "${inputs.github-graphql-schema}/schema.graphql";
+            GIT = lib.getExe pkgs.git;
+          };
+          fileset = lib.fileset.unions [
+            ../../crates/fetcher-config/BRANCH_PATTERNS.md
+            ../../crates/fetcher-config/GITHUB_TOKEN.md
+            ../../crates/fetcher-config/GITHUB_REPO_OWNER.md
+            ../../crates/fetcher-config/GITHUB_REPO_NAME.md
+          ];
+        };
+        crates = {
+          pr-tracker-fetcher.drvConfig.mkDerivation.meta.mainProgram = "pr-tracker-fetcher";
+          pr-tracker-fetcher-config.includeInProjectDocs = true;
+        };
       };
-    };
 
-    packages.fetcher = config.nci.outputs.pr-tracker-fetcher.packages.release;
-    checks = {
-      "packages/fetcher" = self'.packages.fetcher;
-      "packages/fetcher/clippy" =
-        (config.nci.outputs.pr-tracker-fetcher.clippy.extendModules {
-          modules = [
-            {
-              rust-crane = {
-                buildFlags = ["--all-targets" "--all-features"];
-                depsDrv.mkDerivation.buildPhase = ":";
-              };
-            }
-          ];
-        })
-        .config
-        .public;
+      packages.fetcher = config.nci.outputs.pr-tracker-fetcher.packages.release;
+      checks = {
+        "packages/fetcher" = self'.packages.fetcher;
+        "packages/fetcher/clippy" =
+          (config.nci.outputs.pr-tracker-fetcher.clippy.extendModules {
+            modules = [
+              {
+                rust-crane = {
+                  buildFlags = [
+                    "--all-targets"
+                    "--all-features"
+                  ];
+                  depsDrv.mkDerivation.buildPhase = ":";
+                };
+              }
+            ];
+          }).config.public;
+      };
     };
-  };
 }
diff --git a/modules/fetcher/nixos-module.nix b/modules/fetcher/nixos-module.nix
index cf7588a..6aa9c6f 100644
--- a/modules/fetcher/nixos-module.nix
+++ b/modules/fetcher/nixos-module.nix
@@ -3,118 +3,126 @@
   moduleLocation,
   privateNixosModules,
   ...
-}: {
-  flake.nixosModules.fetcher = {
-    config,
-    lib,
-    options,
-    pkgs,
-    ...
-  }: let
-    attrsToURLParams = import ../../attrsToURLParams.nix lib;
-    nixosModuleLib = mkNixosModuleLib {inherit options config;};
-
-    cfg = config.services.pr-tracker.fetcher;
-  in {
-    # https://github.com/NixOS/nixpkgs/issues/215496
-    key = "${moduleLocation}#fetcher";
-    _file = "${moduleLocation}#fetcher";
-
-    imports = [
-      privateNixosModules.db
-    ];
-
-    options.services.pr-tracker.fetcher.enable = lib.mkEnableOption "pr-tracker-fetcher";
-    options.services.pr-tracker.fetcher.package = nixosModuleLib.mkPackageOption "fetcher";
-
-    options.services.pr-tracker.fetcher.user = lib.mkOption {
-      type = lib.types.str;
-      description = nixosModuleLib.userDescription;
-      default = "pr-tracker-fetcher";
-    };
-
-    options.services.pr-tracker.fetcher.group = lib.mkOption {
-      type = lib.types.str;
-      description = nixosModuleLib.groupDescription;
-      default = "pr-tracker-fetcher";
-    };
-
-    options.services.pr-tracker.fetcher.branchPatterns = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      description = builtins.readFile ../../crates/fetcher-config/BRANCH_PATTERNS.md;
-      example = ["release-*"];
-    };
-
-    options.services.pr-tracker.fetcher.db = nixosModuleLib.db;
-
-    options.services.pr-tracker.fetcher.githubApiTokenFile = lib.mkOption {
-      type = lib.types.path;
-      description = "Path to a file containing a " + builtins.readFile ../../crates/fetcher-config/GITHUB_TOKEN.md;
-      example = "/run/secrets/github-api.token";
-    };
+}:
+{
+  flake.nixosModules.fetcher =
+    {
+      config,
+      lib,
+      options,
+      pkgs,
+      ...
+    }:
+    let
+      attrsToURLParams = import ../../attrsToURLParams.nix lib;
+      nixosModuleLib = mkNixosModuleLib { inherit options config; };
+
+      cfg = config.services.pr-tracker.fetcher;
+    in
+    {
+      # https://github.com/NixOS/nixpkgs/issues/215496
+      key = "${moduleLocation}#fetcher";
+      _file = "${moduleLocation}#fetcher";
+
+      imports = [
+        privateNixosModules.db
+      ];
+
+      options.services.pr-tracker.fetcher.enable = lib.mkEnableOption "pr-tracker-fetcher";
+      options.services.pr-tracker.fetcher.package = nixosModuleLib.mkPackageOption "fetcher";
+
+      options.services.pr-tracker.fetcher.user = lib.mkOption {
+        type = lib.types.str;
+        description = nixosModuleLib.userDescription;
+        default = "pr-tracker-fetcher";
+      };
 
-    options.services.pr-tracker.fetcher.repo.owner = lib.mkOption {
-      type = lib.types.str;
-      description = builtins.readFile ../../crates/fetcher-config/GITHUB_REPO_OWNER.md;
-      example = "NixOS";
-    };
+      options.services.pr-tracker.fetcher.group = lib.mkOption {
+        type = lib.types.str;
+        description = nixosModuleLib.groupDescription;
+        default = "pr-tracker-fetcher";
+      };
 
-    options.services.pr-tracker.fetcher.repo.name = lib.mkOption {
-      type = lib.types.str;
-      description = builtins.readFile ../../crates/fetcher-config/GITHUB_REPO_NAME.md;
-      example = "nixpkgs";
-    };
+      options.services.pr-tracker.fetcher.branchPatterns = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = builtins.readFile ../../crates/fetcher-config/BRANCH_PATTERNS.md;
+        example = [ "release-*" ];
+      };
 
-    options.services.pr-tracker.fetcher.onCalendar = lib.mkOption {
-      type = lib.types.str;
-      description = ''
-        When to run the fetcher. This is a systemd timer `OnCalendar` string, see
-        {manpage}`systemd.time(7)` for a full specification.";
-      '';
-      example = "daily";
-    };
+      options.services.pr-tracker.fetcher.db = nixosModuleLib.db;
 
-    config = lib.mkIf cfg.enable {
-      users.groups.${cfg.group} = {};
-      users.users.${cfg.user} = {
-        group = cfg.group;
-        isSystemUser = true;
+      options.services.pr-tracker.fetcher.githubApiTokenFile = lib.mkOption {
+        type = lib.types.path;
+        description =
+          "Path to a file containing a " + builtins.readFile ../../crates/fetcher-config/GITHUB_TOKEN.md;
+        example = "/run/secrets/github-api.token";
       };
 
-      systemd.timers.pr-tracker-fetcher.timerConfig.OnCalendar = cfg.onCalendar;
-      systemd.timers.pr-tracker-fetcher.wantedBy = ["timers.target"];
+      options.services.pr-tracker.fetcher.repo.owner = lib.mkOption {
+        type = lib.types.str;
+        description = builtins.readFile ../../crates/fetcher-config/GITHUB_REPO_OWNER.md;
+        example = "NixOS";
+      };
 
-      systemd.services.pr-tracker-fetcher.description = "pr-tracker-fetcher";
-      systemd.services.pr-tracker-fetcher.after = ["network.target"] ++ lib.optional cfg.db.isLocal "postgresql.service";
-      systemd.services.pr-tracker-fetcher.requires = lib.optional cfg.db.isLocal "postgresql.service";
-      systemd.services.pr-tracker-fetcher.script = let
-        databaseUrl = "postgresql://?${attrsToURLParams cfg.db.urlParams}";
+      options.services.pr-tracker.fetcher.repo.name = lib.mkOption {
+        type = lib.types.str;
+        description = builtins.readFile ../../crates/fetcher-config/GITHUB_REPO_NAME.md;
+        example = "nixpkgs";
+      };
 
-        passwordFile = lib.optional (cfg.db.passwordFile != null) ''
-          PASSWORD=$(${lib.getExe pkgs.urlencode} --encode-set component < ${cfg.db.passwordFile})
-          PR_TRACKER_FETCHER_DATABASE_URL="$PR_TRACKER_FETCHER_DATABASE_URL&password=$PASSWORD"
+      options.services.pr-tracker.fetcher.onCalendar = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          When to run the fetcher. This is a systemd timer `OnCalendar` string, see
+          {manpage}`systemd.time(7)` for a full specification.";
         '';
-      in
-        builtins.concatStringsSep "\n" (
-          [
-            "export PR_TRACKER_FETCHER_DATABASE_URL=${lib.escapeShellArg databaseUrl}"
-            "export PR_TRACKER_FETCHER_GITHUB_REPO_OWNER=${lib.escapeShellArg cfg.repo.owner}"
-            "export PR_TRACKER_FETCHER_GITHUB_REPO_NAME=${lib.escapeShellArg cfg.repo.name}"
-            "export PR_TRACKER_FETCHER_BRANCH_PATTERNS=${lib.escapeShellArg (builtins.toJSON cfg.branchPatterns)}"
-            "export PR_TRACKER_FETCHER_GITHUB_TOKEN=$(< ${cfg.githubApiTokenFile})"
-            # CACHE_DIRECTORY is set by systemd based on the CacheDirectory setting.
-            # See https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory=
-            "export PR_TRACKER_FETCHER_CACHE_DIR=$CACHE_DIRECTORY"
-          ]
-          ++ passwordFile
-          ++ ["exec ${lib.getExe cfg.package}"]
-        );
-
-      systemd.services.pr-tracker-fetcher.serviceConfig.User = cfg.user;
-      systemd.services.pr-tracker-fetcher.serviceConfig.Group = cfg.group;
-      systemd.services.pr-tracker-fetcher.serviceConfig.Type = "oneshot";
-      systemd.services.pr-tracker-fetcher.serviceConfig.Restart = "on-failure";
-      systemd.services.pr-tracker-fetcher.serviceConfig.CacheDirectory = "pr-tracker-fetcher";
+        example = "daily";
+      };
+
+      config = lib.mkIf cfg.enable {
+        users.groups.${cfg.group} = { };
+        users.users.${cfg.user} = {
+          group = cfg.group;
+          isSystemUser = true;
+        };
+
+        systemd.timers.pr-tracker-fetcher.timerConfig.OnCalendar = cfg.onCalendar;
+        systemd.timers.pr-tracker-fetcher.wantedBy = [ "timers.target" ];
+
+        systemd.services.pr-tracker-fetcher.description = "pr-tracker-fetcher";
+        systemd.services.pr-tracker-fetcher.after = [
+          "network.target"
+        ] ++ lib.optional cfg.db.isLocal "postgresql.service";
+        systemd.services.pr-tracker-fetcher.requires = lib.optional cfg.db.isLocal "postgresql.service";
+        systemd.services.pr-tracker-fetcher.script =
+          let
+            databaseUrl = "postgresql://?${attrsToURLParams cfg.db.urlParams}";
+
+            passwordFile = lib.optional (cfg.db.passwordFile != null) ''
+              PASSWORD=$(${lib.getExe pkgs.urlencode} --encode-set component < ${cfg.db.passwordFile})
+              PR_TRACKER_FETCHER_DATABASE_URL="$PR_TRACKER_FETCHER_DATABASE_URL&password=$PASSWORD"
+            '';
+          in
+          builtins.concatStringsSep "\n" (
+            [
+              "export PR_TRACKER_FETCHER_DATABASE_URL=${lib.escapeShellArg databaseUrl}"
+              "export PR_TRACKER_FETCHER_GITHUB_REPO_OWNER=${lib.escapeShellArg cfg.repo.owner}"
+              "export PR_TRACKER_FETCHER_GITHUB_REPO_NAME=${lib.escapeShellArg cfg.repo.name}"
+              "export PR_TRACKER_FETCHER_BRANCH_PATTERNS=${lib.escapeShellArg (builtins.toJSON cfg.branchPatterns)}"
+              "export PR_TRACKER_FETCHER_GITHUB_TOKEN=$(< ${cfg.githubApiTokenFile})"
+              # CACHE_DIRECTORY is set by systemd based on the CacheDirectory setting.
+              # See https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory=
+              "export PR_TRACKER_FETCHER_CACHE_DIR=$CACHE_DIRECTORY"
+            ]
+            ++ passwordFile
+            ++ [ "exec ${lib.getExe cfg.package}" ]
+          );
+
+        systemd.services.pr-tracker-fetcher.serviceConfig.User = cfg.user;
+        systemd.services.pr-tracker-fetcher.serviceConfig.Group = cfg.group;
+        systemd.services.pr-tracker-fetcher.serviceConfig.Type = "oneshot";
+        systemd.services.pr-tracker-fetcher.serviceConfig.Restart = "on-failure";
+        systemd.services.pr-tracker-fetcher.serviceConfig.CacheDirectory = "pr-tracker-fetcher";
+      };
     };
-  };
 }
diff --git a/modules/filter-options.nix b/modules/filter-options.nix
index 3a8f832..1199aeb 100644
--- a/modules/filter-options.nix
+++ b/modules/filter-options.nix
@@ -1,52 +1,60 @@
 {
-  perSystem = {
-    pkgs,
-    lib,
-    ...
-  }: let
-    filterOptionsCheck = let
-      subject = import ../filterOptions.nix lib;
+  perSystem =
+    {
+      pkgs,
+      lib,
+      ...
+    }:
+    let
+      filterOptionsCheck =
+        let
+          subject = import ../filterOptions.nix lib;
 
-      tests.testEmpty = {
-        expr = subject (p: o: true) {};
-        expected = {};
-      };
+          tests.testEmpty = {
+            expr = subject (p: o: true) { };
+            expected = { };
+          };
 
-      tests.testNoFilter = {
-        expr = subject (p: o: true) {foo-1 = lib.mkOption {};};
-        expected = {foo-1 = lib.mkOption {};};
-      };
+          tests.testNoFilter = {
+            expr = subject (p: o: true) { foo-1 = lib.mkOption { }; };
+            expected = {
+              foo-1 = lib.mkOption { };
+            };
+          };
 
-      tests.testFilter = {
-        expr = subject (p: o: lib.hasPrefix "foo-" o.description) {
-          foo-1 = lib.mkOption {description = "foo-1";};
-          bar-1 = lib.mkOption {description = "bar-1";};
-        };
-        expected = {
-          foo-1 = lib.mkOption {description = "foo-1";};
-        };
-      };
+          tests.testFilter = {
+            expr = subject (p: o: lib.hasPrefix "foo-" o.description) {
+              foo-1 = lib.mkOption { description = "foo-1"; };
+              bar-1 = lib.mkOption { description = "bar-1"; };
+            };
+            expected = {
+              foo-1 = lib.mkOption { description = "foo-1"; };
+            };
+          };
 
-      tests.testFilterDeep = {
-        expr = subject (p: o: o.description == "foo") {
-          nested.foo = lib.mkOption {description = "foo";};
-          nested.bar = lib.mkOption {description = "bar";};
-        };
-        expected.nested.foo = lib.mkOption {description = "foo";};
-      };
+          tests.testFilterDeep = {
+            expr = subject (p: o: o.description == "foo") {
+              nested.foo = lib.mkOption { description = "foo"; };
+              nested.bar = lib.mkOption { description = "bar"; };
+            };
+            expected.nested.foo = lib.mkOption { description = "foo"; };
+          };
 
-      tests.testFilterPath = {
-        expr = subject (p: o: lib.elem "foo" p) {
-          nested.foo = lib.mkOption {};
-          nested.bar = lib.mkOption {};
-        };
-        expected.nested.foo = lib.mkOption {};
-      };
+          tests.testFilterPath = {
+            expr = subject (p: o: lib.elem "foo" p) {
+              nested.foo = lib.mkOption { };
+              nested.bar = lib.mkOption { };
+            };
+            expected.nested.foo = lib.mkOption { };
+          };
 
-      failures = lib.debug.runTests tests;
+          failures = lib.debug.runTests tests;
+        in
+        lib.assertMsg (failures == [ ]) (builtins.toJSON failures);
     in
-      lib.assertMsg (failures == []) (builtins.toJSON failures);
-  in {
-    checks.filterOptions = assert filterOptionsCheck; pkgs.hello;
-  };
+    {
+      checks.filterOptions =
+        assert filterOptionsCheck;
+        pkgs.hello;
+    };
 }
diff --git a/modules/formatting.nix b/modules/formatting.nix
index db7ad54..7a8e0b1 100644
--- a/modules/formatting.nix
+++ b/modules/formatting.nix
@@ -1,4 +1,5 @@
-{inputs, ...}: {
+{ inputs, ... }:
+{
   imports = [
     inputs.treefmt-nix.flakeModule
   ];
@@ -11,7 +12,7 @@
     treefmt = {
       projectRootFile = "flake.nix";
       programs = {
-        alejandra.enable = true;
+        nixfmt.enable = true;
         prettier.enable = true;
         toml-sort = {
           enable = true;
diff --git a/modules/git-hooks.nix b/modules/git-hooks.nix
index 39f778d..e18f27b 100644
--- a/modules/git-hooks.nix
+++ b/modules/git-hooks.nix
@@ -1,7 +1,10 @@
-{inputs, ...}: {
-  imports = [inputs.git-hooks-nix.flakeModule];
-  perSystem = {config, ...}: {
-    pre-commit.check.enable = false;
-    devshells.default.devshell.startup.git-hooks.text = config.pre-commit.installationScript;
-  };
+{ inputs, ... }:
+{
+  imports = [ inputs.git-hooks-nix.flakeModule ];
+  perSystem =
+    { config, ... }:
+    {
+      pre-commit.check.enable = false;
+      devshells.default.devshell.startup.git-hooks.text = config.pre-commit.installationScript;
+    };
 }
diff --git a/modules/integration-tests/api/default-package.nix b/modules/integration-tests/api/default-package.nix
index 478db0a..86ee5c0 100644
--- a/modules/integration-tests/api/default-package.nix
+++ b/modules/integration-tests/api/default-package.nix
@@ -1,26 +1,31 @@
-{self, ...}: {
-  perSystem = {
-    pkgs,
-    nodeToApiTest,
-    ...
-  }: {
-    checks."integration/api/default-package" = nodeToApiTest "api with default pacakge" (let
-      inherit
-        (pkgs)
-        system
-        ;
-      port = 7000;
-      pgPort = 5432;
-    in {
-      imports = [self.nixosModules.api];
+{ self, ... }:
+{
+  perSystem =
+    {
+      pkgs,
+      nodeToApiTest,
+      ...
+    }:
+    {
+      checks."integration/api/default-package" = nodeToApiTest "api with default pacakge" (
+        let
+          inherit (pkgs)
+            system
+            ;
+          port = 7000;
+          pgPort = 5432;
+        in
+        {
+          imports = [ self.nixosModules.api ];
 
-      nixpkgs.hostPlatform = system;
+          nixpkgs.hostPlatform = system;
 
-      services.pr-tracker.api.enable = true;
-      systemd.services.pr-tracker-api.environment.RUST_BACKTRACE = "1";
-      services.pr-tracker.api.port = port;
-      services.pr-tracker.api.user = "pr-tracker-api";
-      services.pr-tracker.db.createLocally = true;
-    });
-  };
+          services.pr-tracker.api.enable = true;
+          systemd.services.pr-tracker-api.environment.RUST_BACKTRACE = "1";
+          services.pr-tracker.api.port = port;
+          services.pr-tracker.api.user = "pr-tracker-api";
+          services.pr-tracker.db.createLocally = true;
+        }
+      );
+    };
 }
diff --git a/modules/integration-tests/api/default.nix b/modules/integration-tests/api/default.nix
index 640d463..1600d5f 100644
--- a/modules/integration-tests/api/default.nix
+++ b/modules/integration-tests/api/default.nix
@@ -1,18 +1,21 @@
 {
-  perSystem = {pkgs, ...}: {
-    _module.args.nodeToApiTest = name: node:
-      pkgs.nixosTest {
-        inherit name;
+  perSystem =
+    { pkgs, ... }:
+    {
+      _module.args.nodeToApiTest =
+        name: node:
+        pkgs.nixosTest {
+          inherit name;
 
-        nodes.pr_tracker_api = node;
+          nodes.pr_tracker_api = node;
 
-        testScript = ''
-          pr_tracker_api.start()
-          pr_tracker_api.wait_for_unit("pr-tracker-api.service")
-          pr_tracker_api.succeed("curl --fail http://localhost:7000/api/v1/healthcheck")
-        '';
-      };
-  };
+          testScript = ''
+            pr_tracker_api.start()
+            pr_tracker_api.wait_for_unit("pr-tracker-api.service")
+            pr_tracker_api.succeed("curl --fail http://localhost:7000/api/v1/healthcheck")
+          '';
+        };
+    };
   imports = [
     ./default-package.nix
     ./tcp-db.nix
diff --git a/modules/integration-tests/api/tcp-db.nix b/modules/integration-tests/api/tcp-db.nix
index 43252a6..baedc69 100644
--- a/modules/integration-tests/api/tcp-db.nix
+++ b/modules/integration-tests/api/tcp-db.nix
@@ -1,60 +1,62 @@
-{self, ...}: {
-  perSystem = {
-    nodeToApiTest,
-    pkgs,
-    ...
-  }: {
-    checks."integration/api/tcp-db" = nodeToApiTest "api with tcp db" (let
-      inherit
-        (pkgs)
-        system
-        writeText
-        ;
-      dbPass = "api-db-secret";
-      port = 7000;
-      pgPort = 5432;
-      user = "pr-tracker";
-    in {
-      imports = [self.nixosModules.api];
+{ self, ... }:
+{
+  perSystem =
+    {
+      nodeToApiTest,
+      pkgs,
+      ...
+    }:
+    {
+      checks."integration/api/tcp-db" = nodeToApiTest "api with tcp db" (
+        let
+          inherit (pkgs)
+            system
+            writeText
+            ;
+          dbPass = "api-db-secret";
+          port = 7000;
+          pgPort = 5432;
+          user = "pr-tracker";
+        in
+        {
+          imports = [ self.nixosModules.api ];
 
-      nixpkgs.hostPlatform = system;
+          nixpkgs.hostPlatform = system;
 
-      services.postgresql.enable = true;
-      services.postgresql.settings.port = pgPort;
-      services.postgresql.enableTCPIP = true;
-      services.postgresql.initialScript = writeText "postgresql-init-script" ''
-        CREATE ROLE "${user}" WITH LOGIN PASSWORD '${dbPass}';
-      '';
-      services.postgresql.authentication =
-        # type   database  user  address    auth-method
-        ''
-          host   all       all   0.0.0.0/0  md5
-        '';
-      services.postgresql.ensureDatabases = [user];
-      services.postgresql.ensureUsers = [
-        {
-          name = user;
-          ensureDBOwnership = true;
-        }
-      ];
+          services.postgresql.enable = true;
+          services.postgresql.settings.port = pgPort;
+          services.postgresql.enableTCPIP = true;
+          services.postgresql.initialScript = writeText "postgresql-init-script" ''
+            CREATE ROLE "${user}" WITH LOGIN PASSWORD '${dbPass}';
+          '';
+          services.postgresql.authentication =
+            # type   database  user  address    auth-method
+            ''
+              host   all       all   0.0.0.0/0  md5
+            '';
+          services.postgresql.ensureDatabases = [ user ];
+          services.postgresql.ensureUsers = [
+            {
+              name = user;
+              ensureDBOwnership = true;
+            }
+          ];
 
-      services.pr-tracker.api.enable = true;
-      services.pr-tracker.api.package =
-        (self.packages.${system}.api.extendModules
-          {
-            modules = [{mkDerivation.dontStrip = true;}];
-          })
-        .config
-        .public;
-      systemd.services.pr-tracker-api.environment.RUST_BACKTRACE = "1";
-      services.pr-tracker.api.port = port;
-      services.pr-tracker.api.user = user;
-      services.pr-tracker.api.db.urlParams.user = user;
-      services.pr-tracker.api.db.urlParams.host = "localhost";
-      services.pr-tracker.api.db.urlParams.port = toString pgPort;
-      services.pr-tracker.api.db.urlParams.dbname = user;
-      services.pr-tracker.api.db.passwordFile = writeText "password-file" dbPass;
-      services.pr-tracker.api.db.isLocal = true;
-    });
-  };
+          services.pr-tracker.api.enable = true;
+          services.pr-tracker.api.package =
+            (self.packages.${system}.api.extendModules {
+              modules = [ { mkDerivation.dontStrip = true; } ];
+            }).config.public;
+          systemd.services.pr-tracker-api.environment.RUST_BACKTRACE = "1";
+          services.pr-tracker.api.port = port;
+          services.pr-tracker.api.user = user;
+          services.pr-tracker.api.db.urlParams.user = user;
+          services.pr-tracker.api.db.urlParams.host = "localhost";
+          services.pr-tracker.api.db.urlParams.port = toString pgPort;
+          services.pr-tracker.api.db.urlParams.dbname = user;
+          services.pr-tracker.api.db.passwordFile = writeText "password-file" dbPass;
+          services.pr-tracker.api.db.isLocal = true;
+        }
+      );
+    };
 }
diff --git a/modules/integration-tests/create-locally.nix b/modules/integration-tests/create-locally.nix
index 334a0ca..d644fbd 100644
--- a/modules/integration-tests/create-locally.nix
+++ b/modules/integration-tests/create-locally.nix
@@ -1,59 +1,59 @@
-{self, ...}: let
+{ self, ... }:
+let
   apiPort = 7000;
-in {
-  perSystem = {pkgs, ...}: {
-    checks."integration/create-locally" = pkgs.nixosTest {
-      name = "db.createLocally";
+in
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      checks."integration/create-locally" = pkgs.nixosTest {
+        name = "db.createLocally";
 
-      nodes.pr_tracker = {pkgs, ...}: let
-        inherit
-          (pkgs)
-          system
-          writeText
-          ;
-      in {
-        imports = [
-          self.nixosModules.api
-          self.nixosModules.fetcher
-        ];
+        nodes.pr_tracker =
+          { pkgs, ... }:
+          let
+            inherit (pkgs)
+              system
+              writeText
+              ;
+          in
+          {
+            imports = [
+              self.nixosModules.api
+              self.nixosModules.fetcher
+            ];
 
-        nixpkgs.hostPlatform = system;
+            nixpkgs.hostPlatform = system;
 
-        services.pr-tracker.db.createLocally = true;
+            services.pr-tracker.db.createLocally = true;
 
-        services.pr-tracker.api.enable = true;
-        services.pr-tracker.api.package =
-          (self.packages.${system}.api.extendModules
-            {
-              modules = [{mkDerivation.dontStrip = true;}];
-            })
-          .config
-          .public;
-        systemd.services.pr-tracker-api.environment.RUST_BACKTRACE = "1";
-        services.pr-tracker.api.port = apiPort;
+            services.pr-tracker.api.enable = true;
+            services.pr-tracker.api.package =
+              (self.packages.${system}.api.extendModules {
+                modules = [ { mkDerivation.dontStrip = true; } ];
+              }).config.public;
+            systemd.services.pr-tracker-api.environment.RUST_BACKTRACE = "1";
+            services.pr-tracker.api.port = apiPort;
 
-        services.pr-tracker.fetcher.enable = true;
-        services.pr-tracker.fetcher.package =
-          (self.packages.${system}.fetcher.extendModules
-            {
-              modules = [{mkDerivation.dontStrip = true;}];
-            })
-          .config
-          .public;
-        systemd.services.pr-tracker-fetcher.environment.RUST_BACKTRACE = "1";
-        services.pr-tracker.fetcher.onCalendar = "*:*:*"; # every single second
-        services.pr-tracker.fetcher.githubApiTokenFile = writeText "gh-auth-token" "hunter2";
-        services.pr-tracker.fetcher.branchPatterns = ["*"];
-        services.pr-tracker.fetcher.repo.owner = "molybdenumsoftware";
-        services.pr-tracker.fetcher.repo.name = "pr-tracker";
-      };
+            services.pr-tracker.fetcher.enable = true;
+            services.pr-tracker.fetcher.package =
+              (self.packages.${system}.fetcher.extendModules {
+                modules = [ { mkDerivation.dontStrip = true; } ];
+              }).config.public;
+            systemd.services.pr-tracker-fetcher.environment.RUST_BACKTRACE = "1";
+            services.pr-tracker.fetcher.onCalendar = "*:*:*"; # every single second
+            services.pr-tracker.fetcher.githubApiTokenFile = writeText "gh-auth-token" "hunter2";
+            services.pr-tracker.fetcher.branchPatterns = [ "*" ];
+            services.pr-tracker.fetcher.repo.owner = "molybdenumsoftware";
+            services.pr-tracker.fetcher.repo.name = "pr-tracker";
+          };
 
-      testScript = ''
-        pr_tracker.start()
-        pr_tracker.wait_for_unit("pr-tracker-api.service")
-        pr_tracker.succeed("curl --fail http://localhost:${toString apiPort}/api/v1/healthcheck")
-        pr_tracker.wait_until_succeeds("journalctl -u pr-tracker-fetcher.service --grep 'error sending request for url'", timeout=60)
-      '';
+        testScript = ''
+          pr_tracker.start()
+          pr_tracker.wait_for_unit("pr-tracker-api.service")
+          pr_tracker.succeed("curl --fail http://localhost:${toString apiPort}/api/v1/healthcheck")
+          pr_tracker.wait_until_succeeds("journalctl -u pr-tracker-fetcher.service --grep 'error sending request for url'", timeout=60)
+        '';
+      };
     };
-  };
 }
diff --git a/modules/integration-tests/fetcher/default-package.nix b/modules/integration-tests/fetcher/default-package.nix
index b3f641a..c6ae285 100644
--- a/modules/integration-tests/fetcher/default-package.nix
+++ b/modules/integration-tests/fetcher/default-package.nix
@@ -1,30 +1,35 @@
-{self, ...}: {
-  perSystem = {
-    nodeToFetcherTest,
-    pkgs,
-    ...
-  }: {
-    checks."integration/fetcher/default-package" = nodeToFetcherTest "fetcher with default package" (let
-      inherit
-        (pkgs)
-        system
-        writeText
-        ;
-      pgPort = 5432;
-    in {
-      imports = [self.nixosModules.fetcher];
+{ self, ... }:
+{
+  perSystem =
+    {
+      nodeToFetcherTest,
+      pkgs,
+      ...
+    }:
+    {
+      checks."integration/fetcher/default-package" = nodeToFetcherTest "fetcher with default package" (
+        let
+          inherit (pkgs)
+            system
+            writeText
+            ;
+          pgPort = 5432;
+        in
+        {
+          imports = [ self.nixosModules.fetcher ];
 
-      nixpkgs.hostPlatform = system;
+          nixpkgs.hostPlatform = system;
 
-      services.pr-tracker.fetcher.enable = true;
-      systemd.services.pr-tracker-fetcher.environment.RUST_BACKTRACE = "1";
-      services.pr-tracker.fetcher.user = "pr-tracker-fetcher";
-      services.pr-tracker.db.createLocally = true;
-      services.pr-tracker.fetcher.onCalendar = "*:*:*"; # every single second
-      services.pr-tracker.fetcher.githubApiTokenFile = writeText "gh-auth-token" "hunter2";
-      services.pr-tracker.fetcher.branchPatterns = ["*"];
-      services.pr-tracker.fetcher.repo.owner = "molybdenumsoftware";
-      services.pr-tracker.fetcher.repo.name = "pr-tracker";
-    });
-  };
+          services.pr-tracker.fetcher.enable = true;
+          systemd.services.pr-tracker-fetcher.environment.RUST_BACKTRACE = "1";
+          services.pr-tracker.fetcher.user = "pr-tracker-fetcher";
+          services.pr-tracker.db.createLocally = true;
+          services.pr-tracker.fetcher.onCalendar = "*:*:*"; # every single second
+          services.pr-tracker.fetcher.githubApiTokenFile = writeText "gh-auth-token" "hunter2";
+          services.pr-tracker.fetcher.branchPatterns = [ "*" ];
+          services.pr-tracker.fetcher.repo.owner = "molybdenumsoftware";
+          services.pr-tracker.fetcher.repo.name = "pr-tracker";
+        }
+      );
+    };
 }
diff --git a/modules/integration-tests/fetcher/default.nix b/modules/integration-tests/fetcher/default.nix
index 692cf6f..72cc851 100644
--- a/modules/integration-tests/fetcher/default.nix
+++ b/modules/integration-tests/fetcher/default.nix
@@ -1,17 +1,21 @@
-{self, ...}: {
-  perSystem = {pkgs, ...}: {
-    _module.args.nodeToFetcherTest = name: node:
-      pkgs.nixosTest {
-        inherit name;
+{ self, ... }:
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      _module.args.nodeToFetcherTest =
+        name: node:
+        pkgs.nixosTest {
+          inherit name;
 
-        nodes.pr_tracker_fetcher = node;
+          nodes.pr_tracker_fetcher = node;
 
-        testScript = ''
-          pr_tracker_fetcher.start()
-          pr_tracker_fetcher.wait_until_succeeds("journalctl -u pr-tracker-fetcher.service --grep 'error sending request for url'", timeout=60)
-        '';
-      };
-  };
+          testScript = ''
+            pr_tracker_fetcher.start()
+            pr_tracker_fetcher.wait_until_succeeds("journalctl -u pr-tracker-fetcher.service --grep 'error sending request for url'", timeout=60)
+          '';
+        };
+    };
 
   imports = [
     ./default-package.nix
diff --git a/modules/integration-tests/fetcher/tcp-db.nix b/modules/integration-tests/fetcher/tcp-db.nix
index 580f0f8..934e714 100644
--- a/modules/integration-tests/fetcher/tcp-db.nix
+++ b/modules/integration-tests/fetcher/tcp-db.nix
@@ -1,64 +1,66 @@
-{self, ...}: {
-  perSystem = {
-    nodeToFetcherTest,
-    pkgs,
-    ...
-  }: {
-    checks."integration/fetcher/tcp-db" = nodeToFetcherTest "fetcher with tcp db" (let
-      inherit
-        (pkgs)
-        system
-        writeText
-        ;
+{ self, ... }:
+{
+  perSystem =
+    {
+      nodeToFetcherTest,
+      pkgs,
+      ...
+    }:
+    {
+      checks."integration/fetcher/tcp-db" = nodeToFetcherTest "fetcher with tcp db" (
+        let
+          inherit (pkgs)
+            system
+            writeText
+            ;
 
-      pgPort = 5432;
-      user = "pr-tracker";
-      dbPass = "fetcher-db-secret";
-    in {
-      imports = [self.nixosModules.fetcher];
+          pgPort = 5432;
+          user = "pr-tracker";
+          dbPass = "fetcher-db-secret";
+        in
+        {
+          imports = [ self.nixosModules.fetcher ];
 
-      nixpkgs.hostPlatform = system;
+          nixpkgs.hostPlatform = system;
 
-      services.postgresql.enable = true;
-      services.postgresql.settings.port = pgPort;
-      services.postgresql.enableTCPIP = true;
-      services.postgresql.initialScript = writeText "postgresql-init-script" ''
-        CREATE ROLE "${user}" WITH LOGIN PASSWORD '${dbPass}';
-      '';
-      services.postgresql.authentication =
-        # type   database  user  address    auth-method
-        ''
-          host   all       all   0.0.0.0/0  md5
-        '';
-      services.postgresql.ensureDatabases = [user];
-      services.postgresql.ensureUsers = [
-        {
-          name = user;
-          ensureDBOwnership = true;
-        }
-      ];
+          services.postgresql.enable = true;
+          services.postgresql.settings.port = pgPort;
+          services.postgresql.enableTCPIP = true;
+          services.postgresql.initialScript = writeText "postgresql-init-script" ''
+            CREATE ROLE "${user}" WITH LOGIN PASSWORD '${dbPass}';
+          '';
+          services.postgresql.authentication =
+            # type   database  user  address    auth-method
+            ''
+              host   all       all   0.0.0.0/0  md5
+            '';
+          services.postgresql.ensureDatabases = [ user ];
+          services.postgresql.ensureUsers = [
+            {
+              name = user;
+              ensureDBOwnership = true;
+            }
+          ];
 
-      services.pr-tracker.fetcher.enable = true;
-      services.pr-tracker.fetcher.package =
-        (self.packages.${system}.fetcher.extendModules
-          {
-            modules = [{mkDerivation.dontStrip = true;}];
-          })
-        .config
-        .public;
-      systemd.services.pr-tracker-fetcher.environment.RUST_BACKTRACE = "1";
-      services.pr-tracker.fetcher.user = user;
-      services.pr-tracker.fetcher.db.urlParams.user = user;
-      services.pr-tracker.fetcher.db.urlParams.host = "localhost";
-      services.pr-tracker.fetcher.db.urlParams.port = toString pgPort;
-      services.pr-tracker.fetcher.db.urlParams.dbname = user;
-      services.pr-tracker.fetcher.db.passwordFile = writeText "password-file" dbPass;
-      services.pr-tracker.fetcher.db.isLocal = true;
-      services.pr-tracker.fetcher.onCalendar = "*:*:*"; # every single second
-      services.pr-tracker.fetcher.githubApiTokenFile = writeText "gh-auth-token" "hunter2";
-      services.pr-tracker.fetcher.branchPatterns = ["*"];
-      services.pr-tracker.fetcher.repo.owner = "molybdenumsoftware";
-      services.pr-tracker.fetcher.repo.name = "pr-tracker";
-    });
-  };
+          services.pr-tracker.fetcher.enable = true;
+          services.pr-tracker.fetcher.package =
+            (self.packages.${system}.fetcher.extendModules {
+              modules = [ { mkDerivation.dontStrip = true; } ];
+            }).config.public;
+          systemd.services.pr-tracker-fetcher.environment.RUST_BACKTRACE = "1";
+          services.pr-tracker.fetcher.user = user;
+          services.pr-tracker.fetcher.db.urlParams.user = user;
+          services.pr-tracker.fetcher.db.urlParams.host = "localhost";
+          services.pr-tracker.fetcher.db.urlParams.port = toString pgPort;
+          services.pr-tracker.fetcher.db.urlParams.dbname = user;
+          services.pr-tracker.fetcher.db.passwordFile = writeText "password-file" dbPass;
+          services.pr-tracker.fetcher.db.isLocal = true;
+          services.pr-tracker.fetcher.onCalendar = "*:*:*"; # every single second
+          services.pr-tracker.fetcher.githubApiTokenFile = writeText "gh-auth-token" "hunter2";
+          services.pr-tracker.fetcher.branchPatterns = [ "*" ];
+          services.pr-tracker.fetcher.repo.owner = "molybdenumsoftware";
+          services.pr-tracker.fetcher.repo.name = "pr-tracker";
+        }
+      );
+    };
 }
diff --git a/modules/nci.nix b/modules/nci.nix
index 7764819..de7503f 100644
--- a/modules/nci.nix
+++ b/modules/nci.nix
@@ -1,26 +1,77 @@
-{inputs, ...}: {
-  imports = [inputs.nci.flakeModule];
-  perSystem = {
-    pkgs,
-    config,
-    ...
-  }: {
-    nci.projects.default = {
-      path = ../.;
-      profiles = {
-        dev = {};
-        release.runTests = true;
-      };
-      clippyProfile = "release";
-      drvConfig.env.RUSTFLAGS = "--deny warnings";
-      export = false;
-    };
-    devshells.default.devshell.packages = [
-      pkgs.rust-analyzer-unwrapped # https://github.com/NixOS/nixpkgs/issues/212439
-    ];
-    treefmt.programs.rustfmt = {
-      enable = true;
-      package = config.nci.toolchains.mkBuild pkgs;
+{
+  inputs,
+  lib,
+  flake-parts-lib,
+  ...
+}:
+{
+  imports = [ inputs.nci.flakeModule ];
+
+  options.perSystem = flake-parts-lib.mkPerSystemOption {
+    options.nci.projects = lib.mkOption {
+      type = lib.types.lazyAttrsOf (
+        lib.types.submoduleWith {
+          modules = [
+            {
+              options.fileset = lib.mkOption {
+                type = lib.mkOptionType {
+                  name = "fileset";
+                  merge = _loc: defs: lib.fileset.unions (map (def: def.value) defs);
+                };
+              };
+            }
+          ];
+        }
+      );
     };
   };
+
+  config.perSystem =
+    {
+      pkgs,
+      config,
+      ...
+    }:
+    {
+      nci.projects.default = {
+        path = lib.fileset.toSource {
+          root = ../.;
+          fileset = config.nci.projects.default.fileset;
+        };
+
+        fileset = lib.fileset.unions (
+          [
+            ../Cargo.toml
+            ../Cargo.lock
+          ]
+          ++ (lib.pipe ../crates [
+            builtins.readDir
+            (lib.filterAttrs (name: type: type == "directory"))
+            (lib.mapAttrsToList (
+              name: type: [
+                (../crates + "/${name}/Cargo.toml")
+                (lib.fileset.maybeMissing (../crates + "/${name}/build.rs"))
+                (../crates + "/${name}/src")
+              ]
+            ))
+            lib.flatten
+          ])
+        );
+
+        profiles = {
+          dev = { };
+          release.runTests = true;
+        };
+        clippyProfile = "release";
+        drvConfig.env.RUSTFLAGS = "--deny warnings";
+        export = false;
+      };
+      devshells.default.devshell.packages = [
+        pkgs.rust-analyzer-unwrapped # https://github.com/NixOS/nixpkgs/issues/212439
+      ];
+      treefmt.programs.rustfmt = {
+        enable = true;
+        package = config.nci.toolchains.mkBuild pkgs;
+      };
+    };
 }
diff --git a/modules/nixos-manual/default.nix b/modules/nixos-manual/default.nix
index 875a683..51363de 100644
--- a/modules/nixos-manual/default.nix
+++ b/modules/nixos-manual/default.nix
@@ -4,74 +4,73 @@
   inputs,
   self,
   ...
-}: {
-  perSystem = {
-    self',
-    system,
-    pkgs,
-    ...
-  }: let
-    inherit
-      (lib)
-      any
-      evalModules
-      hasPrefix
-      ;
+}:
+{
+  perSystem =
+    {
+      self',
+      system,
+      pkgs,
+      ...
+    }:
+    let
+      inherit (lib)
+        any
+        evalModules
+        hasPrefix
+        ;
 
-    inherit
-      (builtins)
-      removeAttrs
-      ;
+      inherit (builtins)
+        removeAttrs
+        ;
 
-    filterOptions = import ../../filterOptions.nix lib;
+      filterOptions = import ../../filterOptions.nix lib;
 
-    configuration = evalModules {
-      modules =
-        [
+      configuration = evalModules {
+        modules = [
           self.nixosModules.api
           self.nixosModules.fetcher
           {
             nixpkgs.hostPlatform = system;
             system.stateVersion = "24.05";
           }
-        ]
-        ++ (import "${inputs.nixpkgs}/nixos/modules/module-list.nix");
-    };
+        ] ++ (import "${inputs.nixpkgs}/nixos/modules/module-list.nix");
+      };
 
-    options =
-      filterOptions
-      (path: option: any (hasPrefix "${self}/") option.declarations)
-      configuration.options;
+      options = filterOptions (
+        path: option: any (hasPrefix "${self}/") option.declarations
+      ) configuration.options;
 
-    optionsDocs = pkgs.buildPackages.nixosOptionsDoc {
-      inherit options;
-      variablelistId = "options";
-      transformOptions = options: removeAttrs options ["declarations"];
-    };
-  in {
-    packages.nixos-manual = pkgs.stdenv.mkDerivation {
-      name = "pr-tracker-nixos-modules-manual";
-      src = ./.;
-      nativeBuildInputs = [pkgs.nixos-render-docs];
+      optionsDocs = pkgs.buildPackages.nixosOptionsDoc {
+        inherit options;
+        variablelistId = "options";
+        transformOptions = options: removeAttrs options [ "declarations" ];
+      };
+    in
+    {
+      packages.nixos-manual = pkgs.stdenv.mkDerivation {
+        name = "pr-tracker-nixos-modules-manual";
+        src = ./.;
+        nativeBuildInputs = [ pkgs.nixos-render-docs ];
 
-      buildPhase = ''
-        mkdir $out
+        buildPhase = ''
+          mkdir $out
 
-        manpage_urls=$(mktemp)
-        echo "{}" > $manpage_urls
+          manpage_urls=$(mktemp)
+          echo "{}" > $manpage_urls
 
-        substituteInPlace ./manual.md \
-          --subst-var-by \
-            OPTIONS_JSON \
-            ${optionsDocs.optionsJSON}/share/doc/nixos/options.json
+          substituteInPlace ./manual.md \
+            --subst-var-by \
+              OPTIONS_JSON \
+              ${optionsDocs.optionsJSON}/share/doc/nixos/options.json
 
-        nixos-render-docs manual html \
-          --manpage-urls $manpage_urls \
-          --revision provide-because-required-but-seems-to-be-unused \
-          manual.md $out/index.html
-      '';
-    };
+          nixos-render-docs manual html \
+            --manpage-urls $manpage_urls \
+            --revision provide-because-required-but-seems-to-be-unused \
+            manual.md $out/index.html
+        '';
+      };
 
-    checks."packages/nixos-modules-manual" = self'.packages.nixos-manual;
-  };
+      checks."packages/nixos-modules-manual" = self'.packages.nixos-manual;
+    };
 }
diff --git a/modules/nixos-modules-lib.nix b/modules/nixos-modules-lib.nix
index c655028..afa6fbb 100644
--- a/modules/nixos-modules-lib.nix
+++ b/modules/nixos-modules-lib.nix
@@ -2,64 +2,68 @@
   lib,
   withSystem,
   ...
-}: {
-  _module.args.mkNixosModuleLib = {
-    options,
-    config,
-  }: let
-    inherit
-      (lib)
-      mkOption
-      types
-      ;
-  in {
-    userDescription = "User to run under.";
-    groupDescription = "Group to run under.";
+}:
+{
+  _module.args.mkNixosModuleLib =
+    {
+      options,
+      config,
+    }:
+    let
+      inherit (lib)
+        mkOption
+        types
+        ;
+    in
+    {
+      userDescription = "User to run under.";
+      groupDescription = "Group to run under.";
 
-    db.urlParams = mkOption {
-      type = types.nullOr (types.attrsOf types.str);
-      description = ''
-        URL parameters from which to compose the ${builtins.readFile ../crates/DATABASE_URL.md}
-        Required unless {option}`${options.services.pr-tracker.db.createLocally}` is true.
-      '';
-      example = {
-        user = "pr-tracker";
-        host = "localhost";
-        port = "5432";
-        dbname = "pr-tracker";
+      db.urlParams = mkOption {
+        type = types.nullOr (types.attrsOf types.str);
+        description = ''
+          URL parameters from which to compose the ${builtins.readFile ../crates/DATABASE_URL.md}
+          Required unless {option}`${options.services.pr-tracker.db.createLocally}` is true.
+        '';
+        example = {
+          user = "pr-tracker";
+          host = "localhost";
+          port = "5432";
+          dbname = "pr-tracker";
+        };
+        default =
+          if config.services.pr-tracker.db.createLocally then
+            {
+              host = "/run/postgresql";
+              port = toString config.services.postgresql.settings.port;
+              dbname = config.services.pr-tracker.db.name;
+            }
+          else
+            null;
       };
-      default =
-        if config.services.pr-tracker.db.createLocally
-        then {
-          host = "/run/postgresql";
-          port = toString config.services.postgresql.settings.port;
-          dbname = config.services.pr-tracker.db.name;
-        }
-        else null;
-    };
-
-    db.passwordFile = mkOption {
-      type = types.nullOr types.path;
-      description = ''
-        Path to a file containing the database password.
-        Contents will be appended to the database URL as a parameter.
-      '';
-      example = "/run/secrets/db-password";
-      default = null;
-    };
 
-    db.isLocal = mkOption {
-      type = types.bool;
-      description = "Whether database is local.";
-      default = config.services.pr-tracker.db.createLocally;
-    };
+      db.passwordFile = mkOption {
+        type = types.nullOr types.path;
+        description = ''
+          Path to a file containing the database password.
+          Contents will be appended to the database URL as a parameter.
+        '';
+        example = "/run/secrets/db-password";
+        default = null;
+      };
 
-    mkPackageOption = packageAttr:
-      lib.mkPackageOption
-      (withSystem config.nixpkgs.hostPlatform.system ({self', ...}: self'.packages))
-      packageAttr
-      {
-        pkgsText = "pr-tracker.packages";
+      db.isLocal = mkOption {
+        type = types.bool;
+        description = "Whether database is local.";
+        default = config.services.pr-tracker.db.createLocally;
       };
-  };
+
+      mkPackageOption =
+        packageAttr:
+        lib.mkPackageOption (withSystem config.nixpkgs.hostPlatform.system ({ self', ... }: self'.packages))
+          packageAttr
+          {
+            pkgsText = "pr-tracker.packages";
+          };
+    };
 }
diff --git a/modules/private-nixos-modules/db.nix b/modules/private-nixos-modules/db.nix
index 9e3773a..863d074 100644
--- a/modules/private-nixos-modules/db.nix
+++ b/modules/private-nixos-modules/db.nix
@@ -1,91 +1,106 @@
-{moduleLocation, ...}: {
-  _module.args.privateNixosModules.db = {
-    lib,
-    config,
-    options,
-    ...
-  }: let
-    inherit
-      (lib)
-      flatten
-      hasAttr
-      mkIf
-      mkOption
-      types
-      ;
+{ moduleLocation, ... }:
+{
+  _module.args.privateNixosModules.db =
+    {
+      lib,
+      config,
+      options,
+      ...
+    }:
+    let
+      inherit (lib)
+        flatten
+        hasAttr
+        mkIf
+        mkOption
+        types
+        ;
 
-    cfg = config.services.pr-tracker;
+      cfg = config.services.pr-tracker;
 
-    programs = ["api" "fetcher"];
-  in {
-    # https://github.com/NixOS/nixpkgs/issues/215496
-    key = "${moduleLocation}#db";
-    _file = "${moduleLocation}#db";
+      programs = [
+        "api"
+        "fetcher"
+      ];
+    in
+    {
+      # https://github.com/NixOS/nixpkgs/issues/215496
+      key = "${moduleLocation}#db";
+      _file = "${moduleLocation}#db";
 
-    options.services.pr-tracker.db.createLocally = mkOption {
-      type = types.bool;
-      description = "Whether to create a local database automatically.";
-      default = false;
-    };
+      options.services.pr-tracker.db.createLocally = mkOption {
+        type = types.bool;
+        description = "Whether to create a local database automatically.";
+        default = false;
+      };
 
-    options.services.pr-tracker.db.name = mkOption {
-      type = types.str;
-      description = "Automatically created local database name.";
-      default = "pr-tracker";
-    };
+      options.services.pr-tracker.db.name = mkOption {
+        type = types.str;
+        description = "Automatically created local database name.";
+        default = "pr-tracker";
+      };
 
-    config = mkIf cfg.db.createLocally {
-      assertions = flatten (
-        map (program: let
-          programEnabled = hasAttr program cfg && programCfg.enable;
-          programCfg = cfg.${program};
-          urlParams = programCfg.db.urlParams;
-          socketHost = "/run/postgresql";
-          msgPrefix = "when `${options.services.pr-tracker.db.createLocally}` then ";
-        in [
-          {
-            assertion = (programEnabled && cfg.db.createLocally) -> urlParams ? host && urlParams.host == socketHost;
-            message = "${msgPrefix}`services.pr-tracker.${program}.db.urlParams.host` must be `\"${socketHost}\"`";
-          }
-          {
-            assertion = (programEnabled && cfg.db.createLocally) -> urlParams ? dbname && urlParams.dbname == cfg.db.name;
-            message = "${msgPrefix}`services.pr-tracker.${program}.db.urlParams.dbname` must equal `${options.services.pr-tracker.db.name}`";
-          }
-          {
-            assertion = (programEnabled && cfg.db.createLocally) -> urlParams ? port && urlParams.port == toString config.services.postgresql.settings.port;
-            message = "${msgPrefix}`services.pr-tracker.${program}.db.urlParams.port` must be the stringified value of `services.postgresql.settings.port`";
-          }
+      config = mkIf cfg.db.createLocally {
+        assertions = flatten (
+          map (
+            program:
+            let
+              programEnabled = hasAttr program cfg && programCfg.enable;
+              programCfg = cfg.${program};
+              urlParams = programCfg.db.urlParams;
+              socketHost = "/run/postgresql";
+              msgPrefix = "when `${options.services.pr-tracker.db.createLocally}` then ";
+            in
+            [
+              {
+                assertion =
+                  (programEnabled && cfg.db.createLocally) -> urlParams ? host && urlParams.host == socketHost;
+                message = "${msgPrefix}`services.pr-tracker.${program}.db.urlParams.host` must be `\"${socketHost}\"`";
+              }
+              {
+                assertion =
+                  (programEnabled && cfg.db.createLocally) -> urlParams ? dbname && urlParams.dbname == cfg.db.name;
+                message = "${msgPrefix}`services.pr-tracker.${program}.db.urlParams.dbname` must equal `${options.services.pr-tracker.db.name}`";
+              }
+              {
+                assertion =
+                  (programEnabled && cfg.db.createLocally)
+                  -> urlParams ? port && urlParams.port == toString config.services.postgresql.settings.port;
+                message = "${msgPrefix}`services.pr-tracker.${program}.db.urlParams.port` must be the stringified value of `services.postgresql.settings.port`";
+              }
+              {
+                assertion = (programEnabled && cfg.db.createLocally) -> programCfg.user != cfg.db.name;
+                message = "${msgPrefix}`services.pr-tracker.${program}.user` must be different from `${options.services.pr-tracker.db.name}`";
+              }
+            ]
+          ) programs
+        );
+
+        services.postgresql.enable = true;
+        services.postgresql.ensureDatabases = [ cfg.db.name ];
+        services.postgresql.ensureUsers = [
           {
-            assertion = (programEnabled && cfg.db.createLocally) -> programCfg.user != cfg.db.name;
-            message = "${msgPrefix}`services.pr-tracker.${program}.user` must be different from `${options.services.pr-tracker.db.name}`";
+            name = cfg.db.name;
+            ensureClauses.login = false;
+            ensureDBOwnership = true;
           }
-        ])
-        programs
-      );
+        ];
+      };
 
-      services.postgresql.enable = true;
-      services.postgresql.ensureDatabases = [cfg.db.name];
-      services.postgresql.ensureUsers = [
+      imports = map (
+        program:
+        let
+          programCfg = cfg.${program};
+        in
         {
-          name = cfg.db.name;
-          ensureClauses.login = false;
-          ensureDBOwnership = true;
+          config = mkIf (cfg.db.createLocally && hasAttr program cfg && programCfg.enable) {
+            services.postgresql.ensureUsers = [ { name = programCfg.user; } ];
+            systemd.services.postgresql.postStart = lib.mkAfter ''
+              $PSQL '${cfg.db.name}' -c 'GRANT "${cfg.db.name}" TO "${programCfg.user}"'
+              $PSQL '${cfg.db.name}' -c 'ALTER DEFAULT PRIVILEGES FOR ROLE "${programCfg.user}" IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO "${cfg.db.name}"'
+            '';
+          };
         }
-      ];
+      ) programs;
     };
-
-    imports =
-      map (program: let
-        programCfg = cfg.${program};
-      in {
-        config = mkIf (cfg.db.createLocally && hasAttr program cfg && programCfg.enable) {
-          services.postgresql.ensureUsers = [{name = programCfg.user;}];
-          systemd.services.postgresql.postStart = lib.mkAfter ''
-            $PSQL '${cfg.db.name}' -c 'GRANT "${cfg.db.name}" TO "${programCfg.user}"'
-            $PSQL '${cfg.db.name}' -c 'ALTER DEFAULT PRIVILEGES FOR ROLE "${programCfg.user}" IN SCHEMA public GRANT ALL PRIVILEGES ON TABLES TO "${cfg.db.name}"'
-          '';
-        };
-      })
-      programs;
-  };
 }
diff --git a/modules/private-nixos-modules/default.nix b/modules/private-nixos-modules/default.nix
index b107ae0..effb701 100644
--- a/modules/private-nixos-modules/default.nix
+++ b/modules/private-nixos-modules/default.nix
@@ -1,3 +1,3 @@
 {
-  imports = [./db.nix];
+  imports = [ ./db.nix ];
 }
diff --git a/modules/program-docs.nix b/modules/program-docs.nix
index 77b92b0..e0b455a 100644
--- a/modules/program-docs.nix
+++ b/modules/program-docs.nix
@@ -1,21 +1,12 @@
 {
-  perSystem = {
-    config,
-    lib,
-    ...
-  }: {
-    packages.program-docs = config.nci.outputs.default.docs;
-    checks."packages/program-docs" = config.packages.program-docs;
-
-    nci.crates =
-      lib.pipe config.nci.outputs
-      [
-        lib.attrNames
-        (map (crateName:
-          lib.nameValuePair crateName {
-            excludeFromProjectDocs = lib.mkDefault true;
-          }))
-        lib.listToAttrs
-      ];
-  };
+  perSystem =
+    { config, ... }:
+    {
+      packages.program-docs = config.nci.outputs.default.docs;
+      checks."packages/program-docs" = config.packages.program-docs;
+      nci.projects.default = {
+        fileset = ../crates/DATABASE_URL.md;
+        includeInProjectDocs = false;
+      };
+    };
 }
diff --git a/modules/release/default.nix b/modules/release/default.nix
index 2e0f554..d033e4f 100644
--- a/modules/release/default.nix
+++ b/modules/release/default.nix
@@ -1,47 +1,50 @@
 {
-  perSystem = {
-    pkgs,
-    lib,
-    ...
-  }: let
-    inherit (pkgs) buildNpmPackage cargo-edit writeShellApplication;
+  perSystem =
+    {
+      pkgs,
+      lib,
+      ...
+    }:
+    let
+      inherit (pkgs) buildNpmPackage cargo-edit writeShellApplication;
 
-    semantic-release = buildNpmPackage {
-      pname = "semantic-release-with-plugins";
-      version = "1.0.0";
-      src = ./semantic-release-with-plugins;
-      npmDepsHash = "sha256-QmAtEDIW+tps9lm8kozZzaJlZHfFs4B5oeprbqhUMkg=";
-      dontNpmBuild = true;
-    };
+      semantic-release = buildNpmPackage {
+        pname = "semantic-release-with-plugins";
+        version = "1.0.0";
+        src = ./semantic-release-with-plugins;
+        npmDepsHash = "sha256-QmAtEDIW+tps9lm8kozZzaJlZHfFs4B5oeprbqhUMkg=";
+        dontNpmBuild = true;
+      };
 
-    bump-version = writeShellApplication {
-      name = "bump-version";
-      runtimeInputs = [cargo-edit];
-      text = ''
-        cargo set-version "$@"
-      '';
-    };
+      bump-version = writeShellApplication {
+        name = "bump-version";
+        runtimeInputs = [ cargo-edit ];
+        text = ''
+          cargo set-version "$@"
+        '';
+      };
 
-    release = writeShellApplication {
-      name = "release-pr-tracker";
-      runtimeInputs = [bump-version];
-      text = ''
-        ${semantic-release}/bin/semantic-release "$@"
-      '';
-    };
-  in {
-    apps.bump-version = {
-      type = "app";
-      program = lib.getExe bump-version;
-    };
-    apps.release = {
-      type = "app";
-      program = lib.getExe release;
-    };
+      release = writeShellApplication {
+        name = "release-pr-tracker";
+        runtimeInputs = [ bump-version ];
+        text = ''
+          ${semantic-release}/bin/semantic-release "$@"
+        '';
+      };
+    in
+    {
+      apps.bump-version = {
+        type = "app";
+        program = lib.getExe bump-version;
+      };
+      apps.release = {
+        type = "app";
+        program = lib.getExe release;
+      };
 
-    treefmt.settings.global.excludes = [
-      "CHANGELOG.md"
-      "modules/release/semantic-release-with-plugins/package-lock.json"
-    ];
-  };
+      treefmt.settings.global.excludes = [
+        "CHANGELOG.md"
+        "modules/release/semantic-release-with-plugins/package-lock.json"
+      ];
+    };
 }
diff --git a/modules/store.nix b/modules/store.nix
index d6eb1a3..ef79303 100644
--- a/modules/store.nix
+++ b/modules/store.nix
@@ -1,12 +1,16 @@
-{lib, ...}: {
-  perSystem = {pkgs, ...}: {
-    treefmt.settings.global.excludes = ["crates/store/.sqlx/*"];
+{ lib, ... }:
+{
+  perSystem =
+    { pkgs, ... }:
+    {
+      treefmt.settings.global.excludes = [ "crates/store/.sqlx/*" ];
+      nci.projects.default.fileset = ../crates/store/.sqlx;
 
-    devshells.default = {
-      env = lib.attrsToList {
-        SQLX_OFFLINE = "true";
+      devshells.default = {
+        env = lib.attrsToList {
+          SQLX_OFFLINE = "true";
+        };
+        packages = [ pkgs.sqlx-cli ];
       };
-      packages = [pkgs.sqlx-cli];
     };
-  };
 }
diff --git a/modules/util.nix b/modules/util.nix
index b9484ba..d36ca8b 100644
--- a/modules/util.nix
+++ b/modules/util.nix
@@ -1,22 +1,25 @@
 {
-  perSystem = {pkgs, ...}: {
-    treefmt.settings.global.excludes = ["crates/util/migrations/*"];
-    devshells.default.commands = [
-      {
-        package = pkgs.writeShellApplication {
-          name = "util-sqlx-prepare";
-          runtimeInputs = [pkgs.sqlx-cli];
-          text = "cargo run --package util --bin sqlx-prepare";
-        };
-        help = "Update query metadata. See https://github.com/launchbadge/sqlx/blob/v0.8.2/sqlx-cli/README.md#enable-building-in-offline-mode-with-query";
-      }
-      {
-        package = pkgs.writeShellApplication {
-          name = "util-db-repl";
-          text = "cargo run --package util --bin db-repl";
-        };
-        help = "Start a psql repl connected to a database with migrations applied.";
-      }
-    ];
-  };
+  perSystem =
+    { pkgs, ... }:
+    {
+      nci.projects.default.fileset = ../crates/util/migrations;
+      treefmt.settings.global.excludes = [ "crates/util/migrations/*" ];
+      devshells.default.commands = [
+        {
+          package = pkgs.writeShellApplication {
+            name = "util-sqlx-prepare";
+            runtimeInputs = [ pkgs.sqlx-cli ];
+            text = "cargo run --package util --bin sqlx-prepare";
+          };
+          help = "Update query metadata. See https://github.com/launchbadge/sqlx/blob/v0.8.2/sqlx-cli/README.md#enable-building-in-offline-mode-with-query";
+        }
+        {
+          package = pkgs.writeShellApplication {
+            name = "util-db-repl";
+            text = "cargo run --package util --bin db-repl";
+          };
+          help = "Start a psql repl connected to a database with migrations applied.";
+        }
+      ];
+    };
 }