diff --git a/hosts/kazuki/mail.nix b/hosts/kazuki/mail.nix
index 4be5d1c..122cc7f 100644
--- a/hosts/kazuki/mail.nix
+++ b/hosts/kazuki/mail.nix
@@ -37,6 +37,8 @@
     };
 
     certificateScheme = "acme-nginx";
+
+    stateVersion = 2;
   };
 
   # TODO: Remove once SNM gets their shit together
diff --git a/hosts/youko/default.nix b/hosts/youko/default.nix
index 4553e2a..456630a 100644
--- a/hosts/youko/default.nix
+++ b/hosts/youko/default.nix
@@ -1,16 +1,16 @@
 { config, lib, ... }:
 let
-  builderUsers = lib.pipe config.assets.sshKeys.system [
-    (lib.filterAttrs (
+  builderUsers = lib.fp.pipe [
+    (lib.attrs.filter (
       name: _:
-      !lib.elem name [
+      !builtins.elem name [
         "youko"
         "kazuki"
         "ude"
       ]
     ))
-    lib.attrValues
-  ];
+    builtins.attrValues
+  ] config.assets.sshKeys.system;
 in
 {
   config.systems.nixos.youko.module =
diff --git a/nilla.nix b/nilla.nix
index 3a1a09e..4e6423f 100644
--- a/nilla.nix
+++ b/nilla.nix
@@ -88,7 +88,7 @@
             darwin-systems' = map (system: system.result.config.system.build.toplevel) darwin-systems;
 
             all-drvs = all-packages' ++ nixos-systems' ++ darwin-systems';
-            all-drvs' = lib.strings.concatMapSep "\n" builtins.unsafeDiscardStringContext all-drvs;
+            all-drvs' = builtins.concatStringsSep "\n" all-drvs;
           in
           mkPackage (
             { runCommand }:
@@ -104,7 +104,7 @@
             system,
           }:
           writeShellScript "ci-check" ''
-            nix-instantiate --eval -E 'import ./nilla.nix {}' -A packages.__allPackages.result.${system}.outPath
+            nix-instantiate --strict --eval -E 'import ./nilla.nix {}' -A packages.__allPackages.result.${system}.outPath
             "${lib.getExe config.packages.formatter.result.${system}}" --ci
           ''
         );
@@ -128,6 +128,7 @@
             config.packages.agenix.result.${system}
             config.packages.attic-client.result.${system}
             config.packages.nh.result.${system}
+            config.packages.formatter.result.${system}
           ];
         };
     };
diff --git a/pkgs/conduit/default.nix b/pkgs/conduit/default.nix
index 10775f7..fee4c6f 100644
--- a/pkgs/conduit/default.nix
+++ b/pkgs/conduit/default.nix
@@ -13,7 +13,8 @@ rustPlatform.buildRustPackage {
   inherit src;
   strictDeps = true;
 
-  cargoLock.lockFile = "${src}/Cargo.lock";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-gNcpB2LMZU18RIxVu+mJfa4+lB5rNIRcZ2DJPvZCdQo=";
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
diff --git a/services/paperless.nix b/services/paperless.nix
index 31838f9..1df2afa 100644
--- a/services/paperless.nix
+++ b/services/paperless.nix
@@ -1,8 +1,8 @@
 {
-  services.paperless = {
+  config.services.paperless = {
     host = "youko";
     ports = [ 28981 ];
-    config =
+    module =
       { config, ... }:
       {
         age.secrets.rab-lol-cf = {