diff --git a/nix/pkgs/heptapod-runner/default.nix b/nix/pkgs/heptapod-runner/default.nix
index c16fea8d90..6196cd40ec 100644
--- a/nix/pkgs/heptapod-runner/default.nix
+++ b/nix/pkgs/heptapod-runner/default.nix
@@ -14,7 +14,7 @@ in
 {
   heptapod-runner = pkgs.gitlab-runner.overrideAttrs (oldAttrs: rec {
     inherit version;
-    buildInputs = oldAttrs.buildInputs ++ [ pkgs.makeWrapper ];
+    buildInputs = (oldAttrs.buildInputs or []) ++ [ pkgs.makeWrapper ];
     src = newSrc;
     patches = [ ./fix-shell-path.patch ];
   });
diff --git a/ops/home-manager-ext.nix b/ops/home-manager-ext.nix
index f2d4133cf1..c13f6b5372 100644
--- a/ops/home-manager-ext.nix
+++ b/ops/home-manager-ext.nix
@@ -24,6 +24,7 @@ let
 
     configuration = {
       imports = [ value ];
+      config._module.args.pkgs = lib.mkForce pkgs;
       config.nixpkgs.config = pkgs.config;
       config.home.sessionVariablesExtra = ''
         export PATH="$HOME/.nix-profile/bin''${PATH:+:}$PATH"
diff --git a/ops/nixos/bvm-matrix/default.nix b/ops/nixos/bvm-matrix/default.nix
index 0bfa56d8be..9f0712fde1 100644
--- a/ops/nixos/bvm-matrix/default.nix
+++ b/ops/nixos/bvm-matrix/default.nix
@@ -119,45 +119,45 @@ in {
   };
   services.matrix-synapse = {
     enable = true;
-    server_name = "zxcvbnm.ninja";
-    macaroon_secret_key = machineSecrets.matrix.macaroonSecretKey;
-    registration_shared_secret = machineSecrets.matrix.registrationSecret;
-    turn_uris = [
-      "turns:matrix.zxcvbnm.ninja:3478?transport=udp"
-      "turns:matrix.zxcvbnm.ninja:3478?transport=tcp"
-      "turn:matrix.zxcvbnm.ninja:3478?transport=udp"
-      "turn:matrix.zxcvbnm.ninja:3478?transport=tcp"
-    ];
-    turn_shared_secret = machineSecrets.turnSecret;
-    public_baseurl = "https://matrix.zxcvbnm.ninja/";
-    url_preview_enabled = true;
-    url_preview_ip_range_blacklist = [
-      "127.0.0.0/8"
-      "10.0.0.0/8"
-      "172.16.0.0/12"
-      "192.168.0.0/16"
-      "100.64.0.0/10"
-      "169.254.0.0/16"
-      "::1/128"
-      "fe80::/64"
-      "fc00::/7"
-    ];
-    listeners = [{
-      port = 8008;
-      bind_address = "::1";
-      type = "http";
-      tls = false;
-      x_forwarded = true;
-      resources = [{
-        names = [ "client" "federation" ];
-        compress = false;
+    settings = {
+      server_name = "zxcvbnm.ninja";
+      url_preview_enabled = true;
+      url_preview_ip_range_blacklist = [
+        "127.0.0.0/8"
+        "10.0.0.0/8"
+        "172.16.0.0/12"
+        "192.168.0.0/16"
+        "100.64.0.0/10"
+        "169.254.0.0/16"
+        "::1/128"
+        "fe80::/64"
+        "fc00::/7"
+      ];
+      listeners = [{
+        port = 8008;
+        bind_addresses = [ "::1" ];
+        type = "http";
+        tls = false;
+        x_forwarded = true;
+        resources = [{
+          names = [ "client" "federation" ];
+          compress = false;
+        }];
       }];
-    }];
-    extraConfig = ''
-      form_secret: "${machineSecrets.matrix.formSecret}"
-      experimental_features:
-        spaces_enabled: true
-    '';
+      turn_uris = [
+        "turns:matrix.zxcvbnm.ninja:3478?transport=udp"
+        "turns:matrix.zxcvbnm.ninja:3478?transport=tcp"
+        "turn:matrix.zxcvbnm.ninja:3478?transport=udp"
+        "turn:matrix.zxcvbnm.ninja:3478?transport=tcp"
+      ];
+      experimental_features.spaces_enabled = true;
+      public_baseurl = "https://matrix.zxcvbnm.ninja/";
+
+      macaroon_secret_key = machineSecrets.matrix.macaroonSecretKey;
+      registration_shared_secret = machineSecrets.matrix.registrationSecret;
+      turn_shared_secret = machineSecrets.turnSecret;
+      form_secret = machineSecrets.matrix.formSecret;
+    };
   };
 
   # Users allowed to use SSL certificate for matrix.zxcvbnm.ninja.
diff --git a/ops/nixos/default.nix b/ops/nixos/default.nix
index fbff63d3c8..cca644d3eb 100644
--- a/ops/nixos/default.nix
+++ b/ops/nixos/default.nix
@@ -8,6 +8,7 @@ let
   baseModule = name: { ... }: {
     _module.args = args // {
       rebuilder = rebuilder name;
+      pkgs = lib.mkForce pkgs;
     };
   };
   systemFor = systemName: config:
diff --git a/ops/nixos/lib/graphical-client.nix b/ops/nixos/lib/graphical-client.nix
index 04d68665f0..3593a9174a 100644
--- a/ops/nixos/lib/graphical-client.nix
+++ b/ops/nixos/lib/graphical-client.nix
@@ -28,8 +28,6 @@ in
       alsa.support32Bit = true;
       jack.enable = true;
       pulse.enable = true;
-
-      media-session.enable = true;
     };
     security.rtkit.enable = true;
 
diff --git a/ops/nixos/lib/home-manager/client.nix b/ops/nixos/lib/home-manager/client.nix
index 0b23daa7fd..88e213cfaf 100644
--- a/ops/nixos/lib/home-manager/client.nix
+++ b/ops/nixos/lib/home-manager/client.nix
@@ -42,7 +42,7 @@ in
     depot.nix.pkgs.common-updater-scripts
     go
     gopls
-    goimports
+    gotools
     graphicsmagick-imagemagick-compat
     vault
     youtube-dl