diff --git a/ci-root.nix b/ci-root.nix
index 864cec8cca..98837c3628 100644
--- a/ci-root.nix
+++ b/ci-root.nix
@@ -23,7 +23,11 @@ let
         inherit (depot.nix.pkgs.authentik) docs webui pythonapp goserver server;
       };
       pkg-grafana-plugins = depot.nix.pkgs.grafana-plugins;
-      web = lib.filterAttrs (n: v: !lib.isFunction v) depot.web;
+      web = builtins.removeAttrs (lib.filterAttrs (n: v: !lib.isFunction v) depot.web) [ "barf" ];
+      web-barf = {
+        inherit (depot.web.barf) frontend;
+        inherit (depot.web.barf.sapi) sapid-wrapper;
+      };
       trains = depot.go.trains.cmd.bins;
       other = {
         twitterchiver-archiver = depot.go.twitterchiver.archiver;
@@ -45,5 +49,10 @@ let
     };
     aarch64-darwin = x86_64-darwin;
   }.${system};
+
+  entriesFilter = entries: assert builtins.isList entries; let
+    notADerivationOrPath = builtins.filter (elem: !lib.isString elem.path && !lib.isDerivation elem.path) entries;
+    notADerivationOrPath' = map (elem: elem.name) notADerivationOrPath;
+  in assert lib.assertMsg ((lib.length notADerivationOrPath') == 0) "not a derivation or path: ${toString notADerivationOrPath'}"; entries;
 in
-pkgs.linkFarm "ci" (builtins.concatLists (lib.mapAttrsToList prefixAttrs ciBits))
+pkgs.linkFarm "ci" (entriesFilter (builtins.concatLists (lib.mapAttrsToList prefixAttrs ciBits)))