diff --git a/doc/src/mailserver.md b/doc/src/mailserver.md
index f0649b03b..e0373c844 100644
--- a/doc/src/mailserver.md
+++ b/doc/src/mailserver.md
@@ -257,7 +257,7 @@ HELO name
 
 Frontend IP addresses
 
-: Public IPv4 and/or IPv6 addresses. **A** and **AAAA** queries of the HELO name
+: Public IPv4 and/or IPv6 adresses. **A** and **AAAA** queries of the HELO name
   must resolve to the frontend IP addresses. Each address must have a **PTR**
   record which must resolve exactly to the HELO name.
 
diff --git a/flake.lock b/flake.lock
deleted file mode 100644
index 5999137c9..000000000
--- a/flake.lock
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "nodes": {
-    "root": {}
-  },
-  "root": "root",
-  "version": 7
-}
diff --git a/flake.nix b/flake.nix
deleted file mode 100644
index e27051cd5..000000000
--- a/flake.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{
-  outputs = { self, ...}: let
-    versions = builtins.fromJSON (builtins.readFile ./versions.json);
-    nixpkgs = let
-      inherit (versions.nixpkgs) owner repo rev;
-    in builtins.getFlake "github:${owner}/${repo}/${rev}";
-
-    inherit (nixpkgs) lib;
-    nixpkgsConfig = import ./nixpkgs-config.nix;
-
-    pkgsFor = system: import nixpkgs {
-      inherit system;
-      overlays = [ self.overlays.default ];
-      config = {
-        inherit (nixpkgsConfig) permittedInsecurePackages;
-      };
-    };
-
-    forAllSystems = lib.genAttrs lib.systems.flakeExposed;
-  in {
-    overlays.default = import ./pkgs/overlay.nix;
-    nixosModules.default = import ./nixos/default.nix;
-
-    legacyPackages = forAllSystems (system: import ./. {
-      inherit nixpkgs system;
-      overlays = [ self.overlays.default ];
-      config = {
-        inherit (nixpkgsConfig) permittedInsecurePackages;
-      };
-    });
-
-    packages = forAllSystems (system: let
-      pkgs = pkgsFor system;
-    in {
-      options = let
-        testConfigFor = system: let
-          pkgs = pkgsFor system;
-          versions = import ./versions.nix { inherit pkgs; };
-          testlib = import ./tests/testlib.nix { inherit  (pkgs) lib; };
-        in lib.nixosSystem {
-          inherit pkgs system;
-          specialArgs.nixos-mailserver = versions.nixos-mailserver;
-
-          modules = [
-            {
-              options.virtualisation.vlans = lib.mkOption {
-                type = lib.types.anything;
-                default = [];
-              };
-
-              config.networking.domain = "test.fcio.net";
-
-              imports = [
-                (testlib.fcConfig {
-                  id = 1;
-                  net.fe = true;
-                  extraEncParameters.environment_url = "test.fcio.net";
-                })
-              ];
-            }
-          ];
-        };
-
-        rawOpts = lib.optionAttrSetToDocList (testConfigFor system).options;
-
-        substSpecial = x:
-          if lib.isDerivation x then { _type = "derivation"; name = x.name; }
-          else if builtins.isAttrs x then lib.mapAttrs (name: substSpecial) x
-          else if builtins.isList x then map substSpecial x
-          else if lib.isFunction x then "<function>"
-          else x;
-
-        filteredOpts = lib.filter (opt: opt.visible && !opt.internal) rawOpts;
-        optionsList = lib.flip map filteredOpts
-          (opt: opt
-            // lib.optionalAttrs (opt ? example) { example = substSpecial opt.example; }
-            // lib.optionalAttrs (opt ? default) { default = substSpecial opt.default; }
-            // lib.optionalAttrs (opt ? type) { type = substSpecial opt.type; }
-          );
-
-        optionsNix = builtins.listToAttrs (map (o: { name = o.name; value = removeAttrs o ["name" "visible" "internal"]; }) optionsList);
-        finalOptions = lib.mapAttrsToList (name: option: option // { inherit name; }) optionsNix;
-      in pkgs.writeText "options.json" (builtins.unsafeDiscardStringContext (builtins.toJSON finalOptions));
-    });
-  };
-}
diff --git a/nixos/platform/auditbeat.nix b/nixos/platform/auditbeat.nix
index 1c463f551..94ed0d93d 100644
--- a/nixos/platform/auditbeat.nix
+++ b/nixos/platform/auditbeat.nix
@@ -13,7 +13,7 @@ in
       type = types.package;
       default = pkgs.auditbeat7-oss;
       defaultText = "pkgs.auditbeat7-oss";
-      example = literalExpression "pkgs.auditbeat7";
+      example = literalExample "pkgs.auditbeat7";
       description = ''
         The auditbeat package to use.
       '';
diff --git a/nixos/platform/default.nix b/nixos/platform/default.nix
index ebb015723..7f4827bc4 100644
--- a/nixos/platform/default.nix
+++ b/nixos/platform/default.nix
@@ -82,7 +82,6 @@ in {
     };
 
     flyingcircus.enc_services_path = mkOption {
-      defaultText = "/etc/nixos/services.json";
       default = /etc/nixos/services.json;
       type = path;
       description = "Where to find the ENC services json file.";
@@ -169,7 +168,7 @@ in {
       '';
       type = types.path;
       default = "/etc/local";
-      example = "./test_cfg";
+      example = ./test_cfg;
     };
 
     flyingcircus.platform = {
diff --git a/nixos/platform/enc.nix b/nixos/platform/enc.nix
index 41ecf73c7..b77b14ce5 100644
--- a/nixos/platform/enc.nix
+++ b/nixos/platform/enc.nix
@@ -35,7 +35,6 @@ with lib;
     };
 
     encAddressesPath = mkOption {
-      defaultText = "/etc/nixos/addresses_srv.json";
       default = /etc/nixos/addresses_srv.json;
       type = path;
       description = "Where to find the address list json file.";
@@ -47,7 +46,6 @@ with lib;
     };
 
     encServicesPath = mkOption {
-      defaultText = "/etc/nixos/services.json";
       default = /etc/nixos/services.json;
       type = path;
       description = "Where to find the ENC services json file.";
@@ -61,7 +59,6 @@ with lib;
     };
 
     encServiceClientsPath = mkOption {
-      defaultText = "/etc/nixos/service_clients.json";
       default = /etc/nixos/service_clients.json;
       type = path;
       description = "Where to find the ENC service clients json file.";
@@ -74,7 +71,6 @@ with lib;
       description = "Where to find the releases json file.";
     };
     systemStatePath = mkOption {
-      defaultText = "/etc/nixos/system_state.json";
       default = /etc/nixos/system_state.json;
       type = path;
       description = "Where to find the system state json file.";
diff --git a/nixos/platform/filebeat.nix b/nixos/platform/filebeat.nix
index 7e60c8def..313f87742 100644
--- a/nixos/platform/filebeat.nix
+++ b/nixos/platform/filebeat.nix
@@ -118,7 +118,7 @@ in
         type = types.package;
         default = pkgs.filebeat7-oss;
         defaultText = "pkgs.filebeat7-oss";
-        example = literalExpression "pkgs.filebeat7";
+        example = literalExample "pkgs.filebeat7";
         description = ''
           The filebeat package to use.
         '';
diff --git a/nixos/platform/journalbeat.nix b/nixos/platform/journalbeat.nix
index 8baf1df7c..e932d0f7f 100644
--- a/nixos/platform/journalbeat.nix
+++ b/nixos/platform/journalbeat.nix
@@ -125,7 +125,7 @@ in
           type = types.package;
           default = pkgs.filebeat7-oss;
           defaultText = "pkgs.filebeat7-oss";
-          example = literalExpression "pkgs.filebeat7";
+          example = literalExample "pkgs.filebeat7";
           description = ''
             The filebeat package to use.
           '';
diff --git a/nixos/platform/static.nix b/nixos/platform/static.nix
index e799d9324..0e5f87c0d 100644
--- a/nixos/platform/static.nix
+++ b/nixos/platform/static.nix
@@ -21,7 +21,6 @@ with lib;
       };
 
       ceph.fsids = {
-        "testloc"."testrg" = "7d3bdc42-1d8e-4fcd-952d-e968d4f0cde4";
         # These are needed once per cluster.
         # Generate a new one via: `uuidgen -t` and record
         # it here with the ${location}.${resourcegroup} key
diff --git a/nixos/platform/users.nix b/nixos/platform/users.nix
index 6531e9e3b..752a23567 100644
--- a/nixos/platform/users.nix
+++ b/nixos/platform/users.nix
@@ -126,7 +126,6 @@ in
     };
 
     userDataPath = lib.mkOption {
-      defaultText = "/etc/nixos/users.json";
       default = /etc/nixos/users.json;
       type = path;
       description = "Where to find the user json file.";
@@ -138,7 +137,6 @@ in
     };
 
     permissionsPath = lib.mkOption {
-      defaultText = "/etc/nixos/permissions.json";
       default = /etc/nixos/permissions.json;
       type = path;
       description = ''
diff --git a/nixos/roles/antivirus.nix b/nixos/roles/antivirus.nix
index 37ea90127..aea48e30f 100644
--- a/nixos/roles/antivirus.nix
+++ b/nixos/roles/antivirus.nix
@@ -16,7 +16,6 @@ in
 
       listenAddresses = lib.mkOption {
         type = lib.types.listOf lib.types.str;
-        defaultText = "addresses of the interfaces `lo` and `srv`";
         default = fclib.network.lo.dualstack.addresses ++
                   fclib.network.srv.dualstack.addresses;
       };
diff --git a/nixos/roles/coturn.nix b/nixos/roles/coturn.nix
index 77455cf34..68b50daa4 100644
--- a/nixos/roles/coturn.nix
+++ b/nixos/roles/coturn.nix
@@ -50,20 +50,7 @@ in
       config = mkOption {
         description = "Platform-configured options";
         type = types.attrs;
-        defaultText = {
-          hostname = "\${cfg.hostName}";
-          alt-listening-port = 3479;
-          alt-tls-listening-port = 5350;
-          listening-ips = "the addresses of networks `lo`, `srv` and `fe`";
-          listening-port = 3478;
-          lt-cred-mech = false;
-          no-cli = true;
-          realm = "\${cfg.hostName}";
-          tls-listening-port = 5349;
-          use-auth-secret = true;
-          extraConfig = [];
-        };
-        default = {
+        default =  {
           hostname = cfg.hostName;
           alt-listening-port = 3479;
           alt-tls-listening-port = 5350;
diff --git a/nixos/roles/external_net/default.nix b/nixos/roles/external_net/default.nix
index 682f3128b..0edac54bf 100644
--- a/nixos/roles/external_net/default.nix
+++ b/nixos/roles/external_net/default.nix
@@ -34,7 +34,7 @@ in
   options = {
     flyingcircus.roles.external_net = {
 
-      enable = lib.mkEnableOption "fcio external_net role";
+      enable = lib.mkEnableOption { };
       supportsContainers = fclib.mkDisableContainerSupport;
 
       vxlan4 = lib.mkOption {
@@ -59,7 +59,6 @@ in
 
       frontendName = lib.mkOption {
         type = lib.types.str;
-        defaultText = "reverse name of the frontend's address";
         default = defaultFrontendName;
         description = ''
           DNS host name for the external network gateway. This is also the name
diff --git a/nixos/roles/external_net/openvpn.nix b/nixos/roles/external_net/openvpn.nix
index bb9da13fb..935c901e1 100644
--- a/nixos/roles/external_net/openvpn.nix
+++ b/nixos/roles/external_net/openvpn.nix
@@ -208,7 +208,7 @@ in
 {
   options = {
     flyingcircus.roles.openvpn = {
-      enable = lib.mkEnableOption "fcio openvpn role";
+      enable = lib.mkEnableOption { };
       supportsContainers = fclib.mkDisableContainerSupport;
 
       accessNets = lib.mkOption {
diff --git a/nixos/roles/external_net/vxlan.nix b/nixos/roles/external_net/vxlan.nix
index 2562d2cb0..1cecfc36e 100644
--- a/nixos/roles/external_net/vxlan.nix
+++ b/nixos/roles/external_net/vxlan.nix
@@ -106,7 +106,7 @@ in
 {
   options = with lib; {
     flyingcircus.roles.vxlan =  {
-      gateway = mkEnableOption "fcio vxlan gateway";
+      gateway = mkEnableOption { };
 
       supportsContainers = fclib.mkDisableContainerSupport;
 
diff --git a/nixos/roles/mailserver.nix b/nixos/roles/mailserver.nix
index fef09bc2f..1005ab966 100644
--- a/nixos/roles/mailserver.nix
+++ b/nixos/roles/mailserver.nix
@@ -26,7 +26,7 @@ let
         then "${hostName}.fe.${params.location}.${domain}"
         else if domain != null then "${hostName}.${domain}" else hostName;
       description = ''
-        FQDN of the mail server's frontend address. IP addresses and
+        FQDN of the mail server's frontend address. IP adresses and
         forward/reverse DNS must match exactly.
       '';
       example = "mail.example.com";
diff --git a/nixos/roles/memcached.nix b/nixos/roles/memcached.nix
index adb5ef048..067d05358 100644
--- a/nixos/roles/memcached.nix
+++ b/nixos/roles/memcached.nix
@@ -34,7 +34,6 @@ in
 
       listenAddresses = lib.mkOption {
         type = lib.types.listOf lib.types.str;
-        defaultText = "the addresses of the networks `lo` and `srv`";
         default = fclib.network.lo.dualstack.addresses ++
                   fclib.network.srv.dualstack.addresses;
       };
diff --git a/nixos/roles/mysql.nix b/nixos/roles/mysql.nix
index 273dc99e3..971bb5722 100644
--- a/nixos/roles/mysql.nix
+++ b/nixos/roles/mysql.nix
@@ -37,7 +37,6 @@ in
 
         listenAddresses = lib.mkOption {
           type = lib.types.listOf lib.types.str;
-          defaultText = "the addresses of the networks `lo` and `srv`";
           default = fclib.network.lo.dualstack.addresses ++
                     fclib.network.srv.dualstack.addresses;
         };
diff --git a/nixos/roles/statshost/default.nix b/nixos/roles/statshost/default.nix
index 722f218c4..3273ac968 100644
--- a/nixos/roles/statshost/default.nix
+++ b/nixos/roles/statshost/default.nix
@@ -191,7 +191,6 @@ in
 
       prometheusListenAddress = mkOption {
         type = types.str;
-        defaultText = "\${head fclib.network.srv.dualstack.addressQuoted}:9090";
         default = "${head fclib.network.srv.dualstack.addressesQuoted}:9090";
         description = "Prometheus listen address";
       };
diff --git a/nixos/roles/webproxy.nix b/nixos/roles/webproxy.nix
index 1ae570ebc..0ba5731d9 100644
--- a/nixos/roles/webproxy.nix
+++ b/nixos/roles/webproxy.nix
@@ -48,7 +48,6 @@ in
 
       listenAddresses = lib.mkOption {
         type = lib.types.listOf lib.types.str;
-        defaultText = "the addresses of the networks `srv` and `lo`";
         default = fclib.network.srv.dualstack.addressesQuoted ++
                   fclib.network.lo.dualstack.addressesQuoted;
       };
diff --git a/nixos/services/ceph/client.nix b/nixos/services/ceph/client.nix
index fc3b3d939..10fc6c8bb 100644
--- a/nixos/services/ceph/client.nix
+++ b/nixos/services/ceph/client.nix
@@ -21,37 +21,6 @@ in
     flyingcircus.services.ceph = {
       config = lib.mkOption {
         type = lib.types.lines;
-        defaultText = ''
-          [global]
-          pid file = /run/ceph/$type-$id.pid
-          admin socket = /run/ceph/$cluster-$name.asok
-
-          # Needs to correspond with daemon startup ulimit
-          max open files = 262144
-
-          osd pool default min size = 2
-          osd pool default size = 3
-
-          osd pool default pg num = 64
-          osd pool default pgp num = 64
-
-          setuser match path = /srv/ceph/$type/ceph-$id
-
-          debug filestore = 4
-          debug mon = 4
-          debug osd = 4
-          debug journal = 4
-          debug throttle = 4
-
-          mon compact on start = true     # Keep leveldb small
-          mon osd down out interval = 900  # Allow 15 min for reboots to happen without backfilling.
-          mon osd nearfull ratio = .9
-
-          mon data = /srv/ceph/mon/$cluster-$id
-          mon osd allow primary affinity = true
-          mon pg warn max per osd = 3000
-          mon pg warn max object skew = 20
-        '';
         default = ''
           [global]
           fsid = ${fs_id}
diff --git a/nixos/services/haproxy/config-options.nix b/nixos/services/haproxy/config-options.nix
index faa8c4ff0..020cc6159 100644
--- a/nixos/services/haproxy/config-options.nix
+++ b/nixos/services/haproxy/config-options.nix
@@ -298,7 +298,7 @@ in {
   };
   listen = mkOption {
     default = {};
-    example = literalExpression ''{
+    example = literalExample ''{
       http-in = {
         binds = [
           "127.0.0.1:8002"
@@ -325,7 +325,7 @@ in {
   };
   backend = mkOption {
     default = {};
-    example = literalExpression ''{
+    example = literalExample ''{
       be = {
         servers = [
           "localhost localhost:8080"
diff --git a/nixos/services/jitsi/jibri.nix b/nixos/services/jitsi/jibri.nix
index 9d47de130..9c6d4ced9 100644
--- a/nixos/services/jitsi/jibri.nix
+++ b/nixos/services/jitsi/jibri.nix
@@ -162,7 +162,6 @@ in
 
     configFile = mkOption {
       type = types.path;
-      defaultText = "jibri.conf";
       default = "${pkgs.writeText "jibri.conf" (toHOCON cfg.settings)}";
       description = ''
         Jibri main config file path.
@@ -172,7 +171,6 @@ in
 
     settings = mkOption {
       type = types.attrs;
-      defaultText = {};
       default = settings;
       description = "Settings used to generate the default config file";
     };
diff --git a/nixos/services/jitsi/jicofo.nix b/nixos/services/jitsi/jicofo.nix
index b9c0ae839..2dc120277 100644
--- a/nixos/services/jitsi/jicofo.nix
+++ b/nixos/services/jitsi/jicofo.nix
@@ -62,7 +62,7 @@ in
     config = mkOption {
       type = attrsOf str;
       default = { };
-      example = literalExpression ''
+      example = literalExample ''
         {
           "org.jitsi.jicofo.auth.URL" = "XMPP:jitsi-meet.example.com";
         }
diff --git a/nixos/services/jitsi/jitsi-meet.nix b/nixos/services/jitsi/jitsi-meet.nix
index d27667bea..9f3cdc217 100644
--- a/nixos/services/jitsi/jitsi-meet.nix
+++ b/nixos/services/jitsi/jitsi-meet.nix
@@ -54,7 +54,7 @@ in
     config = mkOption {
       type = attrs;
       default = { };
-      example = literalExpression ''
+      example = literalExample ''
         {
           enableWelcomePage = false;
           defaultLang = "fi";
@@ -81,7 +81,7 @@ in
     interfaceConfig = mkOption {
       type = attrs;
       default = { };
-      example = literalExpression ''
+      example = literalExample ''
         {
           SHOW_JITSI_WATERMARK = false;
           SHOW_WATERMARK_FOR_GUESTS = false;
diff --git a/nixos/services/jitsi/jitsi-videobridge.nix b/nixos/services/jitsi/jitsi-videobridge.nix
index 6ae88afd4..275a37354 100644
--- a/nixos/services/jitsi/jitsi-videobridge.nix
+++ b/nixos/services/jitsi/jitsi-videobridge.nix
@@ -57,7 +57,7 @@ in
     config = mkOption {
       type = attrs;
       default = { };
-      example = literalExpression ''
+      example = literalExample ''
         {
           videobridge = {
             ice.udp.port = 5000;
@@ -83,7 +83,7 @@ in
         See <link xlink:href="https://github.com/jitsi/jitsi-videobridge/blob/master/doc/muc.md" /> for more information.
       '';
       default = { };
-      example = literalExpression ''
+      example = literalExample ''
         {
           "localhost" = {
             hostName = "localhost";
diff --git a/nixos/services/jitsi/prosody.nix b/nixos/services/jitsi/prosody.nix
index ed742e83b..28e019590 100644
--- a/nixos/services/jitsi/prosody.nix
+++ b/nixos/services/jitsi/prosody.nix
@@ -501,7 +501,7 @@ in
         description = "Prosody package to use";
         default = pkgs.prosody;
         defaultText = "pkgs.prosody";
-        example = literalExpression ''
+        example = literalExample ''
           pkgs.prosody.override {
             withExtraLibs = [ pkgs.luaPackages.lpty ];
             withCommunityModules = [ "auth_external" ];
diff --git a/nixos/services/k3s/frontend.nix b/nixos/services/k3s/frontend.nix
index a736a80d9..5a0902b5d 100644
--- a/nixos/services/k3s/frontend.nix
+++ b/nixos/services/k3s/frontend.nix
@@ -78,7 +78,6 @@ let
         (lib.optionalString (conf.haproxyExtraConfig != "") conf.haproxyExtraConfig)
       ];
   }) frontendCfg;
-
 in
 {
   options = with lib; {
@@ -172,7 +171,7 @@ in
           };
 
           extraPodTemplateOptions = mkOption {
-            type = lines;
+            type = string;
             default = "";
             description = "haproxy options for the server-template directive used for the pod backends, added verbatim to the end of the generated line.";
           };
@@ -196,7 +195,7 @@ in
           };
 
           serviceName = mkOption {
-            type = nullOr str;
+            type = nullOr string;
             default = null;
             description = ''
               Name of the Kubernetes service we want to proxy.
@@ -221,7 +220,7 @@ in
           };
 
           namespace = mkOption {
-            type = str;
+            type = string;
             default = "default";
             description = ''
               Kubernetes namespace the service is defined in.
@@ -232,7 +231,7 @@ in
           binds = mkOption {
             type = nullOr (listOf str);
             default = null;
-            example = [ "0.0.0.0:8008" ];
+            example = map (a: "${a}:8080") fclib.network.fe.dualstack.addressesQuoted;
             description = ''Addresses with ports haproxy is binding to,
               listening for incoming connections. Defaults to 127.0.0.1, using either `lbServicePort`
               or `podPort`, if `lbServicePort` is not set.
diff --git a/nixos/services/mail/default.nix b/nixos/services/mail/default.nix
index eeea65475..337daa3dc 100644
--- a/nixos/services/mail/default.nix
+++ b/nixos/services/mail/default.nix
@@ -1,8 +1,4 @@
-{ config
-, lib
-, pkgs
-, nixos-mailserver ? (import ../../../versions.nix {}).nixos-mailserver
-, ... }:
+{ config, lib, pkgs, ... }:
 
 with builtins;
 with lib;
@@ -15,6 +11,8 @@ with lib;
 # - domains: list of mail domains for which regular mail accounts exist
 
 let
+  inherit (import ../../../versions.nix { }) nixos-mailserver;
+
   role = config.flyingcircus.roles.mailserver;
   svc = config.flyingcircus.services.mail;
   fclib = config.fclib;
diff --git a/nixos/services/matomo.nix b/nixos/services/matomo.nix
index b252dd4f8..926a29eb6 100644
--- a/nixos/services/matomo.nix
+++ b/nixos/services/matomo.nix
@@ -162,7 +162,11 @@ in {
       hostname = mkOption {
         type = types.str;
         default = "${user}.${fqdn}";
-        defaultText = literalExpression "${user}.\${fqdn}";
+        defaultText = literalExpression ''
+          if config.${options.networking.domain} != null
+          then "${user}.''${config.${options.networking.fqdn}}"
+          else "${user}.''${config.${options.networking.hostName}}"
+        '';
         example = "matomo.yourdomain.org";
         description = lib.mdDoc ''
           URL of the host, without https prefix. You may want to change it if you
diff --git a/nixos/services/nginx/default.nix b/nixos/services/nginx/default.nix
index 8d702baf8..0ac7f88e8 100644
--- a/nixos/services/nginx/default.nix
+++ b/nixos/services/nginx/default.nix
@@ -147,7 +147,6 @@ in
 
     defaultListenAddresses = lib.mkOption {
       type = lib.types.listOf lib.types.str;
-      defaultText = "addresses of the `fe` network";
       default = fclib.network.fe.dualstack.addressesQuoted;
       description = ''
         Addresses to listen on if a vhost does not specify any.
@@ -240,7 +239,7 @@ in
         };
       }));
       default = {};
-      example = literalExpression ''
+      example = literalExample ''
         {
           "hydra.example.com" = {
             forceSSL = true;
diff --git a/nixos/services/nginx/location-options.nix b/nixos/services/nginx/location-options.nix
index 99832f57b..82e0037b4 100644
--- a/nixos/services/nginx/location-options.nix
+++ b/nixos/services/nginx/location-options.nix
@@ -14,7 +14,7 @@ with lib;
     basicAuth = mkOption {
       type = types.attrsOf types.str;
       default = {};
-      example = literalExpression ''
+      example = literalExample ''
         {
           user = "password";
         };
diff --git a/nixos/services/nginx/vhost-options.nix b/nixos/services/nginx/vhost-options.nix
index 6a5baf800..92073d764 100644
--- a/nixos/services/nginx/vhost-options.nix
+++ b/nixos/services/nginx/vhost-options.nix
@@ -234,7 +234,7 @@ with lib;
     basicAuth = mkOption {
       type = types.attrsOf types.str;
       default = {};
-      example = literalExpression ''
+      example = literalExample ''
         {
           user = "password";
         };
@@ -264,7 +264,7 @@ with lib;
         inherit lib;
       }));
       default = {};
-      example = literalExpression ''
+      example = literalExample ''
         {
           "/" = {
             proxyPass = "http://localhost:3000";
diff --git a/nixos/services/percona.nix b/nixos/services/percona.nix
index d64e3e73d..ec2d43938 100644
--- a/nixos/services/percona.nix
+++ b/nixos/services/percona.nix
@@ -102,7 +102,7 @@ in
 
       package = mkOption {
         type = types.package;
-        example = literalExpression "pkgs.percona";
+        example = literalExample "pkgs.percona";
         description = "
           Which MySQL derivation to use.
         ";
@@ -155,8 +155,8 @@ in
           to create databases on the first startup of MySQL
         '';
         example = [
-          { name = "foodatabase"; schema = literalExpression "./foodatabase.sql"; }
-          { name = "bardatabase"; schema = literalExpression "./bardatabase.sql"; }
+          { name = "foodatabase"; schema = literalExample "./foodatabase.sql"; }
+          { name = "bardatabase"; schema = literalExample "./bardatabase.sql"; }
         ];
       };
 
diff --git a/nixos/services/prometheus.nix b/nixos/services/prometheus.nix
index 6976a4fea..63bf37969 100644
--- a/nixos/services/prometheus.nix
+++ b/nixos/services/prometheus.nix
@@ -73,7 +73,8 @@ let
     else x;
 
   mkDefOpt = type : defaultStr : description : mkOpt type (description + ''
-    Defaults to <literal>${builtins.toString defaultStr}</literal> in prometheus
+
+    Defaults to <literal>${defaultStr}</literal> in prometheus
     when set to <literal>null</literal>.
   '');
 
diff --git a/nixos/services/redis.nix b/nixos/services/redis.nix
index 93d391f85..59e514475 100644
--- a/nixos/services/redis.nix
+++ b/nixos/services/redis.nix
@@ -27,7 +27,6 @@ in {
 
       listenAddresses = lib.mkOption {
         type = lib.types.listOf lib.types.str;
-        defaultText = "the addresses of the networks `lo` and `srv`";
         default = fclib.network.lo.dualstack.addresses ++
                   fclib.network.srv.dualstack.addresses;
       };
diff --git a/pkgs/overlay.nix b/pkgs/overlay.nix
index a93197c2f..24afba0df 100644
--- a/pkgs/overlay.nix
+++ b/pkgs/overlay.nix
@@ -1,44 +1,44 @@
-final: prev:
+self: super:
 let
-  versions = import ../versions.nix { pkgs = prev; };
+  versions = import ../versions.nix { pkgs = super; };
   # import fossar/nix-phps overlay with nixpkgs-unstable's generic.nix copied in
   # then use release-set as pkgs
   phps = (import ../nix-phps/pkgs/phps.nix) (../nix-phps)
-    {} prev;
+    {} super;
 
-  inherit (prev) fetchpatch fetchFromGitHub fetchurl lib;
+  inherit (super) fetchpatch fetchFromGitHub fetchurl lib;
 
 in {
   #
   # == our own stuff
   #
   fc = (import ./default.nix {
-    pkgs = final;
+    pkgs = self;
     # Only used by the agent for now but we should probably use this
     # for all our Python packages and update Python in sync then.
-    pythonPackages = final.python310Packages;
+    pythonPackages = self.python310Packages;
   });
 
   #
   # imports from other nixpkgs versions or local definitions
   #
 
-  apacheHttpdLegacyCrypt = final.apacheHttpd.override {
-    aprutil = final.aprutil.override { libxcrypt = final.libxcrypt-legacy; };
+  apacheHttpdLegacyCrypt = self.apacheHttpd.override {
+    aprutil = self.aprutil.override { libxcrypt = self.libxcrypt-legacy; };
   };
 
-  inherit (prev.callPackage ./boost { }) boost159;
+  inherit (super.callPackage ./boost { }) boost159;
 
-  bundlerSensuPlugin = prev.callPackage ./sensuplugins-rb/bundler-sensu-plugin.nix { };
-  busybox = prev.busybox.overrideAttrs (oldAttrs: {
+  bundlerSensuPlugin = super.callPackage ./sensuplugins-rb/bundler-sensu-plugin.nix { };
+  busybox = super.busybox.overrideAttrs (oldAttrs: {
       meta.priority = 10;
     });
 
-  certmgr = prev.callPackage ./certmgr.nix {  };
+  certmgr = super.callPackage ./certmgr.nix {  };
 
-  check_ipmi_sensor = prev.callPackage ./check_ipmi_sensor.nix { };
-  check_md_raid = prev.callPackage ./check_md_raid { };
-  check_megaraid = prev.callPackage ./check_megaraid { };
+  check_ipmi_sensor = super.callPackage ./check_ipmi_sensor.nix { };
+  check_md_raid = super.callPackage ./check_md_raid { };
+  check_megaraid = super.callPackage ./check_megaraid { };
 
   # XXX: ceph doesn't build
   # ceph = (super.callPackage ./ceph {
@@ -46,9 +46,9 @@ in {
   #     boost = super.boost155;
   # });
 
-  docsplit = prev.callPackage ./docsplit { };
+  docsplit = super.callPackage ./docsplit { };
 
-  innotop = prev.callPackage ./percona/innotop.nix { };
+  innotop = super.callPackage ./percona/innotop.nix { };
 
   # XXX: pinned to the latest 16.1.0 version using Go 1.20.5 (from release 2023_017)
   # until the gitlab-runner problem with Go 1.20.6 is fixed:
@@ -56,9 +56,9 @@ in {
   # https://github.com/NixOS/nixpkgs/issues/245365
   gitlab-runner = builtins.storePath /nix/store/hfk8w6yf0zfvs6ng1swpiyrqrk5pghn5-gitlab-runner-16.1.0;
 
-  libmodsecurity = prev.callPackage ./libmodsecurity { };
+  libmodsecurity = super.callPackage ./libmodsecurity { };
 
-  jicofo = prev.jicofo.overrideAttrs(oldAttrs: rec {
+  jicofo = super.jicofo.overrideAttrs(oldAttrs: rec {
     pname = "jicofo";
     version = "1.0-1027";
     src = fetchurl {
@@ -67,7 +67,7 @@ in {
     };
   });
 
-  jitsi-meet = prev.jitsi-meet.overrideAttrs(oldAttrs: rec {
+  jitsi-meet = super.jitsi-meet.overrideAttrs(oldAttrs: rec {
     pname = "jitsi-meet";
     version = "1.0.7235";
     src = fetchurl {
@@ -77,7 +77,7 @@ in {
 
   });
 
-  jitsi-videobridge = prev.jitsi-videobridge.overrideAttrs(oldAttrs: rec {
+  jitsi-videobridge = super.jitsi-videobridge.overrideAttrs(oldAttrs: rec {
     pname = "jitsi-videobridge2";
     version = "2.3-19-gb286dc0c";
     src = fetchurl {
@@ -88,7 +88,7 @@ in {
     installPhase = ''
       runHook preInstall
       substituteInPlace usr/share/jitsi-videobridge/jvb.sh \
-        --replace "exec java" "exec ${final.jre_headless}/bin/java"
+        --replace "exec java" "exec ${self.jre_headless}/bin/java"
 
       mkdir -p $out/{bin,share/jitsi-videobridge,etc/jitsi/videobridge}
       mv etc/jitsi/videobridge/logging.properties $out/etc/jitsi/videobridge/
@@ -98,25 +98,25 @@ in {
       # work around https://github.com/jitsi/jitsi-videobridge/issues/1547
       wrapProgram $out/bin/jitsi-videobridge \
         --set VIDEOBRIDGE_GC_TYPE G1GC \
-        --set LD_LIBRARY_PATH ${prev.lib.getLib prev.openssl_3_0}/lib/
+        --set LD_LIBRARY_PATH ${super.lib.getLib super.openssl_3_0}/lib/
       runHook postInstall
     '';
   });
 
-  inherit (prev.callPackages ./matomo {})
+  inherit (super.callPackages ./matomo {})
     matomo
     matomo-beta;
 
 
-  kubernetes-dashboard = prev.callPackage ./kubernetes-dashboard.nix { };
-  kubernetes-dashboard-metrics-scraper = prev.callPackage ./kubernetes-dashboard-metrics-scraper.nix { };
+  kubernetes-dashboard = super.callPackage ./kubernetes-dashboard.nix { };
+  kubernetes-dashboard-metrics-scraper = super.callPackage ./kubernetes-dashboard-metrics-scraper.nix { };
 
   # Overriding the version for Go modules doesn't work properly so we
   # include our own beats.nix here. The other beats below inherit the version
   # change.
-  inherit (prev.callPackage ./beats.nix {}) filebeat7;
+  inherit (super.callPackage ./beats.nix {}) filebeat7;
 
-  auditbeat7 = final.filebeat7.overrideAttrs(a: a // {
+  auditbeat7 = self.filebeat7.overrideAttrs(a: a // {
     name = "auditbeat-${a.version}";
 
     postFixup = "";
@@ -126,23 +126,23 @@ in {
     ];
   });
 
-  auditbeat7-oss = final.auditbeat7.overrideAttrs(a: a // {
+  auditbeat7-oss = self.auditbeat7.overrideAttrs(a: a // {
     name = "auditbeat-oss-${a.version}";
     preBuild = "rm -rf x-pack";
   });
 
-  cyrus_sasl-legacyCrypt = prev.cyrus_sasl.override {
-    libxcrypt = final.libxcrypt-legacy;
+  cyrus_sasl-legacyCrypt = super.cyrus_sasl.override {
+    libxcrypt = self.libxcrypt-legacy;
   };
 
-  dovecot = (prev.dovecot.override {
-    cyrus_sasl = final.cyrus_sasl-legacyCrypt;
+  dovecot = (super.dovecot.override {
+    cyrus_sasl = self.cyrus_sasl-legacyCrypt;
   }).overrideAttrs(old: {
     strictDeps = true;
-    buildInputs = [ final.libxcrypt-legacy ] ++ old.buildInputs;
+    buildInputs = [ self.libxcrypt-legacy ] ++ old.buildInputs;
   });
 
-  filebeat7-oss = final.filebeat7.overrideAttrs(a: a // {
+  filebeat7-oss = self.filebeat7.overrideAttrs(a: a // {
     name = "filebeat-oss-${a.version}";
     preBuild = "rm -rf x-pack";
   });
@@ -154,7 +154,7 @@ in {
 
   # PHP versions from vendored nix-phps
 
-  lamp_php72 = final.php72.withExtensions ({ enabled, all }:
+  lamp_php72 = self.php72.withExtensions ({ enabled, all }:
               enabled ++ [
                 all.bcmath
                 all.imagick
@@ -162,7 +162,7 @@ in {
                 all.redis
               ]);
 
-  lamp_php73 = final.php73.withExtensions ({ enabled, all }:
+  lamp_php73 = self.php73.withExtensions ({ enabled, all }:
               enabled ++ [
                 all.bcmath
                 all.imagick
@@ -170,7 +170,7 @@ in {
                 all.redis
               ]);
 
-  lamp_php74 = (final.php74.withExtensions ({ enabled, all }:
+  lamp_php74 = (self.php74.withExtensions ({ enabled, all }:
               enabled ++ [
                 all.bcmath
                 all.imagick
@@ -180,7 +180,7 @@ in {
 
   # PHP versions from nixpkgs
 
-  lamp_php80 = (prev.php80.withExtensions ({ enabled, all }:
+  lamp_php80 = (super.php80.withExtensions ({ enabled, all }:
               enabled ++ [
                 all.bcmath
                 all.imagick
@@ -188,7 +188,7 @@ in {
                 all.redis
               ]));
 
-  lamp_php81 = prev.php81.withExtensions ({ enabled, all }:
+  lamp_php81 = super.php81.withExtensions ({ enabled, all }:
               enabled ++ [
                 all.bcmath
                 all.imagick
@@ -196,7 +196,7 @@ in {
                 all.redis
               ]);
 
-  lamp_php82 = prev.php82.withExtensions ({ enabled, all }:
+  lamp_php82 = super.php82.withExtensions ({ enabled, all }:
               enabled ++ [
                 all.bcmath
                 all.imagick
@@ -204,18 +204,18 @@ in {
                 all.redis
               ]);
 
-  latencytop_nox = prev.latencytop.overrideAttrs(_: {
-    buildInputs = with final; [ ncurses glib ];
+  latencytop_nox = super.latencytop.overrideAttrs(_: {
+    buildInputs = with self; [ ncurses glib ];
     makeFlags = [ "HAS_GTK_GUI=" ];
   });
 
-  libxcrypt-with-sha256 = prev.libxcrypt.override {
+  libxcrypt-with-sha256 = super.libxcrypt.override {
     enableHashes = "strong,sha256crypt";
   };
 
-  links2_nox = prev.links2.override { enableX11 = false; enableFB = false; };
+  links2_nox = super.links2.override { enableX11 = false; enableFB = false; };
 
-  lkl = prev.lkl.overrideAttrs(_: rec {
+  lkl = super.lkl.overrideAttrs(_: rec {
     version = "2022-05-18";
     src = fetchFromGitHub {
       rev = "10c7b5dee8c424cc2ab754e519ecb73350283ff9";
@@ -233,14 +233,14 @@ in {
   });
 
 
-  mc = prev.callPackage ./mc.nix { };
+  mc = super.callPackage ./mc.nix { };
 
-  mysql = prev.mariadb;
+  mysql = super.mariadb;
 
-  monitoring-plugins = prev.monitoring-plugins.overrideAttrs(_: rec {
+  monitoring-plugins = super.monitoring-plugins.overrideAttrs(_: rec {
     name = "monitoring-plugins-2.3.0";
 
-      src = prev.fetchFromGitHub {
+      src = super.fetchFromGitHub {
         owner  = "monitoring-plugins";
         repo   = "monitoring-plugins";
         rev    = "v2.3";
@@ -249,7 +249,7 @@ in {
 
       patches = [];
 
-      postInstall = prev.monitoring-plugins.postInstall + ''
+      postInstall = super.monitoring-plugins.postInstall + ''
         cp plugins-root/check_dhcp $out/bin
         cp plugins-root/check_icmp $out/bin
       '';
@@ -257,8 +257,8 @@ in {
     });
 
   # This is our default version.
-  nginxStable = (prev.nginxStable.override {
-    modules = with prev.nginxModules; [
+  nginxStable = (super.nginxStable.override {
+    modules = with super.nginxModules; [
       dav
       modsecurity
       moreheaders
@@ -270,10 +270,10 @@ in {
     ];
   });
 
-  nginx = final.nginxStable;
+  nginx = self.nginxStable;
 
-  nginxMainline = (prev.nginxMainline.override {
-    modules = with prev.nginxModules; [
+  nginxMainline = (super.nginxMainline.override {
+    modules = with super.nginxModules; [
       dav
       modsecurity
       rtmp
@@ -284,20 +284,20 @@ in {
     ];
   });
 
-  nginxLegacyCrypt = final.nginx.overrideAttrs(old: {
+  nginxLegacyCrypt = self.nginx.overrideAttrs(old: {
     strictDeps = true;
-    buildInputs = [ final.libxcrypt-legacy ] ++ old.buildInputs;
+    buildInputs = [ self.libxcrypt-legacy ] ++ old.buildInputs;
   });
 
-  openldap_2_4 = prev.callPackage ./openldap_2_4.nix {
-    libxcrypt = final.libxcrypt-legacy;
+  openldap_2_4 = super.callPackage ./openldap_2_4.nix {
+    libxcrypt = self.libxcrypt-legacy;
   };
 
-  opensearch = prev.callPackage ./opensearch { };
-  opensearch-dashboards = prev.callPackage ./opensearch-dashboards { };
+  opensearch = super.callPackage ./opensearch { };
+  opensearch-dashboards = super.callPackage ./opensearch-dashboards { };
 
-  percona = final.percona80;
-  percona-toolkit = prev.perlPackages.PerconaToolkit.overrideAttrs(oldAttrs: {
+  percona = self.percona80;
+  percona-toolkit = super.perlPackages.PerconaToolkit.overrideAttrs(oldAttrs: {
     # The script uses usr/bin/env perl and the Perl builder adds PERL5LIB to it.
     # This doesn't work. Looks like a bug in Nixpkgs.
     # Replacing the interpreter path before the Perl builder touches it fixes this.
@@ -306,62 +306,62 @@ in {
     '';
   });
 
-  percona57 = prev.callPackage ./percona/5.7.nix {
-    boost = final.boost159;
-    openssl = final.openssl_1_1;
+  percona57 = super.callPackage ./percona/5.7.nix {
+    boost = self.boost159;
+    openssl = self.openssl_1_1;
   };
 
-  percona80 = prev.callPackage ./percona/8.0.nix {
-    boost = final.boost177;
-    openldap = final.openldap_2_4;
-    openssl = final.openssl_1_1;
-    inherit (prev.darwin.apple_sdk.frameworks) CoreServices;
-    inherit (prev.darwin) cctools developer_cmds DarwinTools;
+  percona80 = super.callPackage ./percona/8.0.nix {
+    boost = self.boost177;
+    openldap = self.openldap_2_4;
+    openssl = self.openssl_1_1;
+    inherit (super.darwin.apple_sdk.frameworks) CoreServices;
+    inherit (super.darwin) cctools developer_cmds DarwinTools;
   };
 
-  percona-xtrabackup_2_4 = prev.callPackage ./percona-xtrabackup/2_4.nix {
-    boost = final.boost159;
-    openssl = final.openssl_1_1;
+  percona-xtrabackup_2_4 = super.callPackage ./percona-xtrabackup/2_4.nix {
+    boost = self.boost159;
+    openssl = self.openssl_1_1;
   };
 
-  percona-xtrabackup_8_0 = prev.callPackage ./percona-xtrabackup/8_0.nix {
-    boost = final.boost177;
-    openssl = final.openssl_1_1;
+  percona-xtrabackup_8_0 = super.callPackage ./percona-xtrabackup/8_0.nix {
+    boost = self.boost177;
+    openssl = self.openssl_1_1;
   };
 
   # Has been renamed upstream, backy-extract still wants to use it.
-  pkgconfig = prev.pkg-config;
+  pkgconfig = super.pkg-config;
 
-  postfix = prev.postfix.override {
-    cyrus_sasl = final.cyrus_sasl-legacyCrypt;
+  postfix = super.postfix.override {
+    cyrus_sasl = self.cyrus_sasl-legacyCrypt;
   };
 
-  postgis_2_5 = (prev.postgresqlPackages.postgis.override {
-      proj = final.proj_7;
+  postgis_2_5 = (super.postgresqlPackages.postgis.override {
+      proj = self.proj_7;
     }).overrideAttrs(_: rec {
     version = "2.5.5";
-    src = prev.fetchurl {
+    src = super.fetchurl {
       url = "https://download.osgeo.org/postgis/source/postgis-${version}.tar.gz";
       sha256 = "0547xjk6jcwx44s6dsfp4f4j93qrbf2d2j8qhd23w55a58hs05qj";
     };
   });
 
-  prometheus-elasticsearch-exporter = prev.callPackage ./prometheus-elasticsearch-exporter.nix { };
+  prometheus-elasticsearch-exporter = super.callPackage ./prometheus-elasticsearch-exporter.nix { };
 
-  python27 = prev.python27.overrideAttrs (prev: {
-    buildInputs = prev.buildInputs ++ [ final.libxcrypt-legacy ];
+  python27 = super.python27.overrideAttrs (prev: {
+    buildInputs = prev.buildInputs ++ [ super.libxcrypt-legacy ];
     NIX_LDFLAGS = "-lcrypt";
     configureFlags = [
-      "CFLAGS=-I${final.libxcrypt-legacy}/include"
-      "LIBS=-L${final.libxcrypt-legacy}/lib"
+      "CFLAGS=-I${super.libxcrypt-legacy}/include"
+      "LIBS=-L${super.libxcrypt-legacy}/lib"
     ];
   });
 
-  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+  pythonPackagesExtensions = super.pythonPackagesExtensions ++ [
     (python-final: python-prev: {
       pyslurm = python-prev.pyslurm.overridePythonAttrs(_: {
         version = "unstable-2023-05-12";
-        src = prev.fetchFromGitHub {
+        src = super.fetchFromGitHub {
           owner = "pyslurm";
           repo = "pyslurm";
           rev = "42471d8575e89caa64fea55677d1af130328b4a7";
@@ -372,35 +372,35 @@ in {
   ];
 
   # This was renamed in NixOS 22.11, nixos-mailserver still refers to the old name.
-  pypolicyd-spf = final.spf-engine;
+  pypolicyd-spf = self.spf-engine;
 
-  rabbitmq-server_3_8 = prev.rabbitmq-server;
+  rabbitmq-server_3_8 = super.rabbitmq-server;
 
-  sensu = prev.callPackage ./sensu { };
-  sensu-plugins-elasticsearch = prev.callPackage ./sensuplugins-rb/sensu-plugins-elasticsearch { };
-  sensu-plugins-kubernetes = prev.callPackage ./sensuplugins-rb/sensu-plugins-kubernetes { };
-  sensu-plugins-memcached = prev.callPackage ./sensuplugins-rb/sensu-plugins-memcached { };
-  sensu-plugins-mysql = prev.callPackage ./sensuplugins-rb/sensu-plugins-mysql { };
-  sensu-plugins-disk-checks = prev.callPackage ./sensuplugins-rb/sensu-plugins-disk-checks { };
-  sensu-plugins-entropy-checks = prev.callPackage ./sensuplugins-rb/sensu-plugins-entropy-checks { };
-  sensu-plugins-http = prev.callPackage ./sensuplugins-rb/sensu-plugins-http { };
-  sensu-plugins-logs = prev.callPackage ./sensuplugins-rb/sensu-plugins-logs { };
-  sensu-plugins-network-checks = prev.callPackage ./sensuplugins-rb/sensu-plugins-network-checks { };
-  sensu-plugins-postfix = prev.callPackage ./sensuplugins-rb/sensu-plugins-postfix { };
-  sensu-plugins-postgres = prev.callPackage ./sensuplugins-rb/sensu-plugins-postgres { };
-  sensu-plugins-rabbitmq = prev.callPackage ./sensuplugins-rb/sensu-plugins-rabbitmq { };
-  sensu-plugins-redis = prev.callPackage ./sensuplugins-rb/sensu-plugins-redis { };
+  sensu = super.callPackage ./sensu { };
+  sensu-plugins-elasticsearch = super.callPackage ./sensuplugins-rb/sensu-plugins-elasticsearch { };
+  sensu-plugins-kubernetes = super.callPackage ./sensuplugins-rb/sensu-plugins-kubernetes { };
+  sensu-plugins-memcached = super.callPackage ./sensuplugins-rb/sensu-plugins-memcached { };
+  sensu-plugins-mysql = super.callPackage ./sensuplugins-rb/sensu-plugins-mysql { };
+  sensu-plugins-disk-checks = super.callPackage ./sensuplugins-rb/sensu-plugins-disk-checks { };
+  sensu-plugins-entropy-checks = super.callPackage ./sensuplugins-rb/sensu-plugins-entropy-checks { };
+  sensu-plugins-http = super.callPackage ./sensuplugins-rb/sensu-plugins-http { };
+  sensu-plugins-logs = super.callPackage ./sensuplugins-rb/sensu-plugins-logs { };
+  sensu-plugins-network-checks = super.callPackage ./sensuplugins-rb/sensu-plugins-network-checks { };
+  sensu-plugins-postfix = super.callPackage ./sensuplugins-rb/sensu-plugins-postfix { };
+  sensu-plugins-postgres = super.callPackage ./sensuplugins-rb/sensu-plugins-postgres { };
+  sensu-plugins-rabbitmq = super.callPackage ./sensuplugins-rb/sensu-plugins-rabbitmq { };
+  sensu-plugins-redis = super.callPackage ./sensuplugins-rb/sensu-plugins-redis { };
 
-  solr = prev.callPackage ./solr { };
+  solr = super.callPackage ./solr { };
 
-  temporal_tables = prev.callPackage ./postgresql/temporal_tables { };
+  temporal_tables = super.callPackage ./postgresql/temporal_tables { };
 
-  tideways_daemon = prev.callPackage ./tideways/daemon.nix {};
-  tideways_module = prev.callPackage ./tideways/module.nix {};
+  tideways_daemon = super.callPackage ./tideways/daemon.nix {};
+  tideways_module = super.callPackage ./tideways/module.nix {};
 
-  wkhtmltopdf_0_12_5 = prev.callPackage ./wkhtmltopdf/0_12_5.nix { };
-  wkhtmltopdf_0_12_6 = prev.callPackage ./wkhtmltopdf/0_12_6.nix { };
-  wkhtmltopdf = final.wkhtmltopdf_0_12_6;
+  wkhtmltopdf_0_12_5 = super.callPackage ./wkhtmltopdf/0_12_5.nix { };
+  wkhtmltopdf_0_12_6 = super.callPackage ./wkhtmltopdf/0_12_6.nix { };
+  wkhtmltopdf = self.wkhtmltopdf_0_12_6;
 
-  xtrabackup = final.percona-xtrabackup_8_0;
+  xtrabackup = self.percona-xtrabackup_8_0;
 }
diff --git a/release/default.nix b/release/default.nix
index 69faa6b58..05200aecb 100644
--- a/release/default.nix
+++ b/release/default.nix
@@ -308,9 +308,6 @@ let
     # VM image for the Flying Circus infrastructure.
     fc = lib.hydraJob (import "${nixpkgs_}/nixos/lib/eval-config.nix" {
       inherit system;
-      specialArgs = {
-        inherit (import ../versions.nix { inherit pkgs; }) nixos-mailserver;
-      };
       modules = [
         (import ./vm-image.nix imgArgs)
         (import version_nix {})
diff --git a/tests/default.nix b/tests/default.nix
index b567039c6..d167ba14e 100644
--- a/tests/default.nix
+++ b/tests/default.nix
@@ -11,7 +11,7 @@ let
     inherit system;
   } // args);
 
-  callTest = fn: args: hydraJob (importTest fn args system);
+  callTest = fn: args: hydraJob (importTest fn args system).test;
 
   callSubTests = fn: args: let
     discover = attrs: let
diff --git a/tests/lamp/package-test.nix b/tests/lamp/package-test.nix
index aba7fdabb..434db18be 100644
--- a/tests/lamp/package-test.nix
+++ b/tests/lamp/package-test.nix
@@ -1,20 +1,23 @@
 { version ? "lamp_php74", pkgs ? import ./../.. {}, ... }:
 let
   php = pkgs.${version};
-  pcreTestPackage = import ./pcre-test-package.nix { inherit pkgs php; };
-in pkgs.runCommand "php-pcre-test-${version}" {} ''
-  set -eo pipefail
+  pcreTestPackage = import ./pcre-test-package.nix { pkgs = pkgs; php = php; };
+in
+{
+  test = pkgs.runCommand "php-pcre-test-${version}" {} ''
+    set -eo pipefail
 
-  # run ${pcreTestPackage}/testPcre.sh and save output as variable
-  output=$(${pcreTestPackage}/testPcre.sh)
+    # run ${pcreTestPackage}/testPcre.sh and save output as variable
+    output=$(${pcreTestPackage}/testPcre.sh)
 
-  # remove the first line of the output, which just roughly shows the command that was run
-  output=$(echo "''${output}" | tail -n +2)
+    # remove the first line of the output, which just roughly shows the command that was run
+    output=$(echo "''${output}" | tail -n +2)
 
-  # if output contains "doesnotwork", exit with error
-  if echo "$output" | grep "doesnotwork"; then
-    echo "PCRE test failed with output: $output"
-    exit 1
-  fi
-  >$out
-''
+    # if output contains "doesnotwork", exit with error
+    if echo "$output" | grep "doesnotwork"; then
+      echo "PCRE test failed with output: $output"
+      exit 1
+    fi
+    >$out
+  '';
+}
diff --git a/tests/make-test-python.nix b/tests/make-test-python.nix
index 7672a0d5b..29dd4cff0 100644
--- a/tests/make-test-python.nix
+++ b/tests/make-test-python.nix
@@ -43,18 +43,12 @@ f: {
   , ...
 } @ args:
 
-let
-  inherit (pkgs) lib;
-  pytest = import "${nixpkgs}/nixos/lib/testing-python.nix" {
-    inherit system pkgs;
-  };
-
-  defaultTest = {
-    node.specialArgs = {
-      inherit (import ../versions.nix { inherit pkgs; }) nixos-mailserver;
-    };
-  };
+with import "${nixpkgs}/nixos/lib/testing-python.nix" {
+  inherit system pkgs;
+};
 
+let
+  lib = pkgs.lib;
   test =
     if lib.isFunction f
     then f (args // {
@@ -63,11 +57,11 @@ let
     })
     else f;
 
-  makeTestSkipLint = args: pytest.runTest ({ skipLint = true; } // args);
+  makeTestSkipLint = args: makeTest ({ skipLint = true; } // args);
 
 in if test ? testCases
 then lib.mapAttrs
   (testCaseName: testCase: makeTestSkipLint (
     testCase // { name = "${test.name}-${testCaseName}"; }))
   test.testCases
-  else makeTestSkipLint (lib.recursiveUpdate defaultTest test)
+else makeTestSkipLint test