diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e097c51..dc9d1e7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,20 +1,21 @@
-# Copyright 2022-2023, axodotdev
+# This file was autogenerated by dist: https://opensource.axo.dev/cargo-dist/
+#
+# Copyright 2022-2024, axodotdev
 # SPDX-License-Identifier: MIT or Apache-2.0
 #
 # CI that:
 #
 # * checks for a Git Tag that looks like a release
-# * builds artifacts with cargo-dist (archives, installers, hashes)
+# * builds artifacts with dist (archives, installers, hashes)
 # * uploads those artifacts to temporary workflow zip
-# * on success, uploads the artifacts to a Github Release
+# * on success, uploads the artifacts to a GitHub Release
 #
-# Note that the Github Release will be created with a generated
+# Note that the GitHub Release will be created with a generated
 # title/body based on your changelogs.
 
 name: Release
-
 permissions:
-  contents: write
+  "contents": "write"
 
 # This task will run whenever you push a git tag that looks like a version
 # like "1.0.0", "v0.1.0-prerelease.1", "my-app/0.1.0", "releases/v1.0.0", etc.
@@ -23,30 +24,30 @@ permissions:
 # must be a Cargo-style SemVer Version (must have at least major.minor.patch).
 #
 # If PACKAGE_NAME is specified, then the announcement will be for that
-# package (erroring out if it doesn't have the given version or isn't cargo-dist-able).
+# package (erroring out if it doesn't have the given version or isn't dist-able).
 #
 # If PACKAGE_NAME isn't specified, then the announcement will be for all
-# (cargo-dist-able) packages in the workspace with that version (this mode is
+# (dist-able) packages in the workspace with that version (this mode is
 # intended for workspaces with only one dist-able package, or with all dist-able
 # packages versioned/released in lockstep).
 #
 # If you push multiple tags at once, separate instances of this workflow will
-# spin up, creating an independent announcement for each one. However Github
+# spin up, creating an independent announcement for each one. However, GitHub
 # will hard limit this to 3 tags per commit, as it will assume more tags is a
 # mistake.
 #
 # If there's a prerelease-style suffix to the version, then the release(s)
 # will be marked as a prerelease.
 on:
+  pull_request:
   push:
     tags:
       - '**[0-9]+.[0-9]+.[0-9]+*'
-  pull_request:
 
 jobs:
-  # Run 'cargo dist plan' (or host) to determine what tasks we need to do
+  # Run 'dist plan' (or host) to determine what tasks we need to do
   plan:
-    runs-on: ubuntu-latest
+    runs-on: "ubuntu-20.04"
     outputs:
       val: ${{ steps.plan.outputs.manifest }}
       tag: ${{ !github.event.pull_request && github.ref_name || '' }}
@@ -58,11 +59,16 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - name: Install cargo-dist
+      - name: Install dist
         # we specify bash to get pipefail; it guards against the `curl` command
         # failing. otherwise `sh` won't catch that `curl` returned non-0
         shell: bash
-        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.7.2/cargo-dist-installer.sh | sh"
+        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.28.0/cargo-dist-installer.sh | sh"
+      - name: Cache dist
+        uses: actions/upload-artifact@v4
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/dist
       # sure would be cool if github gave us proper conditionals...
       # so here's a doubly-nested ternary-via-truthiness to try to provide the best possible
       # functionality based on whether this is a pull_request, and whether it's from a fork.
@@ -70,15 +76,15 @@ jobs:
       # but also really annoying to build CI around when it needs secrets to work right.)
       - id: plan
         run: |
-          cargo dist ${{ !github.event.pull_request && format('host --steps=create --tag={0}', github.ref_name) || (github.event.pull_request.head.repo.fork && 'plan' || 'host --steps=check') }} --output-format=json > dist-manifest.json
-          echo "cargo dist ran successfully"
-          cat dist-manifest.json
-          echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
+          dist ${{ (!github.event.pull_request && format('host --steps=create --tag={0}', github.ref_name)) || 'plan' }} --output-format=json > plan-dist-manifest.json
+          echo "dist ran successfully"
+          cat plan-dist-manifest.json
+          echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: artifacts
-          path: dist-manifest.json
+          name: artifacts-plan-dist-manifest
+          path: plan-dist-manifest.json
 
   # Build and packages all the platform-specific things
   build-local-artifacts:
@@ -89,42 +95,53 @@ jobs:
     if: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix.include != null && (needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload') }}
     strategy:
       fail-fast: false
-      # Target platforms/runners are computed by cargo-dist in create-release.
+      # Target platforms/runners are computed by dist in create-release.
       # Each member of the matrix has the following arguments:
       #
       # - runner: the github runner
-      # - dist-args: cli flags to pass to cargo dist
-      # - install-dist: expression to run to install cargo-dist on the runner
+      # - dist-args: cli flags to pass to dist
+      # - install-dist: expression to run to install dist on the runner
       #
       # Typically there will be:
       # - 1 "global" task that builds universal installers
       # - N "local" tasks that build each platform's binaries and platform-specific installers
       matrix: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix }}
     runs-on: ${{ matrix.runner }}
+    container: ${{ matrix.container && matrix.container.image || null }}
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json
     steps:
+      - name: enable windows longpaths
+        run: |
+          git config --global core.longpaths true
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - uses: swatinem/rust-cache@v2
-      - name: Install cargo-dist
-        run: ${{ matrix.install_dist }}
+      - name: Install Rust non-interactively if not already installed
+        if: ${{ matrix.container }}
+        run: |
+          if ! command -v cargo > /dev/null 2>&1; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+            echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+          fi
+      - name: Install dist
+        run: ${{ matrix.install_dist.run }}
       # Get the dist-manifest
       - name: Fetch local artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@v4
         with:
-          name: artifacts
+          pattern: artifacts-*
           path: target/distrib/
+          merge-multiple: true
       - name: Install dependencies
         run: |
           ${{ matrix.packages_install }}
       - name: Build artifacts
         run: |
           # Actually do builds and make zips and whatnot
-          cargo dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
-          echo "cargo dist ran successfully"
+          dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
+          echo "dist ran successfully"
       - id: cargo-dist
         name: Post-build
         # We force bash here just because github makes it really hard to get values up
@@ -134,14 +151,14 @@ jobs:
         run: |
           # Parse out what we just built and upload it to scratch storage
           echo "paths<<EOF" >> "$GITHUB_OUTPUT"
-          jq --raw-output ".artifacts[]?.path | select( . != null )" dist-manifest.json >> "$GITHUB_OUTPUT"
+          dist print-upload-files-from-manifest --manifest dist-manifest.json >> "$GITHUB_OUTPUT"
           echo "EOF" >> "$GITHUB_OUTPUT"
 
           cp dist-manifest.json "$BUILD_MANIFEST_NAME"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: artifacts
+          name: artifacts-build-local-${{ join(matrix.targets, '_') }}
           path: |
             ${{ steps.cargo-dist.outputs.paths }}
             ${{ env.BUILD_MANIFEST_NAME }}
@@ -159,30 +176,35 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - name: Install cargo-dist
-        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.7.2/cargo-dist-installer.sh | sh"
+      - name: Install cached dist
+        uses: actions/download-artifact@v4
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/
+      - run: chmod +x ~/.cargo/bin/dist
       # Get all the local artifacts for the global tasks to use (for e.g. checksums)
       - name: Fetch local artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@v4
         with:
-          name: artifacts
+          pattern: artifacts-*
           path: target/distrib/
+          merge-multiple: true
       - id: cargo-dist
         shell: bash
         run: |
-          cargo dist build ${{ needs.plan.outputs.tag-flag }} --output-format=json "--artifacts=global" > dist-manifest.json
-          echo "cargo dist ran successfully"
+          dist build ${{ needs.plan.outputs.tag-flag }} --output-format=json "--artifacts=global" > dist-manifest.json
+          echo "dist ran successfully"
 
           # Parse out what we just built and upload it to scratch storage
           echo "paths<<EOF" >> "$GITHUB_OUTPUT"
-          jq --raw-output ".artifacts[]?.path | select( . != null )" dist-manifest.json >> "$GITHUB_OUTPUT"
+          jq --raw-output ".upload_files[]" dist-manifest.json >> "$GITHUB_OUTPUT"
           echo "EOF" >> "$GITHUB_OUTPUT"
 
           cp dist-manifest.json "$BUILD_MANIFEST_NAME"
       - name: "Upload artifacts"
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: artifacts
+          name: artifacts-build-global
           path: |
             ${{ steps.cargo-dist.outputs.paths }}
             ${{ env.BUILD_MANIFEST_NAME }}
@@ -203,29 +225,55 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - name: Install cargo-dist
-        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.7.2/cargo-dist-installer.sh | sh"
+      - name: Install cached dist
+        uses: actions/download-artifact@v4
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/
+      - run: chmod +x ~/.cargo/bin/dist
       # Fetch artifacts from scratch-storage
       - name: Fetch artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@v4
         with:
-          name: artifacts
+          pattern: artifacts-*
           path: target/distrib/
-      # This is a harmless no-op for Github Releases, hosting for that happens in "announce"
+          merge-multiple: true
       - id: host
         shell: bash
         run: |
-          cargo dist host ${{ needs.plan.outputs.tag-flag }} --steps=upload --steps=release --output-format=json > dist-manifest.json
+          dist host ${{ needs.plan.outputs.tag-flag }} --steps=upload --steps=release --output-format=json > dist-manifest.json
           echo "artifacts uploaded and released successfully"
           cat dist-manifest.json
           echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: artifacts
+          # Overwrite the previous copy
+          name: artifacts-dist-manifest
           path: dist-manifest.json
+      # Create a GitHub Release while uploading all files to it
+      - name: "Download GitHub Artifacts"
+        uses: actions/download-artifact@v4
+        with:
+          pattern: artifacts-*
+          path: artifacts
+          merge-multiple: true
+      - name: Cleanup
+        run: |
+          # Remove the granular manifests
+          rm -f artifacts/*-dist-manifest.json
+      - name: Create GitHub Release
+        env:
+          PRERELEASE_FLAG: "${{ fromJson(steps.host.outputs.manifest).announcement_is_prerelease && '--prerelease' || '' }}"
+          ANNOUNCEMENT_TITLE: "${{ fromJson(steps.host.outputs.manifest).announcement_title }}"
+          ANNOUNCEMENT_BODY: "${{ fromJson(steps.host.outputs.manifest).announcement_github_body }}"
+          RELEASE_COMMIT: "${{ github.sha }}"
+        run: |
+          # Write and read notes from a file to avoid quoting breaking things
+          echo "$ANNOUNCEMENT_BODY" > $RUNNER_TEMP/notes.txt
+
+          gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
 
-  # Create a Github Release while uploading all files to it
   announce:
     needs:
       - plan
@@ -241,20 +289,3 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - name: "Download Github Artifacts"
-        uses: actions/download-artifact@v4.1.7
-        with:
-          name: artifacts
-          path: artifacts
-      - name: Cleanup
-        run: |
-          # Remove the granular manifests
-          rm -f artifacts/*-dist-manifest.json
-      - name: Create Github Release
-        uses: ncipollo/release-action@v1
-        with:
-          tag: ${{ needs.plan.outputs.tag }}
-          name: ${{ fromJson(needs.host.outputs.val).announcement_title }}
-          body: ${{ fromJson(needs.host.outputs.val).announcement_github_body }}
-          prerelease: ${{ fromJson(needs.host.outputs.val).announcement_is_prerelease }}
-          artifacts: "artifacts/*"
diff --git a/Cargo.toml b/Cargo.toml
index 5e0b93f..45a3576 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,23 +39,6 @@ pretty_assertions = "1.4.0"
 test-log = "0.2.14"
 urlencoding = "2.1.3"
 
-# Config for 'cargo dist'
-[workspace.metadata.dist]
-# The preferred cargo-dist version to use in CI (Cargo.toml SemVer syntax)
-cargo-dist-version = "0.7.2"
-# CI backends to support
-ci = ["github"]
-# The installers to generate for each app
-installers = ["shell"]
-# Target platforms to build apps for (Rust target-triple syntax)
-targets = [
-    "x86_64-unknown-linux-gnu",
-    "aarch64-apple-darwin",
-    "x86_64-apple-darwin",
-]
-# Publish jobs to run in CI
-pr-run-mode = "plan"
-
 # The profile that 'cargo dist' will build with
 [profile.dist]
 inherits = "release"
diff --git a/dist-workspace.toml b/dist-workspace.toml
new file mode 100644
index 0000000..15a3a5f
--- /dev/null
+++ b/dist-workspace.toml
@@ -0,0 +1,19 @@
+[workspace]
+members = ["cargo:."]
+
+# Config for 'dist'
+[dist]
+# The preferred dist version to use in CI (Cargo.toml SemVer syntax)
+cargo-dist-version = "0.28.0"
+# CI backends to support
+ci = "github"
+# The installers to generate for each app
+installers = ["shell"]
+# Target platforms to build apps for (Rust target-triple syntax)
+targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "x86_64-unknown-linux-gnu"]
+# Which actions to run on pull requests
+pr-run-mode = "plan"
+# Path that installers should place binaries in
+install-path = "CARGO_HOME"
+# Whether to install an updater program
+install-updater = false
diff --git a/flake.lock b/flake.lock
index 51167b5..4f0e686 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,17 +1,12 @@
 {
   "nodes": {
     "crane": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1718078026,
-        "narHash": "sha256-LbQabH6h86ZzTvDnaZHmMwedRZNB2jYtUQzmoqWQoJ8=",
+        "lastModified": 1736101677,
+        "narHash": "sha256-iKOPq86AOWCohuzxwFy/MtC8PcSVGnrxBOvxpjpzrAY=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "a3f0c63eed74a516298932b9b1627dd80b9c3892",
+        "rev": "61ba163d85e5adeddc7b3a69bb174034965965b2",
         "type": "github"
       },
       "original": {
@@ -41,11 +36,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1718149104,
-        "narHash": "sha256-Ds1QpobBX2yoUDx9ZruqVGJ/uQPgcXoYuobBguyKEh8=",
+        "lastModified": 1736320768,
+        "narHash": "sha256-nIYdTAiKIGnFNugbomgBJR+Xv5F1ZQU+HfaBqJKroC0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e913ae340076bbb73d9f4d3d065c2bca7caafb16",
+        "rev": "4bc9c909d9ac828a039f288cf872d16d38185db8",
         "type": "github"
       },
       "original": {
@@ -92,11 +87,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1718271808,
-        "narHash": "sha256-fXM6Gle4dt1iJgI6NuPl9l00i5sXGYkE+sUvFdps44s=",
+        "lastModified": 1725435397,
+        "narHash": "sha256-32OFphh/wfghv9J9DtpOBIzpOhlq3TeqW5uO5zq2hDU=",
         "owner": "tweag",
         "repo": "nixtract",
-        "rev": "eddcfd45d517928bf8d18b849d5ab0f6e5d49686",
+        "rev": "d77acf9149138e0083db93c60fc23cf6053601c6",
         "type": "github"
       },
       "original": {
@@ -109,8 +104,7 @@
       "inputs": {
         "crane": "crane",
         "nixpkgs": "nixpkgs",
-        "nixtract": "nixtract",
-        "utils": "utils_2"
+        "nixtract": "nixtract"
       }
     },
     "systems": {
@@ -128,21 +122,6 @@
         "type": "github"
       }
     },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "utils": {
       "inputs": {
         "systems": "systems"
@@ -160,24 +139,6 @@
         "repo": "flake-utils",
         "type": "github"
       }
-    },
-    "utils_2": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 4cbe765..45d9799 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,11 +2,9 @@
   inputs = {
     crane = {
       url = "github:ipetkov/crane";
-      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    utils.url = "github:numtide/flake-utils";
     nixtract.url = "github:tweag/nixtract";
   };
 
@@ -14,67 +12,96 @@
     { self
     , crane
     , nixpkgs
-    , utils
     , nixtract
     }:
-    utils.lib.eachDefaultSystem
-      (system:
-      let
-        pkgs = import nixpkgs { inherit system; };
-        crane-lib = crane.mkLib nixpkgs.legacyPackages.${system};
-        cyclonedx = pkgs.cyclonedx-cli;
-        nixtract-cli = nixtract.defaultPackage.${system};
 
+    let
+      supportedSystems = [
+        "aarch64-darwin"
+        "aarch64-linux"
+        "i686-linux"
+        "x86_64-darwin"
+        "x86_64-linux"
+      ];
+
+      pkgsFor = nixpkgs.lib.genAttrs supportedSystems (system: import nixpkgs {
+        inherit system;
+      });
+
+      forAllSystems = fn: nixpkgs.lib.genAttrs supportedSystems (system: fn rec {
+        inherit system;
+        pkgs = pkgsFor.${system};
+        inherit (pkgs) lib;
+      });
+
+      mkGenealogosArtifacts = pkgs: rec {
+        crane-lib = crane.mkLib nixpkgs.legacyPackages.${pkgs.system};
+        nixtract-cli = nixtract.defaultPackage.${pkgs.system};
         crane-outputs = import ./nix/crane.nix {
-          inherit pkgs crane-lib nixtract-cli cyclonedx;
+          inherit pkgs crane-lib nixtract-cli;
+          inherit (pkgs) cyclonedx-cli;
         };
-        tmp = pkgs.runCommand "tmp" { } ''
-          mkdir $out
-          mkdir -m 1777 $out/tmp
-        '';
-        dockerImage = pkgs.dockerTools.buildLayeredImageWithNixDb {
-          name = "genealogos";
-          tag = "latest";
-          contents = [ crane-outputs.packages.genealogos-api tmp ];
-          config = {
-            EntryPoint = [ "genealogos-api" ];
-            ExposedPorts."8000" = {};
-            Env = [
-              "ROCKET_ADDRESS=0.0.0.0"
-              "ROCKET_PORT=8000"
-              "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
-            ];
-          };
-        };
-      in
-      rec {
-        inherit (crane-outputs) checks;
-        packages = crane-outputs.packages // {
-          inherit dockerImage;
-        };
-        overlays.default = import ./nix/overlays.nix {
-          inherit crane-lib;
-        };
-        nixosModules.default = import ./nix/genealogos-module.nix { inherit (crane-outputs.packages) genealogos-api; };
-        nixosConfigurations.genealogos-test = nixpkgs.lib.nixosSystem
-          {
-            inherit system;
-            modules = [
-              ./nix/configuration.nix
-              nixosModules.default
-            ];
+      };
+    in
+
+    {
+      overlays.default = import ./nix/overlays.nix {
+        inherit crane;
+      };
+
+      nixosModules.default = import ./nix/genealogos-module.nix { inherit mkGenealogosArtifacts; };
+
+      packages = forAllSystems ({ system, pkgs, ... }:
+        let artifacts = mkGenealogosArtifacts pkgs; in
+        let
+          tmp = pkgs.runCommand "tmp" { } ''
+            mkdir $out
+            mkdir -m 1777 $out/tmp
+          '';
+        in
+        artifacts.crane-outputs.packages // {
+          dockerImage = pkgs.dockerTools.buildLayeredImageWithNixDb {
+            name = "genealogos";
+            tag = "latest";
+            contents = [ artifacts.crane-outputs.packages.genealogos-api tmp ];
+            config = {
+              EntryPoint = [ "genealogos-api" ];
+              ExposedPorts."8000" = { };
+              Env = [
+                "ROCKET_ADDRESS=0.0.0.0"
+                "ROCKET_PORT=8000"
+                "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+              ];
+            };
           };
+        }
+      );
 
-        apps.default = utils.lib.mkApp {
-          drv = crane-outputs.packages.genealogos-cli;
-        };
+      checks = forAllSystems ({ system, pkgs, ... }:
+        let artifacts = mkGenealogosArtifacts pkgs; in
+        artifacts.crane-outputs.checks
+      );
 
-        devShells.default = crane-lib.devShell {
-          inherit (crane-outputs) checks;
+      apps = forAllSystems ({ system, pkgs, ... }:
+        let artifacts = mkGenealogosArtifacts pkgs; in
+        {
+          default = {
+            type = "app";
+            program =
+              artifacts.crane-outputs.packages.genealogos-cli.passthru.exePath;
+          };
+        });
 
-          packages = with pkgs; [
-            rust-analyzer
-          ];
-        };
-      });
+      devShells = forAllSystems ({ system, pkgs, ... }:
+        let artifacts = mkGenealogosArtifacts pkgs; in
+        {
+          default = artifacts.crane-lib.devShell {
+            inherit (artifacts.crane-outputs) checks;
+
+            packages = with pkgs; [
+              rust-analyzer
+            ];
+          };
+        });
+    };
 }
diff --git a/nix/crane.nix b/nix/crane.nix
index fbea994..0d51d25 100644
--- a/nix/crane.nix
+++ b/nix/crane.nix
@@ -3,7 +3,7 @@
 { pkgs
 , crane-lib
 , nixtract-cli ? null
-, cyclonedx ? null
+, cyclonedx-cli ? null
 }:
 let
   common-crane-args = {
@@ -32,14 +32,21 @@ let
     cargoTestCommand = "cargo test --profile release";
   });
 
-  # Crane buildPackage arguments for every crate
-  crates = {
+  # Crane buildPackage arguments for every crate. The whole set takes an
+  # additioinal argument indicating if we're producing a binary or not (the
+  # other possibilities being documentation, derivation that runs clippy, etc.).
+  # Otherwise, the binary-specific gymnastics such as `makeWrapper` errors out
+  # on non-binary derivatives.
+  crates = { binary ? true }: {
     genealogos = (common-crane-args // {
       cargoExtraArgs = "-p genealogos";
     });
+
     genealogos-cli = (common-crane-args // {
       pname = "genealogos-cli";
       cargoExtraArgs = "-p genealogos-cli";
+    }
+      // pkgs.lib.attrsets.optionalAttrs binary {
       passthru.exePath = "/bin/genealogos";
       nativeBuildInputs = common-crane-args.nativeBuildInputs ++ [ pkgs.makeWrapper ];
       preFixup = ''
@@ -47,9 +54,11 @@ let
           --prefix PATH : ${pkgs.lib.makeBinPath [ pkgs.nix ]}
       '';
     });
+
     genealogos-api = (common-crane-args // {
       pname = "genealogos-api";
       cargoExtraArgs = "-p genealogos-api";
+    } // pkgs.lib.attrsets.optionalAttrs binary {
       nativeBuildInputs = common-crane-args.nativeBuildInputs ++ [ pkgs.makeWrapper ];
       preFixup = ''
         wrapProgram $out/bin/genealogos-api \
@@ -57,8 +66,16 @@ let
       '';
     });
   };
+
+  # The collection of genealogos crates to be used when producing binary
+  # packages.
+  binaryCrates = crates { binary = true; };
+  # The collection of genealogos crates to be used when deriving non binary
+  # byproducts, such as documentation or checks.
+  nonBinaryCrates = crates { binary = false; };
+
   rust-packages =
-    builtins.mapAttrs (_: crane-lib.buildPackage) crates;
+    builtins.mapAttrs (_: crane-lib.buildPackage) binaryCrates;
 in
 rec {
   checks =
@@ -69,11 +86,11 @@ rec {
       (_: args: crane-lib.cargoClippy (args // {
         cargoClippyExtraArgs = "--all-targets -- --deny warnings";
       }))
-      crates
+      nonBinaryCrates
     # Doc
-    // builtins.mapAttrs (_: crane-lib.cargoDoc) crates
+    // builtins.mapAttrs (_: crane-lib.cargoDoc) nonBinaryCrates
     # fmt
-    // builtins.mapAttrs (_: crane-lib.cargoFmt) crates;
+    // builtins.mapAttrs (_: crane-lib.cargoFmt) nonBinaryCrates;
 
   packages =
     rust-packages // {
@@ -93,7 +110,7 @@ rec {
       };
       verify-fixture-files = pkgs.writeShellApplication {
         name = "verify-fixture-files";
-        runtimeInputs = [ cyclonedx ];
+        runtimeInputs = [ cyclonedx-cli ];
         text = builtins.readFile ../scripts/verify-fixture-files.sh;
       };
     };
diff --git a/nix/genealogos-module.nix b/nix/genealogos-module.nix
index 375dad2..c415d93 100644
--- a/nix/genealogos-module.nix
+++ b/nix/genealogos-module.nix
@@ -1,4 +1,4 @@
-{ genealogos-api }:
+{ mkGenealogosArtifacts }:
 { config, lib, pkgs, ... }:
 
 with lib;
@@ -6,6 +6,7 @@ with lib;
 let
   cfg = config.services.genealogos;
   rocketConfigFormat = pkgs.formats.toml { };
+  genealogos-api = (mkGenealogosArtifacts pkgs).crane-outputs.packages.genealogos-api;
 in
 {
   options = {
diff --git a/nix/overlays.nix b/nix/overlays.nix
index 9843b7c..18a6cf8 100644
--- a/nix/overlays.nix
+++ b/nix/overlays.nix
@@ -1,6 +1,7 @@
-{ crane-lib }:
+{ crane }:
 final: prev:
 let
+  crane-lib = crane.mkLib prev;
   crane-outputs = import ./crane.nix { pkgs = prev; inherit crane-lib; };
 in
 {