diff --git a/flake.nix b/flake.nix
index cf417e73..b6a74d3c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -20,139 +20,145 @@
     treefmt-nix,
     sops-nix,
     ...
-  }:
-    with builtins; let
-      inherit
-        (nixpkgs.lib)
-        concatMapAttrs
-        mapAttrs'
-        foldr
-        recursiveUpdate
-        nameValuePair
-        nixosSystem
-        filterAttrs
-        ;
-
-      importPackages = pkgs: let
-        nixosTests = let
-          dir = ./tests;
-          testDirs = readDir dir;
-
-          dirToTest = name: _: let
-            mkTestModule = import "${dir}/${name}";
-
-            testModule = mkTestModule {
-              inherit pkgs;
-              inherit (pkgs) lib;
-              modules = extendedModules;
-              configurations = rawNixosConfigs;
-            };
-          in
-            pkgs.nixosTest testModule;
+  }: let
+    inherit
+      (builtins)
+      readDir
+      mapAttrs
+      attrValues
+      ;
+
+    inherit
+      (nixpkgs.lib)
+      concatMapAttrs
+      mapAttrs'
+      foldr
+      recursiveUpdate
+      nameValuePair
+      nixosSystem
+      filterAttrs
+      ;
+
+    importPackages = pkgs: let
+      nixosTests = let
+        dir = ./tests;
+        testDirs = readDir dir;
+
+        dirToTest = name: _: let
+          mkTestModule = import "${dir}/${name}";
+
+          testModule = mkTestModule {
+            inherit pkgs;
+            inherit (pkgs) lib;
+            modules = extendedModules;
+            configurations = rawNixosConfigs;
+          };
         in
-          mapAttrs dirToTest testDirs;
+          pkgs.nixosTest testModule;
+      in
+        mapAttrs dirToTest testDirs;
 
-        callPackage = pkgs.newScope (
-          allPackages // {inherit callPackage nixosTests;}
-        );
+      callPackage = pkgs.newScope (
+        allPackages // {inherit callPackage nixosTests;}
+      );
 
-        pkgsByName = import ./pkgs/by-name {
-          inherit (pkgs) lib;
-          inherit callPackage;
-        };
+      pkgsByName = import ./pkgs/by-name {
+        inherit (pkgs) lib;
+        inherit callPackage;
+      };
 
-        explicitPkgs = import ./pkgs {
-          inherit (pkgs) lib;
-          inherit callPackage;
-        };
+      explicitPkgs = import ./pkgs {
+        inherit (pkgs) lib;
+        inherit callPackage;
+      };
 
-        allPackages = pkgsByName // explicitPkgs;
-      in
-        allPackages;
+      allPackages = pkgsByName // explicitPkgs;
+    in
+      allPackages;
 
-      importNixpkgs = system: overlays: import nixpkgs {inherit system overlays;};
+    importNixpkgs = system: overlays: import nixpkgs {inherit system overlays;};
 
-      rawNixosConfigs = import ./configs/all-configurations.nix;
+    rawNixosConfigs = import ./configs/all-configurations.nix;
 
-      loadTreefmt = pkgs: treefmt-nix.lib.evalModule pkgs ./treefmt.nix;
+    loadTreefmt = pkgs: treefmt-nix.lib.evalModule pkgs ./treefmt.nix;
+
+    # Attribute set containing all modules obtained via `inputs` and defined
+    # in this flake towards definition of `nixosConfigurations` and `nixosTests`.
+    extendedModules =
+      self.nixosModules
+      // {
+        sops-nix = sops-nix.nixosModules.default;
+      };
 
-      # Attribute set containing all modules obtained via `inputs` and defined
-      # in this flake towards definition of `nixosConfigurations` and `nixosTests`.
-      extendedModules =
-        self.nixosModules
+    nixosConfigurations =
+      mapAttrs
+      (_: config: nixosSystem {modules = [config] ++ attrValues extendedModules;})
+      rawNixosConfigs;
+
+    eachDefaultSystemOutputs = flake-utils.lib.eachDefaultSystem (system: let
+      pkgs = importNixpkgs system [];
+      treefmtEval = loadTreefmt pkgs;
+      toplevel = name: config: nameValuePair "${name}-toplevel" config.config.system.build.toplevel;
+    in {
+      packages = importPackages pkgs;
+      formatter = treefmtEval.config.build.wrapper;
+      checks = mapAttrs' toplevel nixosConfigurations;
+    });
+
+    x86_64-linuxOutputs = let
+      system = "x86_64-linux";
+      pkgs = importNixpkgs system [self.overlays.default];
+      treefmtEval = loadTreefmt pkgs;
+      nonBrokenPkgs = filterAttrs (_: v: !v.meta.broken) self.packages.${system};
+    in {
+      # Github Actions executes `nix flake check` therefore this output
+      # should only contain derivations that can built within CI.
+      # See `.github/workflows/ci.yaml`.
+      checks.${system} =
+        # For `nix flake check` to *build* all packages, because by default
+        # `nix flake check` only evaluates packages and does not build them.
+        nonBrokenPkgs
         // {
-          sops-nix = sops-nix.nixosModules.default;
+          formatting = treefmtEval.config.build.check self;
         };
 
-      nixosConfigurations =
-        mapAttrs
-        (_: config: nixosSystem {modules = [config] ++ attrValues extendedModules;})
-        rawNixosConfigs;
-
-      eachDefaultSystemOutputs = flake-utils.lib.eachDefaultSystem (system: let
-        pkgs = importNixpkgs system [];
-        treefmtEval = loadTreefmt pkgs;
-        toplevel = name: config: nameValuePair "${name}-toplevel" config.config.system.build.toplevel;
-      in {
-        packages = importPackages pkgs;
-        formatter = treefmtEval.config.build.wrapper;
-        checks = mapAttrs' toplevel nixosConfigurations;
-      });
-
-      x86_64-linuxOutputs = let
-        system = "x86_64-linux";
-        pkgs = importNixpkgs system [self.overlays.default];
-        treefmtEval = loadTreefmt pkgs;
-        nonBrokenPkgs = filterAttrs (_: v: !v.meta.broken) self.packages.${system};
+      # To generate a Hydra jobset for CI builds of all packages and tests.
+      # See <https://hydra.ngi0.nixos.org/jobset/ngipkgs/main>.
+      hydraJobs = let
+        passthruTests = concatMapAttrs (name: value:
+          if value ? passthru.tests
+          then {${name} = value.passthru.tests;}
+          else {})
+        nonBrokenPkgs;
       in {
-        # Github Actions executes `nix flake check` therefore this output
-        # should only contain derivations that can built within CI.
-        # See `.github/workflows/ci.yaml`.
-        checks.${system} =
-          # For `nix flake check` to *build* all packages, because by default
-          # `nix flake check` only evaluates packages and does not build them.
-          nonBrokenPkgs
-          // {
-            formatting = treefmtEval.config.build.check self;
-          };
+        packages.${system} = nonBrokenPkgs;
+        tests.${system} = passthruTests;
 
-        # To generate a Hydra jobset for CI builds of all packages and tests.
-        # See <https://hydra.ngi0.nixos.org/jobset/ngipkgs/main>.
-        hydraJobs = let
-          passthruTests = concatMapAttrs (name: value:
-            if value ? passthru.tests
-            then {${name} = value.passthru.tests;}
-            else {})
-          nonBrokenPkgs;
-        in {
-          packages.${system} = nonBrokenPkgs;
-          tests.${system} = passthruTests;
-
-          nixosConfigurations.${system} =
-            mapAttrs
-            (name: config: config.config.system.build.toplevel)
-            nixosConfigurations;
-        };
+        nixosConfigurations.${system} =
+          mapAttrs
+          (name: config: config.config.system.build.toplevel)
+          nixosConfigurations;
       };
+    };
 
-      systemAgnosticOutputs = {
-        inherit nixosConfigurations;
+    systemAgnosticOutputs = {
+      inherit nixosConfigurations;
 
-        nixosModules =
-          (import ./modules/all-modules.nix)
-          // {
-            # The default module adds the default overlay on top of nixpkgs.
-            # This is so that `ngipkgs` can be used alongside `nixpkgs` in a configuration.
-            default.nixpkgs.overlays = [self.overlays.default];
-          };
+      nixosModules =
+        (import ./modules/all-modules.nix)
+        // {
+          # The default module adds the default overlay on top of nixpkgs.
+          # This is so that `ngipkgs` can be used alongside `nixpkgs` in a configuration.
+          default.nixpkgs.overlays = [self.overlays.default];
+        };
 
-        # Overlays a package set (e.g. nixpkgs) with the packages defined in this flake.
-        overlays.default = final: prev: importPackages prev;
-      };
-    in
-      foldr recursiveUpdate {} [
-        eachDefaultSystemOutputs
-        x86_64-linuxOutputs
-        systemAgnosticOutputs
-      ];
+      # Overlays a package set (e.g. nixpkgs) with the packages defined in this flake.
+      overlays.default = final: prev: importPackages prev;
+    };
+  in
+    foldr recursiveUpdate {} [
+      eachDefaultSystemOutputs
+      x86_64-linuxOutputs
+      systemAgnosticOutputs
+    ];
 }
diff --git a/modules/flarum.nix b/modules/flarum.nix
index 4333960d..49cf4bc5 100644
--- a/modules/flarum.nix
+++ b/modules/flarum.nix
@@ -1,16 +1,31 @@
 {
   config,
+  options,
   lib,
   pkgs,
   self,
   utils,
   ...
-}:
-with builtins;
-with lib; let
+}: let
+  inherit
+    (builtins)
+    toJSON
+    ;
+
+  inherit
+    (lib)
+    types
+    mkOption
+    mkIf
+    mkEnableOption
+    mkPackageOption
+    optionalString
+    mkDefault
+    ;
+
   cfg = config.services.flarum;
 
-  flarumInstallConfig = pkgs.writeText "config.json" (builtins.toJSON {
+  flarumInstallConfig = pkgs.writeText "config.json" (toJSON {
     debug = false;
     offline = false;
 
@@ -203,7 +218,7 @@ in {
           chmod a+x . public
           chmod +x site.php extend.php flarum
         ''
-        + lib.optionalString
+        + optionalString
         (cfg.createDatabaseLocally && cfg.database.driver == "mysql") ''
           if [ ! -f config.php ]; then
              php flarum install --file=${flarumInstallConfig}
diff --git a/modules/kbin.nix b/modules/kbin.nix
index 7c4da8c2..215b1474 100644
--- a/modules/kbin.nix
+++ b/modules/kbin.nix
@@ -5,11 +5,32 @@
   pkgs,
   ...
 }: let
-  inherit (lib.attrsets) filterAttrs mapAttrs mapAttrsToList;
-  inherit (lib.generators) mkValueStringDefault;
-  inherit (lib.lists) map optional;
-  inherit (lib.meta) getExe;
-  inherit (lib.strings) concatLines;
+  inherit
+    (builtins)
+    map
+    attrNames
+    listToAttrs
+    ;
+
+  inherit
+    (lib)
+    options
+    types
+    modules
+    filterAttrs
+    mapAttrs
+    mapAttrsToList
+    optional
+    getExe
+    strings
+    concatLines
+    generators
+    ;
+
+  inherit
+    (generators)
+    mkValueStringDefault
+    ;
 
   cfg = config.services.kbin;
   opt = options.services.kbin;
@@ -19,8 +40,8 @@
   secretsNonNull = filterAttrs (_: value: value != null) cfg.secrets;
 
   # For usage of secrets via systemd credentials:
-  credentialIds = builtins.attrNames secretsNonNull;
-  loadCredentials = mapAttrsToList (name: value: "${name}:${builtins.toString value}") secretsNonNull;
+  credentialIds = attrNames secretsNonNull;
+  loadCredentials = mapAttrsToList (name: value: "${name}:${toString value}") secretsNonNull;
 
   kbin-console = pkgs.writeShellApplication rec {
     name = "kbin-console";
@@ -48,8 +69,8 @@
     '';
   };
 in {
-  options.services.kbin = with lib.types;
-  with lib.options; {
+  options.services.kbin = with types;
+  with options; {
     enable = mkEnableOption "Kbin";
 
     package = mkPackageOption pkgs "kbin" {};
@@ -82,7 +103,7 @@ in {
       type = submodule {
         freeformType = attrsOf (nullOr path);
 
-        options = builtins.listToAttrs (builtins.map (
+        options = listToAttrs (map (
             name: {
               inherit name;
               value = mkOption {
@@ -106,8 +127,8 @@ in {
     };
   };
 
-  config = with lib.modules;
-  with lib.options;
+  config = with modules;
+  with options;
     mkIf cfg.enable {
       warnings =
         optional (cfg.settings.APP_ENV == "prod" && cfg.settings.APP_DEBUG != "0")
diff --git a/modules/liberaforms.nix b/modules/liberaforms.nix
index 475c7aa6..cda25032 100644
--- a/modules/liberaforms.nix
+++ b/modules/liberaforms.nix
@@ -3,8 +3,14 @@
   lib,
   pkgs,
   ...
-}:
-with lib; let
+}: let
+  inherit
+    (lib)
+    mkForce
+    mkIf
+    types
+    ;
+
   cfg = config.services.liberaforms;
   user = "liberaforms";
   group = "liberaforms";
@@ -344,7 +350,7 @@ in {
     services.postgresql = mkIf cfg.enablePostgres {
       enable = true;
       package = pkgs.postgresql_11;
-      authentication = lib.mkForce ''
+      authentication = mkForce ''
         # TYPE  DATABASE         USER            ADDRESS          METHOD
         local   postgres         postgres                         trust
         local   liberaforms      liberaforms                      trust
diff --git a/modules/pretalx.nix b/modules/pretalx.nix
index d1ac2f2c..0d10ce56 100644
--- a/modules/pretalx.nix
+++ b/modules/pretalx.nix
@@ -5,9 +5,32 @@
   options,
   pkgs,
   ...
-}:
-with builtins;
-with lib; let
+}: let
+  inherit
+    (builtins)
+    elem
+    concatStringsSep
+    ;
+
+  inherit
+    (lib)
+    optionals
+    modules
+    types
+    mkIf
+    mkEnableOption
+    mkDefault
+    mkOption
+    mkPackageOption
+    mkMerge
+    recursiveUpdate
+    optional
+    escapeShellArgs
+    generators
+    filterAttrs
+    filterAttrsRecursive
+    ;
+
   cfg = config.services.pretalx;
   opt = options.services.pretalx;
   gunicorn = pkgs.python3Packages.gunicorn;
@@ -18,8 +41,8 @@ with lib; let
 
   extras =
     cfg.package.optional-dependencies.redis
-    ++ lib.optionals (cfg.database.backend == "mysql") cfg.package.optional-dependencies.mysql
-    ++ lib.optionals (cfg.database.backend == "postgresql") cfg.package.optional-dependencies.postgres;
+    ++ optionals (cfg.database.backend == "mysql") cfg.package.optional-dependencies.mysql
+    ++ optionals (cfg.database.backend == "postgresql") cfg.package.optional-dependencies.postgres;
 
   PYTHONPATH = "${cfg.package.PYTHONPATH}:${cfg.package.python.pkgs.makePythonPath extras}";
 
@@ -443,9 +466,9 @@ in {
         };
         after =
           []
-          ++ lib.optionals cfg.redis.enable ["redis-pretalx.service"]
-          ++ lib.optionals (cfg.database.backend == "postgresql") ["postgresql.service"]
-          ++ lib.optionals (cfg.database.backend == "mysql") ["mysql.service"];
+          ++ optionals cfg.redis.enable ["redis-pretalx.service"]
+          ++ optionals (cfg.database.backend == "postgresql") ["postgresql.service"]
+          ++ optionals (cfg.database.backend == "mysql") ["mysql.service"];
       };
     in {
       sockets."pretalx-web" = {
@@ -455,7 +478,7 @@ in {
       };
       services = let
         catFile = varname: filename: "export ${varname}=\"$(cat ${filename})\"";
-        exportPasswordEnv = lib.concatStringsSep "\n" ([]
+        exportPasswordEnv = concatStringsSep "\n" ([]
           ++ optional cfg.mail.enable (catFile "PRETALX_MAIL_PASSWORD" cfg.mail.passwordFile)
           ++ optional (cfg.database.passwordFile != null) (catFile "PRETALX_DB_PASS" cfg.database.passwordFile)
           ++ optional cfg.redis.enable (catFile "PRETALX_REDIS" cfg.redis.locationFile)
diff --git a/modules/unbootable.nix b/modules/unbootable.nix
index 3b940ac4..26fd8a96 100644
--- a/modules/unbootable.nix
+++ b/modules/unbootable.nix
@@ -22,8 +22,15 @@
   lib,
   config,
   ...
-}:
-with lib; {
+}: let
+  inherit
+    (lib)
+    mkIf
+    types
+    mkOption
+    mkDefault
+    ;
+in {
   options = {
     unbootable = mkOption {
       type = types.bool;
diff --git a/pkgs/by-name/atomic-cli/package.nix b/pkgs/by-name/atomic-cli/package.nix
index bf4ed079..55295aa9 100644
--- a/pkgs/by-name/atomic-cli/package.nix
+++ b/pkgs/by-name/atomic-cli/package.nix
@@ -3,24 +3,30 @@
   rustPlatform,
   fetchCrate,
   stdenv,
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "atomic-cli";
-  version = "0.34.5";
+}: let
+  inherit
+    (lib)
+    licenses
+    maintainers
+    ;
+in
+  rustPlatform.buildRustPackage rec {
+    pname = "atomic-cli";
+    version = "0.34.5";
 
-  src = fetchCrate {
-    inherit pname version;
-    hash = "sha256-97JltSMuNETcgm5jfb2tOjwgw87J0u8qs+TIViT0PBo=";
-  };
+    src = fetchCrate {
+      inherit pname version;
+      hash = "sha256-97JltSMuNETcgm5jfb2tOjwgw87J0u8qs+TIViT0PBo=";
+    };
 
-  cargoHash = "sha256-NehXV26PBOD+V1KZo8I2EQ7Hp32ccT6e51v5qESj+l4=";
+    cargoHash = "sha256-NehXV26PBOD+V1KZo8I2EQ7Hp32ccT6e51v5qESj+l4=";
 
-  doCheck = false; # TODO(jl): broken upstream
+    doCheck = false; # TODO(jl): broken upstream
 
-  meta = with lib; {
-    description = "CLI tool to create, store, query, validate and convert Atomic Data";
-    homepage = "https://crates.io/crates/atomic-cli";
-    license = licenses.mit;
-    maintainers = with maintainers; [];
-  };
-}
+    meta = {
+      description = "CLI tool to create, store, query, validate and convert Atomic Data";
+      homepage = "https://crates.io/crates/atomic-cli";
+      license = licenses.mit;
+      maintainers = with maintainers; [];
+    };
+  }
diff --git a/pkgs/by-name/atomic-server/package.nix b/pkgs/by-name/atomic-server/package.nix
index c13566f3..ca2a2a32 100644
--- a/pkgs/by-name/atomic-server/package.nix
+++ b/pkgs/by-name/atomic-server/package.nix
@@ -3,24 +3,30 @@
   rustPlatform,
   fetchCrate,
   stdenv,
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "atomic-server";
-  version = "0.34.5";
+}: let
+  inherit
+    (lib)
+    licenses
+    maintainers
+    ;
+in
+  rustPlatform.buildRustPackage rec {
+    pname = "atomic-server";
+    version = "0.34.5";
 
-  src = fetchCrate {
-    inherit pname version;
-    hash = "sha256-X7G/EYhs7CBRZ+7oVKyQRk5WDyFKnQmi8aLbi/KIwgI=";
-  };
+    src = fetchCrate {
+      inherit pname version;
+      hash = "sha256-X7G/EYhs7CBRZ+7oVKyQRk5WDyFKnQmi8aLbi/KIwgI=";
+    };
 
-  cargoHash = "sha256-mox1MdWgCgzytjqAPu1xHKWP8D5oRnXvMyqRbZXM9Pc=";
+    cargoHash = "sha256-mox1MdWgCgzytjqAPu1xHKWP8D5oRnXvMyqRbZXM9Pc=";
 
-  doCheck = false; # TODO(jl): broken upstream
+    doCheck = false; # TODO(jl): broken upstream
 
-  meta = with lib; {
-    description = "A Rust library to serialize, parse, store, convert, validate, edit, fetch and store Atomic Data. Powers both atomic-cli and atomic-server.";
-    homepage = "docs.atomicdata.dev";
-    license = licenses.mit;
-    maintainers = with maintainers; [];
-  };
-}
+    meta = {
+      description = "A Rust library to serialize, parse, store, convert, validate, edit, fetch and store Atomic Data. Powers both atomic-cli and atomic-server.";
+      homepage = "docs.atomicdata.dev";
+      license = licenses.mit;
+      maintainers = with maintainers; [];
+    };
+  }
diff --git a/pkgs/by-name/euclid3/package.nix b/pkgs/by-name/euclid3/package.nix
index 0ad67ed7..9e4bb881 100644
--- a/pkgs/by-name/euclid3/package.nix
+++ b/pkgs/by-name/euclid3/package.nix
@@ -3,7 +3,15 @@
   lib,
   fetchPypi,
 }: let
-  inherit (python3.pkgs) buildPythonPackage;
+  inherit
+    (lib)
+    licenses
+    ;
+
+  inherit
+    (python3.pkgs)
+    buildPythonPackage
+    ;
 in
   buildPythonPackage rec {
     pname = "euclid3";
@@ -19,7 +27,7 @@ in
       "euclid3"
     ];
 
-    meta = with lib; {
+    meta = {
       description = "2D and 3D vector, matrix, quaternion and geometry module.";
       homepage = "http://code.google.com/p/pyeuclid/";
       license = licenses.lgpl21Plus;
diff --git a/pkgs/by-name/flarum/package.nix b/pkgs/by-name/flarum/package.nix
index 4880f87d..e1effd7d 100644
--- a/pkgs/by-name/flarum/package.nix
+++ b/pkgs/by-name/flarum/package.nix
@@ -3,26 +3,31 @@
   fetchurl,
   lib,
   php,
-}:
-php.buildComposerProject (finalAttrs: {
-  pname = "flarum";
-  version = "1.8.0";
+}: let
+  inherit
+    (lib)
+    licenses
+    ;
+in
+  php.buildComposerProject (finalAttrs: {
+    pname = "flarum";
+    version = "1.8.0";
 
-  src = fetchFromGitHub {
-    owner = "flarum";
-    repo = "flarum";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-xadZIdyH20mxfxCyiDRtSRSrPj8DWXpuup61WSsjgWw=";
-  };
+    src = fetchFromGitHub {
+      owner = "flarum";
+      repo = "flarum";
+      rev = "v${finalAttrs.version}";
+      hash = "sha256-xadZIdyH20mxfxCyiDRtSRSrPj8DWXpuup61WSsjgWw=";
+    };
 
-  composerLock = ./composer.lock;
-  composerStrictValidation = false;
-  vendorHash = "sha256-G/EPHcvcppuyAC0MAzE11ZjlOSTlphQrHnO3yS4+j5g=";
+    composerLock = ./composer.lock;
+    composerStrictValidation = false;
+    vendorHash = "sha256-G/EPHcvcppuyAC0MAzE11ZjlOSTlphQrHnO3yS4+j5g=";
 
-  meta = {
-    changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";
-    description = "Flarum is a delightfully simple discussion platform for your website";
-    homepage = "https://github.com/flarum/flarum";
-    license = lib.licenses.mit;
-  };
-})
+    meta = {
+      changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";
+      description = "Flarum is a delightfully simple discussion platform for your website";
+      homepage = "https://github.com/flarum/flarum";
+      license = licenses.mit;
+    };
+  })
diff --git a/pkgs/by-name/kbin-backend/package.nix b/pkgs/by-name/kbin-backend/package.nix
index cdd041e4..eddc1915 100644
--- a/pkgs/by-name/kbin-backend/package.nix
+++ b/pkgs/by-name/kbin-backend/package.nix
@@ -6,6 +6,11 @@
   yq,
   withS3 ? false,
 }: let
+  inherit
+    (lib)
+    optionalString
+    ;
+
   phpWithExtensions = php.withExtensions ({
     enabled,
     all,
@@ -46,7 +51,7 @@ in
           < config/packages/oneup_flysystem.yaml \
           | sponge config/packages/oneup_flysystem.yaml
       ''
-      + (lib.optionalString withS3 ''
+      + (optionalString withS3 ''
         yq '(
           .oneup_flysystem.filesystems.public_uploads_filesystem.adapter = "kbin.s3_adapter" |
           .oneup_flysystem.adapters.kbin.s3_adapter.awss3v3 = {client: "kbin.s3_client", bucket: "%amazon.s3.bucket%"}
diff --git a/pkgs/by-name/kikit/package.nix b/pkgs/by-name/kikit/package.nix
index 3977b434..3456079a 100644
--- a/pkgs/by-name/kikit/package.nix
+++ b/pkgs/by-name/kikit/package.nix
@@ -7,13 +7,19 @@
   bats,
   callPackage,
 }: let
+  inherit
+    (lib)
+    toLower
+    licenses
+    ;
+
   properCaseName = "KiKit";
 
   shapely = callPackage ./shapely {};
   solidpython = callPackage ./solidpython {};
 in
   python3.pkgs.buildPythonPackage rec {
-    pname = lib.toLower properCaseName;
+    pname = toLower properCaseName;
     version = "1.3.0";
     format = "setuptools";
 
@@ -67,7 +73,7 @@ in
       runHook postCheck
     '';
 
-    meta = with lib; {
+    meta = {
       description = "Automation for KiCAD boards";
       homepage = "https://github.com/yaqwsx/KiKit/";
       changelog = "https://github.com/yaqwsx/KiKit/releases/tag/v${version}";
diff --git a/pkgs/by-name/kikit/shapely/default.nix b/pkgs/by-name/kikit/shapely/default.nix
index 40305c3b..44b1d2b8 100644
--- a/pkgs/by-name/kikit/shapely/default.nix
+++ b/pkgs/by-name/kikit/shapely/default.nix
@@ -5,63 +5,71 @@
   fetchPypi,
   substituteAll,
   python3,
-}:
-python3.pkgs.buildPythonPackage rec {
-  pname = "Shapely";
-  version = "1.8.4";
-  disabled = python3.pkgs.pythonOlder "3.6";
+}: let
+  inherit
+    (lib)
+    optionals
+    licenses
+    maintainers
+    optionalString
+    ;
+in
+  python3.pkgs.buildPythonPackage rec {
+    pname = "Shapely";
+    version = "1.8.4";
+    disabled = python3.pkgs.pythonOlder "3.6";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-oZXlHKr6IYKR8suqP+9p/TNTyT7EtlsqRyLEz0DDGYw=";
-  };
+    src = fetchPypi {
+      inherit pname version;
+      sha256 = "sha256-oZXlHKr6IYKR8suqP+9p/TNTyT7EtlsqRyLEz0DDGYw=";
+    };
 
-  nativeBuildInputs = with pkgs; [
-    pkgs.geos # for geos-config
-    python3.pkgs.cython
-  ];
+    nativeBuildInputs = with pkgs; [
+      pkgs.geos # for geos-config
+      python3.pkgs.cython
+    ];
 
-  propagatedBuildInputs = with python3.pkgs; [
-    numpy
-  ];
+    propagatedBuildInputs = with python3.pkgs; [
+      numpy
+    ];
 
-  checkInputs = with python3.pkgs; [
-    pytestCheckHook
-  ];
+    checkInputs = with python3.pkgs; [
+      pytestCheckHook
+    ];
 
-  # Environment variable used in shapely/_buildcfg.py
-  GEOS_LIBRARY_PATH = "${pkgs.geos}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";
+    # Environment variable used in shapely/_buildcfg.py
+    GEOS_LIBRARY_PATH = "${pkgs.geos}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";
 
-  patches = [
-    # Patch to search form GOES .so/.dylib files in a Nix-aware way
-    (substituteAll {
-      src = ./library-paths.patch;
-      libgeos_c = GEOS_LIBRARY_PATH;
-      libc = lib.optionalString (!stdenv.isDarwin) "${stdenv.cc.libc}/lib/libc${stdenv.hostPlatform.extensions.sharedLibrary}.6";
-    })
-  ];
+    patches = [
+      # Patch to search form GOES .so/.dylib files in a Nix-aware way
+      (substituteAll {
+        src = ./library-paths.patch;
+        libgeos_c = GEOS_LIBRARY_PATH;
+        libc = optionalString (!stdenv.isDarwin) "${stdenv.cc.libc}/lib/libc${stdenv.hostPlatform.extensions.sharedLibrary}.6";
+      })
+    ];
 
-  preCheck = ''
-    rm -r shapely # prevent import of local shapely
-  '';
+    preCheck = ''
+      rm -r shapely # prevent import of local shapely
+    '';
 
-  disabledTests = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
-    # FIXME(lf-): these logging tests are broken, which is definitely our
-    # fault. I've tried figuring out the cause and failed.
-    #
-    # It is apparently some sandbox or no-sandbox related thing on macOS only
-    # though.
-    "test_error_handler_exception"
-    "test_error_handler"
-    "test_info_handler"
-  ];
+    disabledTests = optionals (stdenv.isDarwin && stdenv.isAarch64) [
+      # FIXME(lf-): these logging tests are broken, which is definitely our
+      # fault. I've tried figuring out the cause and failed.
+      #
+      # It is apparently some sandbox or no-sandbox related thing on macOS only
+      # though.
+      "test_error_handler_exception"
+      "test_error_handler"
+      "test_info_handler"
+    ];
 
-  pythonImportsCheck = ["shapely"];
+    pythonImportsCheck = ["shapely"];
 
-  meta = with lib; {
-    description = "Geometric objects, predicates, and operations";
-    homepage = "https://pypi.python.org/pypi/Shapely/";
-    license = with licenses; [bsd3];
-    maintainers = with maintainers; [knedlsepp];
-  };
-}
+    meta = {
+      description = "Geometric objects, predicates, and operations";
+      homepage = "https://pypi.python.org/pypi/Shapely/";
+      license = with licenses; [bsd3];
+      maintainers = with maintainers; [knedlsepp];
+    };
+  }
diff --git a/pkgs/by-name/kikit/solidpython/default.nix b/pkgs/by-name/kikit/solidpython/default.nix
index a04dc336..7015c4f3 100644
--- a/pkgs/by-name/kikit/solidpython/default.nix
+++ b/pkgs/by-name/kikit/solidpython/default.nix
@@ -7,7 +7,15 @@
   lib,
   euclid3,
 }: let
-  inherit (python3.pkgs) buildPythonPackage;
+  inherit
+    (lib)
+    licenses
+    ;
+
+  inherit
+    (python3.pkgs)
+    buildPythonPackage
+    ;
 
   pypng = python3.pkgs.pypng.overrideAttrs (old: rec {
     version = "0.0.19";
@@ -68,7 +76,7 @@ in
       "solid"
     ];
 
-    meta = with lib; {
+    meta = {
       description = "Python interface to the OpenSCAD declarative geometry language";
       homepage = "https://github.com/SolidCode/SolidPython";
       changelog = "https://github.com/SolidCode/SolidPython/releases/tag/v${version}";
diff --git a/pkgs/by-name/lcrq/package.nix b/pkgs/by-name/lcrq/package.nix
index 892453d0..3e10c290 100644
--- a/pkgs/by-name/lcrq/package.nix
+++ b/pkgs/by-name/lcrq/package.nix
@@ -3,25 +3,30 @@
   fetchFromGitea,
   lib,
   ...
-}:
-stdenv.mkDerivation rec {
-  name = "lcrq";
-  version = "0.1.0";
+}: let
+  inherit
+    (lib)
+    licenses
+    ;
+in
+  stdenv.mkDerivation rec {
+    name = "lcrq";
+    version = "0.1.0";
 
-  src = fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "librecast";
-    repo = "lcrq";
-    rev = "v${version}";
-    sha256 = "sha256-s8+uTF6GQ76wG1zoAxqCaVT1J5Rd7vxPKX4zbQx6ro4=";
-  };
+    src = fetchFromGitea {
+      domain = "codeberg.org";
+      owner = "librecast";
+      repo = "lcrq";
+      rev = "v${version}";
+      sha256 = "sha256-s8+uTF6GQ76wG1zoAxqCaVT1J5Rd7vxPKX4zbQx6ro4=";
+    };
 
-  installFlags = ["PREFIX=$(out)"];
+    installFlags = ["PREFIX=$(out)"];
 
-  meta = with lib; {
-    homepage = "https://librecast.net/lcrq.html";
-    changelog = "https://codeberg.org/librecast/lcrq/src/tag/v${version}/CHANGELOG.md";
-    description = "Librecast RaptorQ library.";
-    license = [licenses.gpl2 licenses.gpl3];
-  };
-}
+    meta = {
+      homepage = "https://librecast.net/lcrq.html";
+      changelog = "https://codeberg.org/librecast/lcrq/src/tag/v${version}/CHANGELOG.md";
+      description = "Librecast RaptorQ library.";
+      license = [licenses.gpl2 licenses.gpl3];
+    };
+  }
diff --git a/pkgs/by-name/lcsync/package.nix b/pkgs/by-name/lcsync/package.nix
index 28efbe40..c5ad6cb1 100644
--- a/pkgs/by-name/lcsync/package.nix
+++ b/pkgs/by-name/lcsync/package.nix
@@ -6,27 +6,32 @@
   librecast,
   lib,
   ...
-}:
-stdenv.mkDerivation rec {
-  name = "lcsync";
-  version = "0.2.1";
+}: let
+  inherit
+    (lib)
+    licenses
+    ;
+in
+  stdenv.mkDerivation rec {
+    name = "lcsync";
+    version = "0.2.1";
 
-  src = fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "librecast";
-    repo = "lcsync";
-    rev = "v${version}";
-    sha256 = "sha256-RVfa0EmCPPT7ndy94YwD24S9pj7L11ztISaKHGcbTS8=";
-  };
-  buildInputs = [lcrq librecast pkgs.libsodium];
-  configureFlags = ["SETCAP_PROGRAM=true"];
-  installFlags = ["PREFIX=$(out)"];
-  doCheck = true;
+    src = fetchFromGitea {
+      domain = "codeberg.org";
+      owner = "librecast";
+      repo = "lcsync";
+      rev = "v${version}";
+      sha256 = "sha256-RVfa0EmCPPT7ndy94YwD24S9pj7L11ztISaKHGcbTS8=";
+    };
+    buildInputs = [lcrq librecast pkgs.libsodium];
+    configureFlags = ["SETCAP_PROGRAM=true"];
+    installFlags = ["PREFIX=$(out)"];
+    doCheck = true;
 
-  meta = with lib; {
-    homepage = "https://librecast.net/lcsync.html";
-    changelog = "https://codeberg.org/librecast/lcsync/src/tag/v${version}/CHANGELOG.md";
-    description = "Librecast File and Syncing Tool";
-    license = [licenses.gpl2 licenses.gpl3];
-  };
-}
+    meta = {
+      homepage = "https://librecast.net/lcsync.html";
+      changelog = "https://codeberg.org/librecast/lcsync/src/tag/v${version}/CHANGELOG.md";
+      description = "Librecast File and Syncing Tool";
+      license = [licenses.gpl2 licenses.gpl3];
+    };
+  }
diff --git a/pkgs/by-name/librecast/package.nix b/pkgs/by-name/librecast/package.nix
index d192e9c4..317601a8 100644
--- a/pkgs/by-name/librecast/package.nix
+++ b/pkgs/by-name/librecast/package.nix
@@ -5,25 +5,30 @@
   lcrq,
   lib,
   ...
-}:
-stdenv.mkDerivation rec {
-  name = "librecast";
-  version = "0.7-RC3";
+}: let
+  inherit
+    (lib)
+    licenses
+    ;
+in
+  stdenv.mkDerivation rec {
+    name = "librecast";
+    version = "0.7-RC3";
 
-  src = fetchFromGitea {
-    domain = "codeberg.org";
-    owner = "librecast";
-    repo = "librecast";
-    rev = "v${version}";
-    sha256 = "sha256-AD3MpWg8Lp+VkizwYTuuS2YWM8e0xaMEavVIvwhSZRo=";
-  };
-  buildInputs = [lcrq pkgs.libsodium];
-  installFlags = ["PREFIX=$(out)"];
+    src = fetchFromGitea {
+      domain = "codeberg.org";
+      owner = "librecast";
+      repo = "librecast";
+      rev = "v${version}";
+      sha256 = "sha256-AD3MpWg8Lp+VkizwYTuuS2YWM8e0xaMEavVIvwhSZRo=";
+    };
+    buildInputs = [lcrq pkgs.libsodium];
+    installFlags = ["PREFIX=$(out)"];
 
-  meta = with lib; {
-    homepage = "https://librecast.net/librecast.html";
-    changelog = "https://codeberg.org/librecast/librecast/src/tag/v${version}/CHANGELOG.md";
-    description = "IPv6 multicast library";
-    license = [licenses.gpl2 licenses.gpl3];
-  };
-}
+    meta = {
+      homepage = "https://librecast.net/librecast.html";
+      changelog = "https://codeberg.org/librecast/librecast/src/tag/v${version}/CHANGELOG.md";
+      description = "IPv6 multicast library";
+      license = [licenses.gpl2 licenses.gpl3];
+    };
+  }
diff --git a/pkgs/by-name/pcbnew-transition/package.nix b/pkgs/by-name/pcbnew-transition/package.nix
index b975effe..5273adb6 100644
--- a/pkgs/by-name/pcbnew-transition/package.nix
+++ b/pkgs/by-name/pcbnew-transition/package.nix
@@ -3,7 +3,15 @@
   fetchPypi,
   lib,
 }: let
-  inherit (python3.pkgs) buildPythonPackage;
+  inherit
+    (lib)
+    licenses
+    ;
+
+  inherit
+    (python3.pkgs)
+    buildPythonPackage
+    ;
 
   properCaseName = "pcbnewTransition";
 in
@@ -31,7 +39,7 @@ in
       properCaseName
     ];
 
-    meta = with lib; {
+    meta = {
       description = "Library that allows you to support both, KiCAD 5 and KiCAD 6 in your plugins";
       homepage = "https://github.com/yaqwsx/pcbnewTransition";
       changelog = "https://github.com/yaqwsx/pcbnewTransition/releases/tag/v${version}";
diff --git a/pkgs/by-name/pybars3/package.nix b/pkgs/by-name/pybars3/package.nix
index 3193875d..7e5584ef 100644
--- a/pkgs/by-name/pybars3/package.nix
+++ b/pkgs/by-name/pybars3/package.nix
@@ -3,35 +3,40 @@
   fetchPypi,
   lib,
   pymeta3,
-}:
-python3.pkgs.buildPythonPackage rec {
-  pname = "pybars3";
-  version = "0.9.7";
-  format = "setuptools";
+}: let
+  inherit
+    (lib)
+    licenses
+    ;
+in
+  python3.pkgs.buildPythonPackage rec {
+    pname = "pybars3";
+    version = "0.9.7";
+    format = "setuptools";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-ashH6QXlO5xbk2rxEskQR14nv3Z/efRSjBb5rx7A4lI=";
-  };
+    src = fetchPypi {
+      inherit pname version;
+      hash = "sha256-ashH6QXlO5xbk2rxEskQR14nv3Z/efRSjBb5rx7A4lI=";
+    };
 
-  propagatedBuildInputs = with python3.pkgs; [
-    pymeta3
-  ];
+    propagatedBuildInputs = with python3.pkgs; [
+      pymeta3
+    ];
 
-  checkPhase = ''
-    runHook preCheck
-    ${python3.interpreter} tests.py
-    runHook postCheck
-  '';
+    checkPhase = ''
+      runHook preCheck
+      ${python3.interpreter} tests.py
+      runHook postCheck
+    '';
 
-  pythonImportsCheck = [
-    "pybars"
-  ];
+    pythonImportsCheck = [
+      "pybars"
+    ];
 
-  meta = with lib; {
-    description = "Handlebars.js template support for Python 3 and 2";
-    homepage = "https://github.com/wbond/pybars3";
-    changelog = "https://github.com/wbond/pybars3/releases/tag/${version}";
-    license = licenses.lgpl3Only;
-  };
-}
+    meta = {
+      description = "Handlebars.js template support for Python 3 and 2";
+      homepage = "https://github.com/wbond/pybars3";
+      changelog = "https://github.com/wbond/pybars3/releases/tag/${version}";
+      license = licenses.lgpl3Only;
+    };
+  }
diff --git a/pkgs/by-name/pymeta3/package.nix b/pkgs/by-name/pymeta3/package.nix
index 8437ba5e..e7bb95dd 100644
--- a/pkgs/by-name/pymeta3/package.nix
+++ b/pkgs/by-name/pymeta3/package.nix
@@ -3,11 +3,21 @@
   fetchPypi,
   lib,
 }: let
-  inherit (python3.pkgs) buildPythonPackage;
+  inherit
+    (lib)
+    toLower
+    licenses
+    ;
+
+  inherit
+    (python3.pkgs)
+    buildPythonPackage
+    ;
+
   properCaseName = "PyMeta3";
 in
   buildPythonPackage rec {
-    pname = lib.toLower properCaseName;
+    pname = toLower properCaseName;
     version = "0.5.1";
     format = "setuptools";
 
@@ -23,7 +33,7 @@ in
       "pymeta"
     ];
 
-    meta = with lib; {
+    meta = {
       description = "Pattern-matching language based on OMeta for Python 3 and 2";
       homepage = "https://github.com/wbond/pymeta3";
       changelog = "https://github.com/wbond/pymeta3/releases/tag/${version}";
diff --git a/pkgs/by-name/rosenpass-tools/package.nix b/pkgs/by-name/rosenpass-tools/package.nix
index 35a7fe6c..5c728982 100644
--- a/pkgs/by-name/rosenpass-tools/package.nix
+++ b/pkgs/by-name/rosenpass-tools/package.nix
@@ -8,30 +8,35 @@
   gawk,
   rosenpass,
   wireguard-tools,
-}:
-stdenv.mkDerivation {
-  inherit (rosenpass) version src;
-  pname = "rosenpass-tools";
+}: let
+  inherit
+    (lib)
+    makeBinPath
+    ;
+in
+  stdenv.mkDerivation {
+    inherit (rosenpass) version src;
+    pname = "rosenpass-tools";
 
-  nativeBuildInputs = [makeWrapper installShellFiles];
+    nativeBuildInputs = [makeWrapper installShellFiles];
 
-  postInstall = ''
-    install -D $src/rp $out/bin/rp
-    installManPage $src/doc/rp.1
-    wrapProgram $out/bin/rp \
-      --prefix PATH : ${lib.makeBinPath [
-      coreutils
-      findutils
-      gawk
-      rosenpass
-      wireguard-tools
-    ]}
-  '';
+    postInstall = ''
+      install -D $src/rp $out/bin/rp
+      installManPage $src/doc/rp.1
+      wrapProgram $out/bin/rp \
+        --prefix PATH : ${makeBinPath [
+        coreutils
+        findutils
+        gawk
+        rosenpass
+        wireguard-tools
+      ]}
+    '';
 
-  meta =
-    rosenpass.meta
-    // {
-      description = "This package contains the Rosenpass tool `rp`, which is a script that wraps the `rosenpass` binary.";
-      mainProgram = "rp";
-    };
-}
+    meta =
+      rosenpass.meta
+      // {
+        description = "This package contains the Rosenpass tool `rp`, which is a script that wraps the `rosenpass` binary.";
+        mainProgram = "rp";
+      };
+  }
diff --git a/pkgs/by-name/rosenpass/package.nix b/pkgs/by-name/rosenpass/package.nix
index e4baa777..c4945b2a 100644
--- a/pkgs/by-name/rosenpass/package.nix
+++ b/pkgs/by-name/rosenpass/package.nix
@@ -8,53 +8,60 @@
   cmake,
   libsodium,
   pkg-config,
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "rosenpass";
-  version = "unstable-2023-09-28";
-
-  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "b15f17133f8b5c3c5175b4cfd4fc10039a4e203f";
-    hash = "sha256-UXAkmt4VY0irLK2k4t6SW+SEodFE3CbX5cFbsPG0ZCo=";
-  };
-
-  cargoHash = "sha256-N1DQHkgKgkDQ6DbgQJlpZkZ7AMTqX3P8R/cWr14jK2I=";
-
-  nativeBuildInputs = [
-    cmake # for oqs build in the oqs-sys crate
-    pkg-config
-    rustPlatform.bindgenHook # for C-bindings in the crypto libs
-    installShellFiles
-  ];
-
-  buildInputs = [libsodium];
-
-  # nix defaults to building for aarch64 _without_ the armv8-a
-  # crypto extensions, but liboqs depends on these
-  preBuild = lib.optionalString targetPlatform.isAarch64 ''
-    NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -march=armv8-a+crypto"
-  '';
-
-  postInstall = ''
-    installManPage doc/rosenpass.1
-  '';
-
-  passthru.tests.rosenpass = nixosTests.rosenpass;
-
-  meta = with lib; {
-    description = "Build post-quantum-secure VPNs with WireGuard!";
-    homepage = "https://rosenpass.eu/";
-    license = with licenses; [
-      mit
-      /*
-      or
-      */
-      asl20
+}: let
+  inherit
+    (lib)
+    optionalString
+    licenses
+    maintainers
+    ;
+in
+  rustPlatform.buildRustPackage rec {
+    pname = "rosenpass";
+    version = "unstable-2023-09-28";
+
+    src = fetchFromGitHub {
+      owner = pname;
+      repo = pname;
+      rev = "b15f17133f8b5c3c5175b4cfd4fc10039a4e203f";
+      hash = "sha256-UXAkmt4VY0irLK2k4t6SW+SEodFE3CbX5cFbsPG0ZCo=";
+    };
+
+    cargoHash = "sha256-N1DQHkgKgkDQ6DbgQJlpZkZ7AMTqX3P8R/cWr14jK2I=";
+
+    nativeBuildInputs = [
+      cmake # for oqs build in the oqs-sys crate
+      pkg-config
+      rustPlatform.bindgenHook # for C-bindings in the crypto libs
+      installShellFiles
     ];
-    maintainers = with maintainers; [wucke13];
-    platforms = ["aarch64-darwin" "aarch64-linux" "x86_64-darwin" "x86_64-linux"];
-    mainProgram = "rosenpass";
-  };
-}
+
+    buildInputs = [libsodium];
+
+    # nix defaults to building for aarch64 _without_ the armv8-a
+    # crypto extensions, but liboqs depends on these
+    preBuild = optionalString targetPlatform.isAarch64 ''
+      NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -march=armv8-a+crypto"
+    '';
+
+    postInstall = ''
+      installManPage doc/rosenpass.1
+    '';
+
+    passthru.tests.rosenpass = nixosTests.rosenpass;
+
+    meta = {
+      description = "Build post-quantum-secure VPNs with WireGuard!";
+      homepage = "https://rosenpass.eu/";
+      license = with licenses; [
+        mit
+        /*
+        or
+        */
+        asl20
+      ];
+      maintainers = with maintainers; [wucke13];
+      platforms = ["aarch64-darwin" "aarch64-linux" "x86_64-darwin" "x86_64-linux"];
+      mainProgram = "rosenpass";
+    };
+  }
diff --git a/pkgs/by-name/steamworks/package.nix b/pkgs/by-name/steamworks/package.nix
index fec55308..c512da98 100644
--- a/pkgs/by-name/steamworks/package.nix
+++ b/pkgs/by-name/steamworks/package.nix
@@ -11,38 +11,44 @@
   catch2,
   log4cpp,
   fetchFromGitLab,
-}:
-stdenv.mkDerivation rec {
-  pname = "steamworks";
-  version = "0.97.2";
+}: let
+  inherit
+    (lib)
+    licenses
+    platforms
+    ;
+in
+  stdenv.mkDerivation rec {
+    pname = "steamworks";
+    version = "0.97.2";
 
-  src = fetchFromGitLab {
-    owner = "arpa2";
-    repo = "steamworks";
-    rev = "v${version}";
-    hash = "sha256-hD1nTyv/t7MQdopqivfSE0o4Qk1ymG8zQVg56lY+t9o=";
-  };
+    src = fetchFromGitLab {
+      owner = "arpa2";
+      repo = "steamworks";
+      rev = "v${version}";
+      hash = "sha256-hD1nTyv/t7MQdopqivfSE0o4Qk1ymG8zQVg56lY+t9o=";
+    };
 
-  nativeBuildInputs = [cmake arpa2cm arpa2common];
+    nativeBuildInputs = [cmake arpa2cm arpa2common];
 
-  buildInputs = [
-    openldap
-    flex
-    bison
-    sqlite
-    #catch2 # Currently makes the CMakeFile generate a wrong linker path
-    log4cpp
-  ];
+    buildInputs = [
+      openldap
+      flex
+      bison
+      sqlite
+      #catch2 # Currently makes the CMakeFile generate a wrong linker path
+      log4cpp
+    ];
 
-  # Currently doesn't build in `Release` since a macro is messing with some code
-  # when building in `Release`.
-  cmakeBuildType = "Debug";
+    # Currently doesn't build in `Release` since a macro is messing with some code
+    # when building in `Release`.
+    cmakeBuildType = "Debug";
 
-  meta = with lib; {
-    description = "Configuration information distributed over LDAP in near realtime";
-    homepage = "https://gitlab.com/arpa2/steamworks";
-    license = licenses.bsd2;
-    maintainers = [];
-    platforms = platforms.linux;
-  };
-}
+    meta = {
+      description = "Configuration information distributed over LDAP in near realtime";
+      homepage = "https://gitlab.com/arpa2/steamworks";
+      license = licenses.bsd2;
+      maintainers = [];
+      platforms = platforms.linux;
+    };
+  }
diff --git a/pkgs/by-name/wireguard-rs/package.nix b/pkgs/by-name/wireguard-rs/package.nix
index 630edabc..2c6b074d 100644
--- a/pkgs/by-name/wireguard-rs/package.nix
+++ b/pkgs/by-name/wireguard-rs/package.nix
@@ -2,23 +2,28 @@
   lib,
   rustPlatform,
   fetchgit,
-}:
-rustPlatform.buildRustPackage {
-  pname = "wireguard-rs";
-  version = "unstable-2021-01-13";
+}: let
+  inherit
+    (lib)
+    licenses
+    ;
+in
+  rustPlatform.buildRustPackage {
+    pname = "wireguard-rs";
+    version = "unstable-2021-01-13";
 
-  src = fetchgit {
-    url = "https://git.zx2c4.com/wireguard-rs";
-    rev = "7d84ef9064559a29b23ab86036f7ef62b450f90c";
-    hash = "sha256-UlT0c0J4oY+E1UM2ElueHECjrxErIBERwiF1huLvtds=";
-  };
+    src = fetchgit {
+      url = "https://git.zx2c4.com/wireguard-rs";
+      rev = "7d84ef9064559a29b23ab86036f7ef62b450f90c";
+      hash = "sha256-UlT0c0J4oY+E1UM2ElueHECjrxErIBERwiF1huLvtds=";
+    };
 
-  cargoSha256 = "sha256-zYcIGTExDcDnRvwTcBRaJGxkiFpft/RelEd4quP9RrA=";
+    cargoSha256 = "sha256-zYcIGTExDcDnRvwTcBRaJGxkiFpft/RelEd4quP9RrA=";
 
-  meta = {
-    homepage = "https://git.zx2c4.com/wireguard-rs";
-    description = "Rust implementation of WireGuard";
-    license = lib.licenses.mit;
-    mainProgram = "wireguard-rs";
-  };
-}
+    meta = {
+      homepage = "https://git.zx2c4.com/wireguard-rs";
+      description = "Rust implementation of WireGuard";
+      license = licenses.mit;
+      mainProgram = "wireguard-rs";
+    };
+  }
diff --git a/pkgs/default.nix b/pkgs/default.nix
index a2e08155..c5b3eaae 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -2,6 +2,11 @@
   lib,
   callPackage,
 }: let
+  inherit
+    (lib)
+    recurseIntoAttrs
+    ;
+
   self = rec {
     # LiberaForms is intentionally disabled.
     # Refer to <https://github.com/ngi-nix/ngipkgs/issues/40>.
@@ -21,7 +26,7 @@
     };
 
     inherit
-      (lib.recurseIntoAttrs (callPackage ./pretalx/plugins.nix {}))
+      (recurseIntoAttrs (callPackage ./pretalx/plugins.nix {}))
       pretalx-downstream
       pretalx-media-ccc-de
       pretalx-pages
diff --git a/pkgs/liberaforms/default.nix b/pkgs/liberaforms/default.nix
index 5880d62b..7634f1d2 100644
--- a/pkgs/liberaforms/default.nix
+++ b/pkgs/liberaforms/default.nix
@@ -5,15 +5,25 @@
   postgresql_11,
   fetchFromGitLab,
   fetchFromGitHub,
-  pkgs,
   system,
+  lib,
   ...
 }: let
+  inherit
+    (builtins)
+    readFile
+    ;
+
+  inherit
+    (lib)
+    replaceStrings
+    ;
+
   src = callPackage ./src.nix {};
 in
   stdenv.mkDerivation {
     pname = "liberaforms";
-    version = with builtins; let
+    version = let
       remove-newline = replaceStrings ["\n"] [""];
     in
       remove-newline (readFile "${src}/VERSION.txt");
diff --git a/pkgs/liberaforms/env.nix b/pkgs/liberaforms/env.nix
index 7a01b566..1d20f195 100644
--- a/pkgs/liberaforms/env.nix
+++ b/pkgs/liberaforms/env.nix
@@ -4,6 +4,12 @@
   system,
   ...
 }: let
+  inherit
+    (builtins)
+    readFile
+    replaceStrings
+    ;
+
   liberaforms-src = callPackage ./src.nix {};
 
   # Mach Nix is broken on recent Nixpkgs
@@ -28,10 +34,10 @@
     {pkgs = machPkgs;};
 
   requirements = let
-    req = builtins.readFile "${liberaforms-src}/requirements.txt";
+    req = readFile "${liberaforms-src}/requirements.txt";
     #TODO lots of notes here; mach-nix doesnt handle (??xref various issues) range of cryptography package - because it doesnt support pyproject.toml?
     #I don't like this, but doing this is the fastest way to get the cryptography from nixpkgs, which is at 36.0.0 (mach-nix automatically finds it)
-    filteredReq = builtins.replaceStrings ["cryptography==36.0.1"] ["cryptography==36.0.0"] req; # for liberaforms > v2.0.1
+    filteredReq = replaceStrings ["cryptography==36.0.1"] ["cryptography==36.0.0"] req; # for liberaforms > v2.0.1
     # Needed for tests only; TODO upstream should make a dev-requirements.txt or whatever?
     # https://gitlab.com/liberaforms/liberaforms/-/commit/16c893ff539bfb6249b3b02f4c834eb8848c16d5
     extraReq = "factory_boy";
diff --git a/pkgs/pretalx/default.nix b/pkgs/pretalx/default.nix
index 0f289cfe..6641b6e9 100644
--- a/pkgs/pretalx/default.nix
+++ b/pkgs/pretalx/default.nix
@@ -9,8 +9,19 @@
   pretalx-frontend,
   nodejs,
   withPlugins ? [],
-}:
-with builtins; let
+}: let
+  inherit
+    (builtins)
+    attrValues
+    ;
+
+  inherit
+    (lib)
+    flatten
+    licenses
+    maintainers
+    ;
+
   python = python3.override {
     packageOverrides = self: super: {
       django-formtools = super.django-formtools.overridePythonAttrs rec {
@@ -136,7 +147,7 @@ in
         pytestCheckHook
         responses
       ]
-      ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+      ++ flatten (attrValues passthru.optional-dependencies);
 
     doCheck = true;
 
@@ -163,7 +174,7 @@ in
       tests.pretalx = nixosTests.pretalx;
     };
 
-    meta = with lib; {
+    meta = {
       description = "Conference planning tool: CfP, scheduling, speaker management";
       homepage = "https://github.com/pretalx/pretalx";
       license = licenses.asl20;
diff --git a/pkgs/pretalx/frontend.nix b/pkgs/pretalx/frontend.nix
index e185f007..be17217b 100644
--- a/pkgs/pretalx/frontend.nix
+++ b/pkgs/pretalx/frontend.nix
@@ -2,34 +2,40 @@
   lib,
   fetchFromGitHub,
   buildNpmPackage,
-}:
-buildNpmPackage rec {
-  pname = "pretalx-frontend";
-  version = "2023.1.0";
+}: let
+  inherit
+    (lib)
+    licenses
+    maintainers
+    ;
+in
+  buildNpmPackage rec {
+    pname = "pretalx-frontend";
+    version = "2023.1.0";
 
-  src = fetchFromGitHub {
-    owner = "pretalx";
-    repo = "pretalx";
-    rev = "v${version}";
-    hash = "sha256-Few4Ojd2i0ELKWPJfkmfd3HeKFx/QK+aP5hYAHDdHeE=";
-  };
+    src = fetchFromGitHub {
+      owner = "pretalx";
+      repo = "pretalx";
+      rev = "v${version}";
+      hash = "sha256-Few4Ojd2i0ELKWPJfkmfd3HeKFx/QK+aP5hYAHDdHeE=";
+    };
 
-  sourceRoot = "source/src/pretalx/frontend/schedule-editor";
+    sourceRoot = "source/src/pretalx/frontend/schedule-editor";
 
-  npmDepsHash = "sha256-4cnBHZ8WpHgp/bbsYYbdtrhuD6ffUAZq9ZjoLpWGfRg=";
+    npmDepsHash = "sha256-4cnBHZ8WpHgp/bbsYYbdtrhuD6ffUAZq9ZjoLpWGfRg=";
 
-  buildPhase = ''
-    runHook preBuild
+    buildPhase = ''
+      runHook preBuild
 
-    npm run build
+      npm run build
 
-    runHook postBuild
-  '';
+      runHook postBuild
+    '';
 
-  meta = with lib; {
-    description = "Conference planning tool: CfP, scheduling, speaker management";
-    homepage = "https://github.com/pretalx/pretalx";
-    license = licenses.asl20;
-    maintainers = with maintainers; [hexa];
-  };
-}
+    meta = {
+      description = "Conference planning tool: CfP, scheduling, speaker management";
+      homepage = "https://github.com/pretalx/pretalx";
+      license = licenses.asl20;
+      maintainers = with maintainers; [hexa];
+    };
+  }
diff --git a/pkgs/pretalx/plugins.nix b/pkgs/pretalx/plugins.nix
index e72805ec..7df1dc8f 100644
--- a/pkgs/pretalx/plugins.nix
+++ b/pkgs/pretalx/plugins.nix
@@ -5,6 +5,11 @@
   python3,
   py ? python3,
 }: let
+  inherit
+    (lib)
+    fakeHash
+    ;
+
   defaultNativeBuildInputs = [gettext py.pkgs.django];
   plugin = {
     name,
@@ -12,7 +17,7 @@
     version,
     rev ? "v${version}",
     repo ? "pretalx-${name}",
-    hash ? lib.fakeHash,
+    hash ? fakeHash,
     format ? "setuptools",
     doCheck ? false,
     nativeBuildInputs ? defaultNativeBuildInputs,
diff --git a/tests/kbin/default.nix b/tests/kbin/default.nix
index 683c2bae..d4b6bc9a 100644
--- a/tests/kbin/default.nix
+++ b/tests/kbin/default.nix
@@ -1,8 +1,14 @@
 {
   configurations,
   modules,
+  lib,
   ...
-}: {
+}: let
+  inherit
+    (lib)
+    mkForce
+    ;
+in {
   name = "kbin";
 
   nodes = {
@@ -18,14 +24,14 @@
         configurations.kbin
       ];
 
-      unbootable = lib.mkForce false;
+      unbootable = mkForce false;
 
       services.phpfpm.pools.kbin = {
         settings = {
           "pm.start_servers" = 1;
           "pm.min_spare_servers" = 1;
         };
-        phpOptions = lib.mkForce ''
+        phpOptions = mkForce ''
           error_log = stderr
           log_errors = on
           error_reporting = E_ALL
diff --git a/tests/pretalx/default.nix b/tests/pretalx/default.nix
index 6ee6cf62..7cd3b470 100644
--- a/tests/pretalx/default.nix
+++ b/tests/pretalx/default.nix
@@ -1,8 +1,14 @@
 {
   configurations,
   modules,
+  lib,
   ...
-}: {
+}: let
+  inherit
+    (lib)
+    mkForce
+    ;
+in {
   name = "pretalx tests";
 
   nodes = {
@@ -19,14 +25,14 @@
         modules.unbootable
       ];
 
-      unbootable = pkgs.lib.mkForce false;
+      unbootable = mkForce false;
 
-      sops = pkgs.lib.mkForce {
+      sops = mkForce {
         age.keyFile = ./sops/keys.txt;
         defaultSopsFile = ./sops/pretalx.yaml;
       };
 
-      services.pretalx.site.url = pkgs.lib.mkForce "http://localhost:8000";
+      services.pretalx.site.url = mkForce "http://localhost:8000";
 
       # Use kmscon <https://www.freedesktop.org/wiki/Software/kmscon/>
       # to provide a slightly nicer console, and while we're at it,