diff --git a/flake.nix b/flake.nix
index 1625f88..b60c05d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -88,7 +88,11 @@
       };
     } // flake-utils.lib.eachDefaultSystem (system:
       let
-        pkgs = serokell-nix.lib.pkgsWith nixpkgs.legacyPackages.${system} allOverlays;
+        pkgsAllowUnfree = import nixpkgs {
+          inherit system;
+          config.allowUnfreePredicate = pkg: builtins.elem (pkg.pname) [ "terraform" ];
+        };
+        pkgs = serokell-nix.lib.pkgsWith pkgsAllowUnfree allOverlays;
 
         tfConfigAst = terranix.lib.terranixConfigurationAst {
           inherit system pkgs;
diff --git a/lib/common/edna/server.nix b/lib/common/edna/server.nix
index 7a41df9..79c4c98 100644
--- a/lib/common/edna/server.nix
+++ b/lib/common/edna/server.nix
@@ -13,9 +13,7 @@
 
     virtualisation.docker = {
       enable = true;
-      logLevel = "warn";
       storageDriver = "overlay2";
-      networks.edna = {};
     };
 
     virtualisation.oci-containers.containers = let
diff --git a/servers/alzirr/platform.nix b/servers/alzirr/platform.nix
index 8ab9591..eba1c0b 100644
--- a/servers/alzirr/platform.nix
+++ b/servers/alzirr/platform.nix
@@ -44,12 +44,11 @@
   # machines irrespective of host names.
   # We do not worry about plugging disks into the wrong machine because
   # we will never exchange disks between machines.
-  environment.etc."mdadm.conf".text = ''
-    HOMEHOST hetzner
-  '';
   # The RAIDs are assembled in stage1, so we need to make the config
   # available there.
-  boot.swraid.mdadmConf = config.environment.etc."mdadm.conf".text;
+  boot.swraid.mdadmConf = ''
+    HOMEHOST hetzner
+  '';
 
   # Default mdmonitor service does not work, fix it by directing events to the log.
   # See https://github.com/NixOS/nixpkgs/issues/72394
diff --git a/servers/wasat/default.nix b/servers/wasat/default.nix
index f987be8..65529e7 100644
--- a/servers/wasat/default.nix
+++ b/servers/wasat/default.nix
@@ -62,7 +62,7 @@ in {
   # dns server blocking malicious hostnames
   services.dnsmasq = {
     enable = true;
-    servers = [ "1.1.1.1" "1.0.0.1" ];
+    settings.server = [ "1.1.1.1" "1.0.0.1" ];
     resolveLocalQueries = false;
     extraConfig = ''
       interface=wg-serokell
@@ -73,5 +73,5 @@ in {
   };
 
   # dnsmasq needs wireguard interface
-  systemd.services.dnsmasq.after = [ "wireguard-wg-serokell.service" ];
+  systemd.services.dnsmasq.after = [ "wireguard-wg-serokell.service" "efi.mount"];
 }