diff --git a/flake.nix b/flake.nix
index c39bdf49..cfe30830 100644
--- a/flake.nix
+++ b/flake.nix
@@ -287,7 +287,10 @@
 
         bind = nixosSystem' {
           modules = [
-            { nixpkgs.overlays = with secrets.overlays; [ bind ]; }
+            {
+              # TODO: migrate to sops
+              nixpkgs.overlays = with secrets.overlays; [ bind ];
+            }
             self.nixosModules.microvm
             ./hosts/bind
           ];
@@ -346,6 +349,7 @@
             self.nixosModules.microvm
             ./hosts/dn42
             {
+              # TODO: migrate to sops
               nixpkgs.overlays = [ secrets.overlays.dn42 ];
             }
           ];
@@ -370,6 +374,7 @@
             self.nixosModules.microvm
             ./hosts/freifunk
             {
+              # TODO: migrate to sops
               nixpkgs.overlays = with secrets.overlays; [
                 freifunk ospf
               ];
@@ -437,7 +442,10 @@
 
         jabber = nixosSystem' {
           modules = [
-            { nixpkgs.overlays = with secrets.overlays; [ jabber ]; }
+            {
+              # TODO: migrate to sops
+              nixpkgs.overlays = with secrets.overlays; [ jabber ];
+            }
             self.nixosModules.microvm
             ./hosts/jabber
           ];
@@ -507,9 +515,13 @@
 
         mucbot = nixosSystem' {
           modules = [
-            { _module.args = { inherit tigger; }; }
             "${tigger}/module.nix"
-            { nixpkgs.overlays = [ secrets.overlays.mucbot ]; }
+            {
+              _module.args = { inherit tigger; };
+
+              # TODO: migrate to sops
+              nixpkgs.overlays = [ secrets.overlays.mucbot ];
+            }
             ./hosts/mucbot
             self.nixosModules.cluster-options
           ];
@@ -641,8 +653,10 @@
             self.nixosModules.microvm
             ./hosts/scrape
             {
-              nixpkgs.overlays = [ secrets.overlays.scrape ];
               _module.args = { inherit scrapers; };
+
+              # TODO: migrate to sops
+              nixpkgs.overlays = [ secrets.overlays.scrape ];
             }
           ];
         };
@@ -650,7 +664,10 @@
         sdrweb = nixosSystem' {
           modules = [
             self.nixosModules.cluster-options
-            { nixpkgs.overlays = [ secrets.overlays.mucbot ]; }
+            {
+              # TODO: migrate to sops
+              nixpkgs.overlays = [ secrets.overlays.mucbot ];
+            }
             heliwatch.nixosModules.heliwatch
             ./hosts/sdrweb
           ];