diff --git a/hosts/dacbert/default.nix b/hosts/dacbert/default.nix
index 19864896..90bbd332 100644
--- a/hosts/dacbert/default.nix
+++ b/hosts/dacbert/default.nix
@@ -73,16 +73,16 @@
   };
 
   nix = {
-    buildCores = 4;
-    maxJobs = 1;
-    trustedUsers = [ "client" ];
-    extraOptions = ''
-      builders-use-substitutes = true
-      extra-platforms = armv6l-linux
-    '';
     daemonCPUSchedPolicy = "idle";
     daemonIOSchedClass = "idle";
-    settings.system-features = [];
+    settings = {
+      builders-use-substitutes = true;
+      cores = 4;
+      extra-platforms = "armv6l-linux";
+      max-jobs = 1;
+      system-features = [];
+      trusted-users = [ "client" ];
+    };
   };
   # kernel 32bit personality patch from Ubuntu
   boot.kernelPatches = [
diff --git a/hosts/hydra/default.nix b/hosts/hydra/default.nix
index 0e6a954e..3277103e 100644
--- a/hosts/hydra/default.nix
+++ b/hosts/hydra/default.nix
@@ -22,14 +22,14 @@
 
   nix = {
     sshServe.enable = true;
-    trustedUsers = [ "@wheel" ];
     settings = {
+      # # restore default overridden by harmonia
+      # allowed-users = lib.mkForce [ "*" ];
       auto-optimise-store = true;
       cores = 20;
       keep-outputs = true;
       max-jobs = 8;
-      # restore default overridden by harmonia
-      allowed-users = lib.mkForce [ "*" ];
+      trusted-users = [ "@wheel" ];
     };
   };
 
diff --git a/hosts/riscbert/default.nix b/hosts/riscbert/default.nix
index 32a80066..906cd5b8 100644
--- a/hosts/riscbert/default.nix
+++ b/hosts/riscbert/default.nix
@@ -54,14 +54,14 @@
   '';
 
   nix = {
-    buildCores = 2;
-    maxJobs = 1;
-    # trustedUsers = [ "client" ];
-    extraOptions = ''
-      builders-use-substitutes = true
-    '';
     daemonCPUSchedPolicy = "idle";
     daemonIOSchedClass = "idle";
+    settings = {
+      builders-use-substitutes = true;
+      cores = 2;
+      max-jobs = 1;
+      # trusted-users = [ "client" ];
+    };
   };
 
   system.stateVersion = "22.05";