diff --git a/flake.nix b/flake.nix
index de73864c..5faeafea 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,7 +5,6 @@
 
     nix-vm-test.url = "github:numtide/nix-vm-test";
     nix-vm-test.inputs.nixpkgs.follows = "nixpkgs";
-    nix-vm-test.inputs.flake-utils.follows = "flake-utils";
 
     # for rust nightly with llvm-tools-preview
     rust-overlay.url = "github:oxalica/rust-overlay";
diff --git a/pkgs/package-rpm.nix b/pkgs/package-rpm.nix
index ee840fb1..dcb5be13 100644
--- a/pkgs/package-rpm.nix
+++ b/pkgs/package-rpm.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  system,
+  stdenvNoCC,
   runCommand,
   rosenpass,
   rpm,
@@ -10,7 +10,7 @@ let
   splitVersion = lib.strings.splitString "-" rosenpass.version;
   version = builtins.head splitVersion;
   release = if builtins.length splitVersion != 2 then "release" else builtins.elemAt splitVersion 1;
-  arch = builtins.head (builtins.split "-" system);
+  arch = builtins.head (builtins.split "-" stdenvNoCC.hostPlatform.system);
 in
 
 runCommand "rosenpass-${version}.rpm" { } ''
diff --git a/pkgs/release-package.nix b/pkgs/release-package.nix
index e74156e0..261a21be 100644
--- a/pkgs/release-package.nix
+++ b/pkgs/release-package.nix
@@ -1,30 +1,26 @@
 {
-  lib,
   stdenvNoCC,
   runCommand,
   pkgsStatic,
   rosenpass,
   rosenpass-oci-image,
   rp,
-}@args:
+}:
 
 let
   version = rosenpass.version;
 
   # select static packages on Linux, default packages otherwise
-  package = if stdenvNoCC.hostPlatform.isLinux then pkgsStatic.rosenpass else args.rosenpass;
-  rp = if stdenvNoCC.hostPlatform.isLinux then pkgsStatic.rp else args.rp;
-  oci-image =
-    if stdenvNoCC.hostPlatform.isLinux then
-      pkgsStatic.rosenpass-oci-image
-    else
-      args.rosenpass-oci-image;
+  rosenpass' = if stdenvNoCC.hostPlatform.isLinux then pkgsStatic.rosenpass else rosenpass;
+  rp' = if stdenvNoCC.hostPlatform.isLinux then pkgsStatic.rp else rp;
+  rosenpass-oci-image' =
+    if stdenvNoCC.hostPlatform.isLinux then pkgsStatic.rosenpass-oci-image else rosenpass-oci-image;
 in
 runCommand "lace-result" { } ''
   mkdir {bin,$out}
   tar -cvf $out/rosenpass-${stdenvNoCC.hostPlatform.system}-${version}.tar \
-    -C ${package} bin/rosenpass lib/systemd \
-    -C ${rp} bin/rp
-  cp ${oci-image} \
+    -C ${rosenpass'} bin/rosenpass lib/systemd \
+    -C ${rp'} bin/rp
+  cp ${rosenpass-oci-image'} \
     $out/rosenpass-oci-image-${stdenvNoCC.hostPlatform.system}-${version}.tar.gz
 ''
diff --git a/pkgs/rosenpass.nix b/pkgs/rosenpass.nix
index 027e8b0a..802dbbf0 100644
--- a/pkgs/rosenpass.nix
+++ b/pkgs/rosenpass.nix
@@ -56,7 +56,7 @@ let
   };
 
   # parsed Cargo.toml
-  cargoToml = builtins.fromTOML (builtins.readFile (src + "/rosenpass/Cargo.toml"));
+  cargoToml = lib.trivial.importTOML (src + "/rosenpass/Cargo.toml");
 in
 rustPlatform.buildRustPackage {
   name = cargoToml.package.name;
diff --git a/tests/integration/rp-key-exchange.nix b/tests/integration/rp-key-exchange.nix
index 97832b5a..eb32596d 100644
--- a/tests/integration/rp-key-exchange.nix
+++ b/tests/integration/rp-key-exchange.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  pkgs,
   config,
   ...
 }:
diff --git a/tests/integration/rpsc-test.nix b/tests/integration/rpsc-test.nix
index c53d4efc..fee30784 100644
--- a/tests/integration/rpsc-test.nix
+++ b/tests/integration/rpsc-test.nix
@@ -42,18 +42,18 @@ let
         ''
           public_key = "${rosenpassKeyFolder}/self.pk"
           secret_key = "${rosenpassKeyFolder}/self.sk"
-          listen = ["[::]:${builtins.toString rpPort}"]
+          listen = ["[::]:${toString rpPort}"]
           verbosity = "Verbose"
 
           [[peers]]
           public_key = "${rosenpassKeyFolder}/peer-b.pk"
-          endpoint = "peerbkeyexchanger:${builtins.toString rpPort}"
+          endpoint = "peerbkeyexchanger:${toString rpPort}"
           key_out = "${keyExchangePathAB}"
         ''
         + (lib.optionalString multiPeer ''
           [[peers]]
           public_key = "${rosenpassKeyFolder}/peer-c.pk"
-          endpoint = "peerckeyexchanger:${builtins.toString rpPort}"
+          endpoint = "peerckeyexchanger:${toString rpPort}"
           key_out = "${keyExchangePathAC}"
         '')
       );
@@ -66,18 +66,18 @@ let
         ''
           public_key = "${rosenpassKeyFolder}/self.pk"
           secret_key = "${rosenpassKeyFolder}/self.sk"
-          listen = ["[::]:${builtins.toString rpPort}"]
+          listen = ["[::]:${toString rpPort}"]
           verbosity = "Verbose"
 
           [[peers]]
           public_key = "${rosenpassKeyFolder}/peer-a.pk"
-          endpoint = "peerakeyexchanger:${builtins.toString rpPort}"
+          endpoint = "peerakeyexchanger:${toString rpPort}"
           key_out = "${keyExchangePathBA}"
         ''
         + (lib.optionalString multiPeer ''
           [[peers]]
           public_key = "${rosenpassKeyFolder}/peer-c.pk"
-          endpoint = "peerckeyexchanger:${builtins.toString rpPort}"
+          endpoint = "peerckeyexchanger:${toString rpPort}"
           key_out = "${keyExchangePathBC}"
         '')
       );
@@ -92,15 +92,15 @@ let
       rosenpassConfig = builtins.toFile "peer-c.toml" ''
         public_key = "${rosenpassKeyFolder}/self.pk"
         secret_key = "${rosenpassKeyFolder}/self.sk"
-        listen = ["[::]:${builtins.toString rpPort}"]
+        listen = ["[::]:${toString rpPort}"]
         verbosity = "Verbose"
         [[peers]]
         public_key = "${rosenpassKeyFolder}/peer-a.pk"
-        endpoint = "peerakeyexchanger:${builtins.toString rpPort}"
+        endpoint = "peerakeyexchanger:${toString rpPort}"
         key_out = "${keyExchangePathCA}"
         [[peers]]
         public_key = "${rosenpassKeyFolder}/peer-b.pk"
-        endpoint = "peerckeyexchanger:${builtins.toString rpPort}"
+        endpoint = "peerckeyexchanger:${toString rpPort}"
         key_out = "${keyExchangePathCB}"
       '';
     };
@@ -146,7 +146,7 @@ in
           rpHost = "peerakeyexchanger";
           peerPubkeyFile = staticConfig.peerB.wgPublicKeyFile;
           remoteKeyPath = keyExchangePathAB;
-          endpoint = "peerB:${builtins.toString wgPort}";
+          endpoint = "peerB:${toString wgPort}";
           allowedIps = "${staticConfig.peerB.innerIp}/32";
         };
       }
@@ -158,7 +158,7 @@ in
           rpHost = "peerakeyexchanger";
           peerPubkeyFile = staticConfig.peerC.wgPublicKeyFile;
           remoteKeyPath = keyExchangePathAC;
-          endpoint = "peerC:${builtins.toString wgPort}";
+          endpoint = "peerC:${toString wgPort}";
           allowedIps = "${staticConfig.peerC.innerIp}/32";
         };
       };
@@ -175,7 +175,7 @@ in
           rpHost = "peerbkeyexchanger";
           peerPubkeyFile = staticConfig.peerA.wgPublicKeyFile;
           remoteKeyPath = keyExchangePathBA;
-          endpoint = "peerA:${builtins.toString wgPort}";
+          endpoint = "peerA:${toString wgPort}";
           allowedIps = "${staticConfig.peerA.innerIp}/32";
         };
       }
@@ -187,7 +187,7 @@ in
           rpHost = "peerbkeyexchanger";
           peerPubkeyFile = staticConfig.peerC.wgPublicKeyFile;
           remoteKeyPath = keyExchangePathBC;
-          endpoint = "peerC:${builtins.toString wgPort}";
+          endpoint = "peerC:${toString wgPort}";
           allowedIps = "${staticConfig.peerC.innerIp}/32";
         };
       };
@@ -235,7 +235,7 @@ in
           rpHost = "peerckeyexchanger";
           peerPubkeyFile = staticConfig.peerA.wgPublicKeyFile;
           remoteKeyPath = keyExchangePathCA;
-          endpoint = "peerA:${builtins.toString wgPort}";
+          endpoint = "peerA:${toString wgPort}";
           allowedIps = "${staticConfig.peerA.innerIp}/32";
         };
         CB = {
@@ -245,7 +245,7 @@ in
           rpHost = "peerckeyexchanger";
           peerPubkeyFile = staticConfig.peerB.wgPublicKeyFile;
           remoteKeyPath = keyExchangePathCB;
-          endpoint = "peerB:${builtins.toString wgPort}";
+          endpoint = "peerB:${toString wgPort}";
           allowedIps = "${staticConfig.peerB.innerIp}/32";
         };
       };
@@ -315,7 +315,7 @@ in
     };
   };
 
-  testScript = (''
+  testScript = ''
     start_all()
 
     print("""Config file versions supported by peers
@@ -381,10 +381,10 @@ in
 
     # Set up wireguard on peerA
     peerA.succeed("ip link add ${wgInterface} type wireguard")
-    peerA.succeed("${pkgs.wireguard-tools}/bin/wg set ${wgInterface} private-key ${staticConfig.peerA.wgPrivateKeyFile} listen-port ${builtins.toString wgPort}")
-    peerA.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerBWgPk} allowed-ips ${staticConfig.peerB.innerIp}/32 endpoint peerB:${builtins.toString wgPort} preshared-key ${wireguardKeyFolder}/peerB.psk")
+    peerA.succeed("${pkgs.wireguard-tools}/bin/wg set ${wgInterface} private-key ${staticConfig.peerA.wgPrivateKeyFile} listen-port ${toString wgPort}")
+    peerA.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerBWgPk} allowed-ips ${staticConfig.peerB.innerIp}/32 endpoint peerB:${toString wgPort} preshared-key ${wireguardKeyFolder}/peerB.psk")
     ${lib.optionalString multiPeer ''
-      peerA.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerCWgPk} allowed-ips ${staticConfig.peerC.innerIp}/32 endpoint peerC:${builtins.toString wgPort} preshared-key ${wireguardKeyFolder}/peerC.psk")
+      peerA.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerCWgPk} allowed-ips ${staticConfig.peerC.innerIp}/32 endpoint peerC:${toString wgPort} preshared-key ${wireguardKeyFolder}/peerC.psk")
     ''}
     peerA.succeed("ip addr add ${staticConfig.peerA.innerIp}/32 dev ${wgInterface}")
     peerA.succeed("ip link set ${wgInterface} up")
@@ -395,10 +395,10 @@ in
 
     # Set up wireguard on peerB
     peerB.succeed("ip link add ${wgInterface} type wireguard")
-    peerB.succeed("${pkgs.wireguard-tools}/bin/wg set ${wgInterface} private-key ${staticConfig.peerB.wgPrivateKeyFile} listen-port ${builtins.toString wgPort}")
-    peerB.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerAWgPk} allowed-ips ${staticConfig.peerA.innerIp}/32 endpoint peerA:${builtins.toString wgPort} preshared-key ${wireguardKeyFolder}/peerA.psk")
+    peerB.succeed("${pkgs.wireguard-tools}/bin/wg set ${wgInterface} private-key ${staticConfig.peerB.wgPrivateKeyFile} listen-port ${toString wgPort}")
+    peerB.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerAWgPk} allowed-ips ${staticConfig.peerA.innerIp}/32 endpoint peerA:${toString wgPort} preshared-key ${wireguardKeyFolder}/peerA.psk")
     ${lib.optionalString multiPeer ''
-      peerB.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerCWgPk} allowed-ips ${staticConfig.peerC.innerIp}/32 endpoint peerC:${builtins.toString wgPort} preshared-key ${wireguardKeyFolder}/peerC.psk")
+      peerB.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerCWgPk} allowed-ips ${staticConfig.peerC.innerIp}/32 endpoint peerC:${toString wgPort} preshared-key ${wireguardKeyFolder}/peerC.psk")
     ''}
     peerB.succeed("ip addr add ${staticConfig.peerB.innerIp}/32 dev ${wgInterface}")
     peerB.succeed("ip link set ${wgInterface} up")
@@ -410,9 +410,9 @@ in
     # Set up wireguard on peerC
     ${lib.optionalString multiPeer ''
       peerC.succeed("ip link add ${wgInterface} type wireguard")
-      peerC.succeed("${pkgs.wireguard-tools}/bin/wg set ${wgInterface} private-key ${staticConfig.peerC.wgPrivateKeyFile} listen-port ${builtins.toString wgPort}")
-      peerC.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerAWgPk} allowed-ips ${staticConfig.peerA.innerIp}/32 endpoint peerA:${builtins.toString wgPort} preshared-key ${wireguardKeyFolder}/peerA.psk")
-      peerC.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerBWgPk} allowed-ips ${staticConfig.peerB.innerIp}/32 endpoint peerB:${builtins.toString wgPort} preshared-key ${wireguardKeyFolder}/peerB.psk")
+      peerC.succeed("${pkgs.wireguard-tools}/bin/wg set ${wgInterface} private-key ${staticConfig.peerC.wgPrivateKeyFile} listen-port ${toString wgPort}")
+      peerC.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerAWgPk} allowed-ips ${staticConfig.peerA.innerIp}/32 endpoint peerA:${toString wgPort} preshared-key ${wireguardKeyFolder}/peerA.psk")
+      peerC.succeed(f"${pkgs.wireguard-tools}/bin/wg set ${wgInterface} peer {peerBWgPk} allowed-ips ${staticConfig.peerB.innerIp}/32 endpoint peerB:${toString wgPort} preshared-key ${wireguardKeyFolder}/peerB.psk")
       peerC.succeed("ip addr add ${staticConfig.peerC.innerIp}/32 dev ${wgInterface}")
       peerC.succeed("ip link set ${wgInterface} up")
       peerC.succeed("ip route add ${staticConfig.peerA.innerIp} dev ${wgInterface} scope link")
@@ -578,5 +578,5 @@ in
       peerC.succeed("${pkgs.wireguard-tools}/bin/wg show all preshared-keys 1>&2")
     ''}
 
-  '');
+  '';
 }
diff --git a/tests/systemd/rosenpass.nix b/tests/systemd/rosenpass.nix
index 3b2fc19d..b267c750 100644
--- a/tests/systemd/rosenpass.nix
+++ b/tests/systemd/rosenpass.nix
@@ -69,8 +69,6 @@ in
       shared =
         peer:
         {
-          config,
-          modulesPath,
           pkgs,
           ...
         }:
diff --git a/tests/systemd/rp.nix b/tests/systemd/rp.nix
index a554a8f2..acdf3dab 100644
--- a/tests/systemd/rp.nix
+++ b/tests/systemd/rp.nix
@@ -59,8 +59,6 @@ in
       shared =
         peer:
         {
-          config,
-          modulesPath,
           pkgs,
           ...
         }:
diff --git a/treefmt.nix b/treefmt.nix
index ec16ae83..2a551124 100644
--- a/treefmt.nix
+++ b/treefmt.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ ... }:
 {
   # Used to find the project root
   projectRootFile = "flake.nix";