diff --git a/modules/features/nixos-base.nix b/modules/features/nixos-base.nix
index 4d66484..40c1178 100644
--- a/modules/features/nixos-base.nix
+++ b/modules/features/nixos-base.nix
@@ -8,6 +8,7 @@
     nixpkgs.config = {
       permittedInsecurePackages = [ "openssl-1.1.1w" ];
       allowUnfree = true;
+      problems.handlers.sublimetext4.broken = "ignore";
     };
 
     # Set your time zone.
diff --git a/modules/hosts/janus/default.nix b/modules/hosts/janus/default.nix
index 30bd608..6173f14 100644
--- a/modules/hosts/janus/default.nix
+++ b/modules/hosts/janus/default.nix
@@ -16,7 +16,6 @@ in
           lib.removePrefix "/etc/" cfg.certDir
         else
           cfg.certDir;
-      certRootEtcPath = "${certDirEtcPath}/root_ca.crt";
       mkStepRules = home: user: group: [
         "d ${home}/.step 0700 ${user} ${group} -"
         "d ${home}/.step/config 0700 ${user} ${group} -"
@@ -38,10 +37,9 @@ in
         environment.etc = lib.mkIf cfgInEtc {
           "step-ca/defaults.json".text = builtins.toJSON {
             ca-url = "https://janus.john-stream.com/";
-            fingerprint = builtins.readFile ./fingerprint;
-            root = "/etc/${certRootEtcPath}";
+            fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
+            root = ./root_ca.crt;
           };
-          "${certRootEtcPath}".source = ./root_ca.crt;
         };
         systemd.tmpfiles.rules =
           mkStepRules johnHome username johnGroup
@@ -49,14 +47,6 @@ in
       };
     };
 
-  flake.modules.homeManager.janus-ca = { config, ... }: {
-    home.file.".step/config/defaults.json".text = builtins.toJSON {
-      ca-url = "https://janus.john-stream.com/";
-      fingerprint = builtins.readFile ./fingerprint;
-      root = ./root_ca.crt;
-    };
-  };
-
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
     modules = with inputs.self.modules; [
       nixos.lxc
@@ -70,6 +60,7 @@ in
       nixos.mtls
       {
         networking.hostName = hostname;
+        sops.defaultSopsFile = ../../../keys/secrets.yaml;
         step-ssh-host = {
           hostname = hostname;
         };
@@ -86,7 +77,6 @@ in
           imports = with inputs.self.modules.homeManager; [
             mysops
           ];
-          shell.program = "zsh";
           docker.enable = true;
         };
       }
diff --git a/modules/hosts/john-kde/default.nix b/modules/hosts/john-kde/default.nix
index b0f488b..d8777bd 100644
--- a/modules/hosts/john-kde/default.nix
+++ b/modules/hosts/john-kde/default.nix
@@ -62,9 +62,15 @@ in
     };
   };
 
-  flake.homeConfigurations."john@john-kde" = withSystem "x86_64-linux" (ctx@{ system, inputs', ... }:
-    inputs.home-manager.lib.homeManagerConfiguration {
-      pkgs = inputs'.nixpkgs.legacyPackages;
-      modules = [ inputs.self.modules.homeManager."${hostname}" ]; # Uses the module defined above
-  });
+  flake.homeConfigurations."john@john-kde" = inputs.home-manager.lib.homeManagerConfiguration {
+    pkgs = import inputs.nixpkgs.outPath {
+      localSystem.system = "x86_64-linux";
+      config = {
+        allowUnfree = true;
+        permittedInsecurePackages = [ "openssl-1.1.1w" ];
+        problems.handlers.sublimetext4.broken = "ignore";
+      };
+    };
+    modules = [ inputs.self.modules.homeManager."${hostname}" ]; # Uses the module defined above
+  };
 }
diff --git a/modules/hosts/john-pc/default.nix b/modules/hosts/john-pc/default.nix
index 3130835..31dcaa9 100644
--- a/modules/hosts/john-pc/default.nix
+++ b/modules/hosts/john-pc/default.nix
@@ -59,7 +59,7 @@ in
     ssh = {
       certificates.enable = true;
       knownHosts = [
-        "fded:fb16:653e:25da:be24:11ff:fea0:753f ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ9ZqiWPrCwHjxFCiu0lT4rlQs7KyMapxKJQQ5PJP1eh"
+        "@cert-authority fded:fb16:653e:25da:be24:11ff:fea0:753f ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ="
       ];
       matchSets = {
         certs = true;
@@ -106,13 +106,15 @@ in
     # };
   };
 
-  flake.homeConfigurations."john@john-pc-ubuntu" = withSystem "x86_64-linux" (ctx@{ system, inputs', ... }:
-    inputs.home-manager.lib.homeManagerConfiguration {
-      # pkgs = import inputs.nixpkgs {
-      #   inherit system;
-      #   overlays = [ inputs.self.overlays.default ];
-      # };
-      pkgs = inputs'.nixpkgs.legacyPackages;
-      modules = [ inputs.self.modules.homeManager."${hostname}" ];
-  });
+  flake.homeConfigurations."john@john-pc-ubuntu" = inputs.home-manager.lib.homeManagerConfiguration {
+    pkgs = import inputs.nixpkgs.outPath {
+      localSystem.system = "x86_64-linux";
+      config = {
+        allowUnfree = true;
+        permittedInsecurePackages = [ "openssl-1.1.1w" ];
+        problems.handlers.sublimetext4.broken = "ignore";
+      };
+    };
+    modules = [ inputs.self.modules.homeManager."${hostname}" ];
+  };
 }
diff --git a/modules/hosts/test-nix.nix b/modules/hosts/test-nix.nix
index 86ae718..5650720 100644
--- a/modules/hosts/test-nix.nix
+++ b/modules/hosts/test-nix.nix
@@ -13,11 +13,12 @@ in
       nixos."${username}"
       nixos.docker
       {
+        step-ssh-host.hostname = hostname;
+        sops.defaultSopsFile = ../../keys/secrets.yaml;
         home-manager.users."${username}" = {
           imports = with inputs.self.modules.homeManager; [
             mysops
           ];
-          shell.program = "zsh";
           docker.enable = true;
           ssh.matchSets = {
             certs = true;