diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 8b771fb..6d089c1 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -1,9 +1,6 @@
 name: Check
 
 on:
-  push:
-    branches:
-      - main
   pull_request:
     branches:
       - main
diff --git a/flake.lock b/flake.lock
index e287297..ddd8e0c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -17,6 +17,36 @@
       }
     },
     "crane": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "flake-utils": [
+          "helix",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "helix",
+          "nixpkgs"
+        ],
+        "rust-overlay": [
+          "helix",
+          "rust-overlay"
+        ]
+      },
+      "locked": {
+        "lastModified": 1688772518,
+        "narHash": "sha256-ol7gZxwvgLnxNSZwFTDJJ49xVY5teaSvF7lzlo3YQfM=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "8b08e96c9af8c6e3a2b69af5a7fa168750fcf88e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "crane_2": {
       "inputs": {
         "flake-compat": [
           "lanzaboote",
@@ -103,6 +133,22 @@
         "type": "github"
       }
     },
+    "flake-compat_3": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1673956053,
+        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -128,6 +174,24 @@
       "inputs": {
         "systems": "systems"
       },
+      "locked": {
+        "lastModified": 1689068808,
+        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
       "locked": {
         "lastModified": 1681202837,
         "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
@@ -164,6 +228,26 @@
         "type": "github"
       }
     },
+    "helix": {
+      "inputs": {
+        "crane": "crane",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1691765042,
+        "narHash": "sha256-EeMn5KYej0NmCf3ghOjq2s8axjaKfqurak5FzScGTO0=",
+        "owner": "helix-editor",
+        "repo": "helix",
+        "rev": "ee3171cc54052bc8d3569cc04bd9f6a57b43afca",
+        "type": "github"
+      },
+      "original": {
+        "id": "helix",
+        "type": "indirect"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -171,11 +255,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1691506824,
-        "narHash": "sha256-Z2Ms7036CCEAfCmDBDy+sFauO6/7fx2UN3aoPCpp4tA=",
+        "lastModified": 1691853673,
+        "narHash": "sha256-GyiO0cIQjfcBHB6CfF0/36EjFNfCXtXtB12k6h2qPtg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7b8d43fbaf8450c30caaed5eab876897d0af891b",
+        "rev": "255f921049df8d45fb5afa2529b79106edbd8301",
         "type": "github"
       },
       "original": {
@@ -221,15 +305,15 @@
     },
     "lanzaboote": {
       "inputs": {
-        "crane": "crane",
-        "flake-compat": "flake-compat_2",
+        "crane": "crane_2",
+        "flake-compat": "flake-compat_3",
         "flake-parts": "flake-parts",
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": [
           "nixpkgs"
         ],
         "pre-commit-hooks-nix": "pre-commit-hooks-nix",
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
         "lastModified": 1682802423,
@@ -287,11 +371,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1691305349,
-        "narHash": "sha256-0Pig7jnmuRH3c5dOTVTOvTLwo2CRzYTyvJRQ82HWRSo=",
+        "lastModified": 1691730710,
+        "narHash": "sha256-q/UBet5RdX8CBjOIpI2Y8EB8DXYr9cb7WuNGTP9HKf8=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "5426a95071d0b9782b3209b3995cde1f5689616e",
+        "rev": "f61352cf8066ddd3dfe9058e62184bae7382672d",
         "type": "github"
       },
       "original": {
@@ -301,17 +385,18 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1691472822,
-        "narHash": "sha256-XVfYZ2oB3lNPVq6sHCY9WkdQ8lHoIDzzbpg8bB6oBxA=",
-        "owner": "NixOS",
+        "lastModified": 1690272529,
+        "narHash": "sha256-MakzcKXEdv/I4qJUtq/k/eG+rVmyOZLnYNC2w1mB59Y=",
+        "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "41c7605718399dcfa53dd7083793b6ae3bc969ff",
+        "rev": "ef99fa5c5ed624460217c31ac4271cfb5cb2502c",
         "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
+        "owner": "nixos",
         "ref": "nixos-unstable",
-        "type": "indirect"
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixpkgs-lib": {
@@ -347,11 +432,11 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1690066826,
-        "narHash": "sha256-6L2qb+Zc0BFkh72OS9uuX637gniOjzU6qCDBpjB2LGY=",
+        "lastModified": 1691280485,
+        "narHash": "sha256-/8Ct9092OC1TTNzHgbcE9ejQdS2QxZYGqrWXEwUxdtQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ce45b591975d070044ca24e3003c830d26fea1c8",
+        "rev": "240472b7e47a641e9e7675f58b64d3626ca7824d",
         "type": "github"
       },
       "original": {
@@ -361,6 +446,21 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1691654369,
+        "narHash": "sha256-gSILTEx1jRaJjwZxRlnu3ZwMn1FVNk80qlwiCX8kmpo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "ce5e4a6ef2e59d89a971bc434ca8ca222b9c7f5e",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-unstable",
+        "type": "indirect"
+      }
+    },
     "pre-commit-hooks-nix": {
       "inputs": {
         "flake-compat": [
@@ -415,19 +515,45 @@
     "root": {
       "inputs": {
         "deploy-rs": "deploy-rs",
+        "helix": "helix",
         "home-manager": "home-manager",
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
         "nix-colors": "nix-colors",
         "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "purge": "purge",
         "sops-nix": "sops-nix",
         "trucksimulatorbot": "trucksimulatorbot"
       }
     },
     "rust-overlay": {
+      "inputs": {
+        "flake-utils": [
+          "helix",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "helix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1690424156,
+        "narHash": "sha256-Bpml+L280tHTQpwpC5/BJbU4HSvEzMvW8IZ4gAXimhE=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "f335a0213504c7e6481c359dc1009be9cf34432c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
       "inputs": {
         "flake-utils": [
           "lanzaboote",
@@ -460,11 +586,11 @@
         "nixpkgs-stable": "nixpkgs-stable_2"
       },
       "locked": {
-        "lastModified": 1690199016,
-        "narHash": "sha256-yTLL72q6aqGmzHq+C3rDp3rIjno7EJZkFLof6Ika7cE=",
+        "lastModified": 1691830846,
+        "narHash": "sha256-ffR5maL8R4gsoF43YZRSBVzB7qYxzG+Ssjjktg80Wy4=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c36df4fe4bf4bb87759b1891cab21e7a05219500",
+        "rev": "5f5d9a3c8bc247eb574823b9f16a79e054dafe73",
         "type": "github"
       },
       "original": {
@@ -487,6 +613,21 @@
         "type": "github"
       }
     },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "trucksimulatorbot": {
       "inputs": {
         "images": "images",
diff --git a/flake.nix b/flake.nix
index df382c0..f917c58 100644
--- a/flake.nix
+++ b/flake.nix
@@ -58,6 +58,7 @@
     , lanzaboote
     , purge
     , trucksimulatorbot
+    , helix
     , ...
     }@attrs: {
       packages.x86_64-linux = {
@@ -100,7 +101,7 @@
         };
         nuc = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
-          specialArgs.inputs = attrs;
+          specialArgs = attrs;
           modules = [
             nixos-hardware.nixosModules.intel-nuc-8i7beh
             nix-index-database.nixosModules.nix-index
@@ -112,7 +113,7 @@
         };
         falkenstein-1 = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
-          specialArgs.inputs = attrs;
+          specialArgs = attrs;
           modules = [
             ./hosts/falkenstein-1
             ./shared
@@ -127,7 +128,7 @@
         };
         vm = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
-          specialArgs.inputs = attrs;
+          specialArgs = attrs;
           modules = [
             ./hosts/vm
             ./shared
diff --git a/hosts/falkenstein-1/default.nix b/hosts/falkenstein-1/default.nix
index 55923cb..c1fe103 100644
--- a/hosts/falkenstein-1/default.nix
+++ b/hosts/falkenstein-1/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, helix, ... }:
 {
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   imports =
@@ -38,7 +38,7 @@
     vim
     wget
     htop-vim
-    helix
+    helix.packages.x86_64-linux.default
     lsof
     python3
   ];
diff --git a/hosts/falkenstein-1/modules/trucksimulatorbot/default.nix b/hosts/falkenstein-1/modules/trucksimulatorbot/default.nix
index be791aa..72e1333 100644
--- a/hosts/falkenstein-1/modules/trucksimulatorbot/default.nix
+++ b/hosts/falkenstein-1/modules/trucksimulatorbot/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, inputs, ... }:
+{ config, pkgs, trucksimulatorbot, ... }:
 let
   domain = "trucksimulatorbot.rfive.de";
 in
@@ -39,7 +39,7 @@ in
         proxyPass = "http://127.0.0.1:${toString config.services.trucksimulatorbot.listenPort}";
       };
       locations."/docs" = {
-        root = "${inputs.trucksimulatorbot.packages.x86_64-linux.docs}";
+        root = "${trucksimulatorbot.packages.x86_64-linux.docs}";
       };
     };
   };
diff --git a/hosts/nuc/default.nix b/hosts/nuc/default.nix
index b01aa3e..0c50949 100644
--- a/hosts/nuc/default.nix
+++ b/hosts/nuc/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, helix, ... }:
 {
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   imports =
@@ -58,7 +58,7 @@
     vim
     wget
     htop-vim
-    helix
+    helix.packages.x86_64-linux.default
     lsof
     btdu
   ];
diff --git a/hosts/thinkpad/default.nix b/hosts/thinkpad/default.nix
index 4ac5b39..a8b3c45 100755
--- a/hosts/thinkpad/default.nix
+++ b/hosts/thinkpad/default.nix
@@ -38,10 +38,12 @@
       experimental-features = [ "nix-command" "flakes" ];
       auto-optimise-store = true;
       substituters = [
+        "https://helix.cachix.org"
         "ssh://nuc.lan"
       ];
       trusted-public-keys = [
         "nuc.lan:a9UkVw3AizAKCER1CfNGhx8UOMF4t4UGE3GJ9dmHwJc="
+        "helix.cachix.org-1:ejp9KQpR1FBI2onstMQ34yogDm4OgU2ru6lIwPvuCVs="
       ];
     };
     # distributedBuilds = true;
@@ -183,6 +185,13 @@
     };
   };
 
+  security.tpm2 = {
+    enable = true;
+    pkcs11.enable = true;
+    abrmd.enable = true;
+    tctiEnvironment.enable = true;
+  };
+
   hardware.opengl.extraPackages = with pkgs; [
     intel-compute-runtime
     intel-media-driver
@@ -192,6 +201,7 @@
     # hardware utilities
     nvme-cli
     intel-gpu-tools
+    tpm2-tools
 
     # system essentials
     wget
diff --git a/shared/zsh.nix b/shared/zsh.nix
index 1c1d732..58b79f1 100644
--- a/shared/zsh.nix
+++ b/shared/zsh.nix
@@ -73,6 +73,19 @@
           unlink $OUT_PATH
         }
 
+        sysdiff() {
+          echo System package diff:
+          ${config.nix.package}/bin/nix store diff-closures $(command ls -d /nix/var/nix/profiles/system-* | tail -2)
+        }
+
+        shell() {
+          for var in "$@"
+          do
+            PKGS=$PKGS\ nixpkgs/nixos-unstable#$var
+          done
+          eval ${pkgs.nix-output-monitor}/bin/nom shell $PKGS
+        }
+
       '';
     promptInit =
       ''
diff --git a/users/rouven/modules/helix/default.nix b/users/rouven/modules/helix/default.nix
index aeec05b..3474a42 100644
--- a/users/rouven/modules/helix/default.nix
+++ b/users/rouven/modules/helix/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, helix, ... }:
 {
   home.packages = with pkgs; [
     gdb
@@ -24,12 +24,17 @@
   ];
   programs.helix = {
     enable = true;
+    # pull helix from the flake to fix random coredumps
+    package = helix.packages.x86_64-linux.default;
     languages = {
+      language-server.rnix-lsp = {
+        command = "rnix-lsp";
+      };
       language = [
         {
           name = "nix";
           auto-format = true;
-          language-server.command = "rnix-lsp";
+          language-servers = [ "rnix-lsp" ];
         }
       ];
     };
diff --git a/users/rouven/modules/wayland/river.nix b/users/rouven/modules/wayland/river.nix
index 58af2f5..153e49b 100644
--- a/users/rouven/modules/wayland/river.nix
+++ b/users/rouven/modules/wayland/river.nix
@@ -16,6 +16,7 @@
       source =
         pkgs.writeShellScript "river-init.sh" ''
           riverctl focus-follows-cursor always
+          riverctl set-cursor-warp on-focus-change
           riverctl attach-mode bottom
           riverctl spawn rivertile
           riverctl default-layout rivertile
@@ -24,6 +25,7 @@
           riverctl input pointer-2-7-SynPS/2_Synaptics_TouchPad tap enabled
           riverctl input pointer-2-7-SynPS/2_Synaptics_TouchPad drag enabled
           riverctl input pointer-2-7-SynPS/2_Synaptics_TouchPad middle-emulation enabled
+          riverctl input pointer-2-7-SynPS/2_Synaptics_TouchPad accel-profile adaptive
           
           riverctl spawn "${pkgs.swaybg}/bin/swaybg -i ${../../../../images/wallpaper.png}"