--- a/cmds/fleet/src/main.rs
+++ b/cmds/fleet/src/main.rs
@@ -203,7 +203,13 @@
 		.map(|a| extra_args::parse_os(&a))
 		.transpose()?
 		.unwrap_or_default();
-	let config = opts.fleet_opts.build(nix_args).await?;
+	let config = opts
+		.fleet_opts
+		.build(
+			nix_args,
+			matches!(opts.command, Opts::Deploy(_) | Opts::BuildSystems(_)),
+		)
+		.await?;
 
 	match run_command(&config, opts.fleet_opts, opts.command).await {
 		Ok(()) => {
--- a/crates/fleet-base/src/opts.rs
+++ b/crates/fleet-base/src/opts.rs
@@ -181,7 +181,7 @@
 	}
 
 	// TODO: Config should be detached from opts.
-	pub async fn build(&self, nix_args: Vec<OsString>) -> Result<Config> {
+	pub async fn build(&self, nix_args: Vec<OsString>, assert: bool) -> Result<Config> {
 		let directory = current_dir()?;
 
 		let pool = NixSessionPool::new(
@@ -204,7 +204,9 @@
 
 		let config_field = nix_go!(fleet_field.config);
 
-		assert_warn("fleet config evaluation", &config_field).await?;
+		if assert {
+			assert_warn("fleet config evaluation", &config_field).await?;
+		}
 
 		let import = nix_go!(builtins_field.import);
 		let overlays = nix_go!(config_field.nixpkgs.overlays);
--- a/crates/nix-eval/src/util.rs
+++ b/crates/nix-eval/src/util.rs
@@ -1,17 +1,19 @@
+use std::time::Instant;
+
 use anyhow::bail;
 use tracing::{debug, warn};
-use std::time::Instant;
 
 use crate::{nix_go_json, Value};
 
+#[tracing::instrument(level = "info", skip(val))]
 pub async fn assert_warn(action: &str, val: &Value) -> anyhow::Result<()> {
 	let before_errors = Instant::now();
 	let errors: Vec<String> = nix_go_json!(val.errors);
 	debug!("errors evaluation took {:?}", before_errors.elapsed());
 	if !errors.is_empty() {
 		bail!(
-			"{action} failed with error{}{}",
-			(errors.len() != 1).then_some("s:\n- ").unwrap_or(": "),
+			"failed with error{}{}",
+			if errors.len() != 1 { "s:\n- " } else { ": " },
 			errors.join("\n- "),
 		);
 	}
@@ -21,8 +23,8 @@
 	debug!("warnings evaluation took {:?}", before_errors.elapsed());
 	if !warnings.is_empty() {
 		warn!(
-			"{action} completed with warning{}{}",
-			(warnings.len() != 1).then_some("s:\n- ").unwrap_or(": "),
+			"completed with warning{}{}",
+			if warnings.len() != 1 { "s:\n- " } else { ": " },
 			warnings.join("\n- "),
 		);
 	}
--- a/modules/secrets-data.nix
+++ b/modules/secrets-data.nix
@@ -52,6 +52,7 @@
         default = null;
       };
     };
+    config = {};
   };
 
   hostSecretData = {
@@ -78,6 +79,7 @@
         default = null;
       };
     };
+    config = {};
   };
 in {
   options.data = mkDataOption ({config, ...}: {