--- a/flake.lock
+++ b/flake.lock
@@ -17,11 +17,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1632011270,
-        "narHash": "sha256-UyEYSWTKB3boKu5JX/TrQtnAgaYvfSWT61VU8ZT1juk=",
+        "lastModified": 1633629671,
+        "narHash": "sha256-1IItATjckflBBAFDm9C0v/pg9b9BvKMj0mT/NDKZkJE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "7f59b4b5295b58659064a91d0bcc8e8a11d0b351",
+        "rev": "471980fd33961a6b893041774a9633811d03354f",
         "type": "github"
       },
       "original": {
@@ -41,11 +41,11 @@
     "rust-overlay": {
       "flake": false,
       "locked": {
-        "lastModified": 1631758650,
-        "narHash": "sha256-7OAtO2V8omtPaoFBASTfPA5m8MzN5LX8agk0k5p8dH0=",
+        "lastModified": 1633573101,
+        "narHash": "sha256-h9NFLA4VLYfa5Cjkwkbq/8N0/wy9bJ7xiIeLE9bjh4g=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "4e79ebf67452cca4ae938180728f9f513e828d5b",
+        "rev": "3131abe7900b142eca189806f51fcc3c475ed072",
         "type": "github"
       },
       "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -24,6 +24,7 @@
           rust
           cargo-edit
           cargo-udeps
+          cargo-fuzz
 
           pkgconfig
           openssl
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -19,10 +19,12 @@
         map
           (
             name: {
-              inherit name; value = nixpkgs.lib.nixosSystem {
-              system = configuredHosts.${name}.system;
-              modules = configuredHosts.${name}.modules;
-            };
+              inherit name;
+              value = nixpkgs.lib.nixosSystem {
+                system = configuredHosts.${name}.system;
+                modules = configuredHosts.${name}.modules;
+                pkgs = import nixpkgs { system = configuredHosts.${name}.system; };
+              };
             }
           )
           (builtins.attrNames root.config.hosts)
--- a/modules/fleet/secrets.nix
+++ b/modules/fleet/secrets.nix
@@ -78,7 +78,7 @@
           {
             secrets = (mapAttrs cleanupSecret
               (filterAttrs (_: v: builtins.elem host v.owners) config.sharedSecrets)
-            ) // (mapAttrs cleanupSecret (if config.hostSecrets ? host then config.hostSecrets.${host} else {}));
+            ) // (mapAttrs cleanupSecret (config.hostSecrets.${host} or {}));
           }
         ];
     });