diff --git a/common/base-server/default.nix b/common/base-server/default.nix
index c074c3c..47a82fa 100644
--- a/common/base-server/default.nix
+++ b/common/base-server/default.nix
@@ -11,6 +11,7 @@ in
     time.timeZone = "Etc/UTC";
 
     # Allow remote deployment with colmena
+    deployment.targetUser = null;
     security.sudo.wheelNeedsPassword = false;
     nix.settings.trusted-users = [ "@wheel" ];
   };
diff --git a/flake.nix b/flake.nix
index 71aa94d..b1a2ac9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -27,36 +27,6 @@
   };
 
   outputs = inputs@{ self, nixpkgs, home-manager, plasma-manager, nur, agenix, birdsong, ... }: {
-    nixosModules.default = {
-      nix.settings.experimental-features = "nix-command flakes";
-      nix.nixPath = [ "nixpkgs=flake:nixpkgs" ];
-      nixpkgs.config.allowUnfree = true;
-
-      nixpkgs.overlays = [ nur.overlay ];
-
-      # TODO: make this or something like it work without infinite recursion
-      # home-manager.users."qenya" = lib.mkIf (config.users.users ? "qenya") self.homeManagerModules."qenya";
-      home-manager.users."qenya" = self.homeManagerModules."qenya";
-
-      imports = [
-        home-manager.nixosModules.home-manager
-        nur.nixosModules.nur
-        agenix.nixosModules.default
-        birdsong.nixosModules.default
-        ./common
-        ./services
-      ];
-    };
-
-    # TODO: simplify
-    nixosConfigurations = {
-      "kilgharrah" = nixpkgs.lib.nixosSystem { modules = [ ./hosts/kilgharrah self.nixosModules.default ]; };
-      "tohru" = nixpkgs.lib.nixosSystem { modules = [ ./hosts/tohru self.nixosModules.default ]; };
-      "yevaud" = nixpkgs.lib.nixosSystem { modules = [ ./hosts/yevaud self.nixosModules.default ]; };
-      "orm" = nixpkgs.lib.nixosSystem { modules = [ ./hosts/orm self.nixosModules.default ]; };
-      "kalessin" = nixpkgs.lib.nixosSystem { modules = [ ./hosts/kalessin self.nixosModules.default ]; };
-    };
-
     # The name of this output type is not standardised. I have picked
     # "homeManagerModules" as the discussion here suggests it's the most common:
     # https://github.com/nix-community/home-manager/issues/1783
@@ -75,28 +45,39 @@
     colmena = {
       meta = {
         nixpkgs = import nixpkgs { system = "x86_64-linux"; };
-        nodeNixpkgs = builtins.mapAttrs (name: value: value.pkgs) self.nixosConfigurations;
+        nodeNixpkgs = {
+          kalessin = import nixpkgs { system = "aarch64-linux"; }; # TODO: this should be generated from the host config somehow
+        };
+      };
+
+      defaults = { name, nodes, ... }: {
+        networking.hostName = name;
+
+        nix.settings.experimental-features = "nix-command flakes";
+        nix.nixPath = [ "nixpkgs=flake:nixpkgs" ];
+        nixpkgs.config.allowUnfree = true;
+
+        nixpkgs.overlays = [ nur.overlay ];
+
+        # TODO: make this or something like it work without infinite recursion
+        # home-manager.users."qenya" = lib.mkIf (config.users.users ? "qenya") self.homeManagerModules."qenya";
+        home-manager.users."qenya" = self.homeManagerModules."qenya";
+
+        imports = [
+          home-manager.nixosModules.home-manager
+          nur.nixosModules.nur
+          agenix.nixosModules.default
+          birdsong.nixosModules.default
+          ./common
+          ./services
+        ];
       };
 
-      # TODO: eliminate duplication with nixosConfigurations
-      defaults.imports = [ self.nixosModules.default ];
       kilgharrah.imports = [ ./hosts/kilgharrah ];
       tohru.imports = [ ./hosts/tohru ];
       yevaud.imports = [ ./hosts/yevaud ];
       orm.imports = [ ./hosts/orm ];
       kalessin.imports = [ ./hosts/kalessin ];
-
-      defaults.deployment = {
-        allowLocalDeployment = true;
-        buildOnTarget = true;
-        targetUser = null;
-      };
-
-      kilgharrah.deployment.targetHost = null;
-      tohru.deployment.targetHost = null;
-      yevaud.deployment.targetHost = "yevaud.birdsong.network";
-      orm.deployment.targetHost = "orm.birdsong.network";
-      kalessin.deployment.targetHost = "kalessin.birdsong.network";
     };
 
     # TODO: have this work on other systems too
diff --git a/hosts/kalessin/default.nix b/hosts/kalessin/default.nix
index aeb39a6..e3c08a6 100644
--- a/hosts/kalessin/default.nix
+++ b/hosts/kalessin/default.nix
@@ -5,8 +5,11 @@
     ./hardware-configuration.nix
   ];
 
-  networking.hostName = "kalessin";
   networking.hostId = "534b538e";
+  deployment = {
+    targetHost = "kalessin.birdsong.network";
+    buildOnTarget = true;
+  };
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
diff --git a/hosts/kilgharrah/default.nix b/hosts/kilgharrah/default.nix
index 00daac3..4418b4a 100644
--- a/hosts/kilgharrah/default.nix
+++ b/hosts/kilgharrah/default.nix
@@ -9,9 +9,13 @@
   ];
 
   nixpkgs.hostPlatform = "x86_64-linux";
-  networking.hostName = "kilgharrah";
   networking.hostId = "72885bb5";
 
+  deployment = {
+    allowLocalDeployment = true;
+    targetHost = null; # disallow remote deployment
+  };
+
   qenya.base-graphical.enable = true;
   qenya.base-graphical.desktop = "plasma6";
 
diff --git a/hosts/orm/default.nix b/hosts/orm/default.nix
index c76bd6b..4b6e346 100644
--- a/hosts/orm/default.nix
+++ b/hosts/orm/default.nix
@@ -5,8 +5,8 @@
     ./hardware-configuration.nix
   ];
 
-  networking.hostName = "orm";
   networking.hostId = "00000000";
+  deployment.targetHost = "orm.birdsong.network";
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
diff --git a/hosts/tohru/default.nix b/hosts/tohru/default.nix
index c5b1fef..53fb544 100644
--- a/hosts/tohru/default.nix
+++ b/hosts/tohru/default.nix
@@ -11,9 +11,13 @@
   ];
 
   nixpkgs.hostPlatform = "x86_64-linux";
-  networking.hostName = "tohru";
   networking.hostId = "31da19c1";
 
+  deployment = {
+    allowLocalDeployment = true;
+    targetHost = null; # disallow remote deployment
+  };
+
   qenya.base-graphical.enable = true;
 
   time.timeZone = "Europe/London";
diff --git a/hosts/yevaud/default.nix b/hosts/yevaud/default.nix
index b620f43..18f868a 100644
--- a/hosts/yevaud/default.nix
+++ b/hosts/yevaud/default.nix
@@ -5,8 +5,8 @@
     ./hardware-configuration.nix
   ];
 
-  networking.hostName = "yevaud";
   networking.hostId = "09673d65";
+  deployment.targetHost = "yevaud.birdsong.network";
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;