diff --git a/ci-lib.nix b/ci-lib.nix
index e526ed23d3..b0f3a565cd 100644
--- a/ci-lib.nix
+++ b/ci-lib.nix
@@ -1,8 +1,5 @@
-{
-  # Generic nixpkgs, use *only* for lib functions that are stable across versions
-  pkgs,
-  lib ? pkgs.lib
-}: rec {
+{ lib }:
+rec {
   inherit (import ./dimension.nix) dimension;
 
   # A filter for removing packages that aren't supported on the current platform
diff --git a/ci.nix b/ci.nix
index e9bac542f0..b2f3e12f12 100644
--- a/ci.nix
+++ b/ci.nix
@@ -1,29 +1,49 @@
 # 'supportedSystems' restricts the set of systems that we will evaluate for. Useful when you're evaluating
 # on a machine with e.g. no way to build the Darwin IFDs you need!
 { ifdLevel ? 3
-# Whether or not we are evaluating in restricted mode. This is true in Hydra, but not in Hercules.
-, restrictEval ? false
 , checkMaterialization ? false
-, compat
-, system
+, system ? builtins.currentSystem
 , evalSystem ? builtins.currentSystem or "x86_64-linux"
-, pkgs ? (compat { inherit system; }).pkgs }:
+  # NOTE: we apply checkMaterialization when defining nixpkgsArgs
+, haskellNix ? import ./default.nix { inherit system ; }
+}:
  let
-  inherit (import ./ci-lib.nix { inherit pkgs; }) dimension platformFilterGeneric filterAttrsOnlyRecursive;
-  inherit (pkgs.haskell-nix) sources;
+  inherit (haskellNix) inputs;
+  inherit (inputs.nixpkgs) lib;
+  inherit
+    (import ./ci-lib.nix { inherit lib; })
+    dimension
+    platformFilterGeneric
+    filterAttrsOnlyRecursive;
+
+  # short names for nixpkgs versions
   nixpkgsVersions = {
-    "R2205" = "nixpkgs-2205";
-    "R2211" = "nixpkgs-2211";
-    "R2305" = "nixpkgs-2305";
-    "unstable" = "nixpkgs-unstable";
+    "R2205" = inputs.nixpkgs-2205;
+    "R2211" = inputs.nixpkgs-2211;
+    "R2305" = inputs.nixpkgs-2305;
+    "unstable" = inputs.nixpkgs-unstable;
   };
-  haskellNix = compat { inherit checkMaterialization system; };
-  nixpkgsArgs = haskellNix.nixpkgsArgs // {
+
+  nixpkgsArgs = {
+    # set checkMaterialization as per top-level argument
+    overlays = [
+      haskellNix.overlay
+      (final: prev: {
+        haskell-nix = prev.haskell-nix // {
+          inherit checkMaterialization;
+        };
+      })
+    ];
     # Needed for dwarf tests
-    config = haskellNix.nixpkgsArgs.config // {
-      permittedInsecurePackages = ["libdwarf-20210528" "libdwarf-20181024" "dwarfdump-20181024"];
+    config = haskellNix.config // {
+      permittedInsecurePackages = [
+        "libdwarf-20210528"
+        "libdwarf-20181024"
+        "dwarfdump-20181024"
+      ];
     };
   };
+
   compilerNixNames = nixpkgsName: nixpkgs:
     # Include only the GHC versions that are supported by haskell.nix
     nixpkgs.lib.filterAttrs (compiler-nix-name: _:
@@ -73,31 +93,30 @@
     # of 'lib.systems.examples' are not understood between all versions
     let lib = nixpkgs.lib;
     in lib.optionalAttrs (nixpkgsName == "unstable"
-      && ((system == "x86_64-linux"  && __elem compiler-nix-name ["ghc8107" "ghc962" "ghc9820230704"])
-       || (system == "aarch64-linux" && __elem compiler-nix-name ["ghc8107" "ghc962" "ghc9820230704"])
-       || (system == "x86_64-darwin" && __elem compiler-nix-name ["ghc8107" "ghc962" "ghc9820230704"])
-       || (system == "aarch64-darwin" && __elem compiler-nix-name ["ghc8107" "ghc962" "ghc9820230704"])
+      && ((system == "x86_64-linux"  && builtins.elem compiler-nix-name ["ghc8107" "ghc962" "ghc9820230704"])
+       || (system == "aarch64-linux" && builtins.elem compiler-nix-name ["ghc8107" "ghc962" "ghc9820230704"])
+       || (system == "x86_64-darwin" && builtins.elem compiler-nix-name ["ghc8107" "ghc962" "ghc9820230704"])
+       || (system == "aarch64-darwin" && builtins.elem compiler-nix-name ["ghc8107" "ghc962" "ghc9820230704"])
        )) {
     inherit (lib.systems.examples) ghcjs;
   } // lib.optionalAttrs (nixpkgsName == "unstable"
-      && ((system == "x86_64-linux"  && __elem compiler-nix-name ["ghc8107" "ghc902" "ghc926" "ghc927" "ghc928" "ghc947" "ghc962" "ghc9820230704"])
-       || (system == "x86_64-darwin" && __elem compiler-nix-name []))) { # TODO add ghc versions when we have more darwin build capacity
+      && ((system == "x86_64-linux"  && builtins.elem compiler-nix-name ["ghc8107" "ghc902" "ghc926" "ghc927" "ghc928" "ghc947" "ghc962" "ghc9820230704"])
+       || (system == "x86_64-darwin" && builtins.elem compiler-nix-name []))) { # TODO add ghc versions when we have more darwin build capacity
     inherit (lib.systems.examples) mingwW64;
-  } // lib.optionalAttrs (system == "x86_64-linux" && nixpkgsName == "unstable" && __elem compiler-nix-name ["ghc8107" "ghc902" "ghc922" "ghc923" "ghc924" "ghc926" "ghc927" "ghc928" "ghc947" "ghc962" "ghc9820230704"]) {
+  } // lib.optionalAttrs (system == "x86_64-linux" && nixpkgsName == "unstable" && builtins.elem compiler-nix-name ["ghc8107" "ghc902" "ghc922" "ghc923" "ghc924" "ghc926" "ghc927" "ghc928" "ghc947" "ghc962" "ghc9820230704"]) {
     # Musl cross only works on linux
     # aarch64 cross only works on linux
     inherit (lib.systems.examples) musl64 aarch64-multiplatform;
-  } // lib.optionalAttrs (system == "x86_64-linux" && nixpkgsName == "unstable" && __elem compiler-nix-name ["ghc927" "ghc928"]) {
+  } // lib.optionalAttrs (system == "x86_64-linux" && nixpkgsName == "unstable" && builtins.elem compiler-nix-name ["ghc927" "ghc928"]) {
     # TODO fix this for the compilers we build with hadrian (ghc >=9.4)
     inherit (lib.systems.examples) aarch64-multiplatform-musl;
-  } // lib.optionalAttrs (system == "aarch64-linux" && nixpkgsName == "unstable" && __elem compiler-nix-name ["ghc927" "ghc928" "ghc947" "ghc962" "ghc9820230704"]) {
+  } // lib.optionalAttrs (system == "aarch64-linux" && nixpkgsName == "unstable" && builtins.elem compiler-nix-name ["ghc927" "ghc928" "ghc947" "ghc962" "ghc9820230704"]) {
     inherit (lib.systems.examples) aarch64-multiplatform-musl;
   };
   isDisabled = d: d.meta.disabled or false;
 in
-dimension "Nixpkgs version" nixpkgsVersions (nixpkgsName: nixpkgs-pin:
-  let pinnedNixpkgsSrc = sources.${nixpkgs-pin};
-      evalPackages = import pinnedNixpkgsSrc (nixpkgsArgs // { system = evalSystem; });
+dimension "Nixpkgs version" nixpkgsVersions (nixpkgsName: pinnedNixpkgsSrc:
+  let evalPackages = import pinnedNixpkgsSrc (nixpkgsArgs // { system = evalSystem; });
   in dimension "GHC version" (compilerNixNames nixpkgsName evalPackages) (compiler-nix-name: {runTests}:
       let pkgs = import pinnedNixpkgsSrc (nixpkgsArgs // { inherit system; });
           build = import ./build.nix { inherit pkgs evalPackages ifdLevel compiler-nix-name haskellNix; };
diff --git a/default.nix b/default.nix
index 2ec0e3a898..4a1c872b70 100644
--- a/default.nix
+++ b/default.nix
@@ -1,21 +1,42 @@
-{...}@args:
+{ system ? builtins.currentSystem
+, sourcesOverride ? { }
+, checkMaterialization ? false
+, ...
+}:
 
 let
-  pins = (__fromJSON (__readFile ./flake.lock)).nodes;
-  nixpkgsPin = pins.nixpkgs-2211.locked;
-  flakeCompatPin = pins.flake-compat.locked;
-  nixpkgsSrc =
+  lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+
+  # NOTE: This has to be whitelisted in restricted evaluation mode
+  flake-compat =
+    with lock.nodes.flake-compat.locked;
     builtins.fetchTarball {
-      url = "https://github.com/NixOS/nixpkgs/archive/${nixpkgsPin.rev}.tar.gz";
-      sha256 = nixpkgsPin.narHash;
+      url = "https://github.com/input-output-hk/flake-compat/archive/${rev}.tar.gz";
+      sha256 = narHash;
     };
-  pkgs = args.pkgs or (import nixpkgsSrc {});
-  flake-compat =
-    pkgs.fetchzip {
-      url = "https://github.com/input-output-hk/flake-compat/archive/${flakeCompatPin.rev}.tar.gz";
-      sha256 = flakeCompatPin.narHash;
+
+  # With flake-compat you will end up fetching the flake inputs with
+  # builtins.fetchTarball. This is simply because you don't have access to any
+  # nixpkgs before fetching the inputs.
+  #
+  # This won't work in restricted evaluation mode.
+  #
+  # Under the mild assumtion that https://github.com/NixOS is whitelisted, we
+  # can manually fetch nixpkgs and let flake-compat fetch the rest of the
+  # inputs with the nixpkgs just fetched.
+  #
+  # Manually fetch nixpkgs
+  nixpkgs =
+    with lock.nodes.nixpkgs.locked;
+    builtins.fetchTarball {
+      url = "https://github.com/NixOS/nixpkgs/archive/${rev}.tar.gz";
+      sha256 = narHash;
     };
-  self = import flake-compat {
+  #
+  # Instantiate the flake fetching the other inputs with the nixpkgs already
+  # fetched
+  self = (import flake-compat {
+    pkgs = import nixpkgs { };
     # We bypass flake-compat's rootSrc cleaning by evading its detection of this as a git
     # repo.
     # This is done for 3 reasons:
@@ -26,7 +47,49 @@ let
     #   in `test/default.nix`).  If `flake-compat` copies the whole git repo, any change to the
     #   repo causes a change of input for all tests.
     src = { outPath = ./.; };
-    inherit pkgs;
+    override-inputs = sourcesOverride;
+  }).defaultNix;
+
+  inherit (self.inputs.nixpkgs) lib;
+
+  # coming from internal.compat
+  overlays = [ self.overlay ]
+    ++ lib.optional checkMaterialization
+    (final: prev: {
+      haskell-nix = prev.haskell-nix // {
+        checkMaterialization = true;
+      };
+    });
+  nixpkgsArgs = {
+    inherit overlays;
+    inherit (self) config;
   };
-in self.defaultNix // (self.defaultNix.internal.compat
-({ system = args.pkgs.system or builtins.currentSystem; } // args))
+  pkgs = import self.inputs.nixpkgs (nixpkgsArgs // {
+    localSystem = { inherit system; };
+  });
+in
+self // {
+  inherit nixpkgsArgs pkgs;
+  inherit (nixpkgsArgs) config overlays;
+  sources = self.inputs;
+  allOverlays = self.overlays;
+  pkgs-2105 = import self.inputs.nixpkgs-2105 (nixpkgsArgs // {
+    localSystem = { inherit system; };
+  });
+  pkgs-2111 = import self.inputs.nixpkgs-2111 (nixpkgsArgs // {
+    localSystem = { inherit system; };
+  });
+  pkgs-2205 = import self.inputs.nixpkgs-2205 (nixpkgsArgs // {
+    localSystem = { inherit system; };
+  });
+  pkgs-2211 = import self.inputs.nixpkgs-2211 (nixpkgsArgs // {
+    localSystem = { inherit system; };
+  });
+  pkgs-2305 = import self.inputs.nixpkgs-2305 (nixpkgsArgs // {
+    localSystem = { inherit system; };
+  });
+  pkgs-unstable = import self.inputs.nixpkgs-unstable (nixpkgsArgs // {
+    localSystem = { inherit system; };
+  });
+  hix = import ./hix/default.nix { inherit pkgs; };
+}
diff --git a/flake.lock b/flake.lock
index 794a383102..95368ed6cb 100644
--- a/flake.lock
+++ b/flake.lock
@@ -100,24 +100,6 @@
         "type": "github"
       }
     },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1692799911,
-        "narHash": "sha256-3eihraek4qL744EvQXsK1Ha6C3CR7nnT8X2qWap4RNk=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "f9e7cf818399d17d347f847525c5a5a8032e4e44",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "ghc-8.6.5-iohk": {
       "flake": false,
       "locked": {
@@ -463,7 +445,6 @@
         "cabal-36": "cabal-36",
         "cardano-shell": "cardano-shell",
         "flake-compat": "flake-compat",
-        "flake-utils": "flake-utils",
         "ghc-8.6.5-iohk": "ghc-8.6.5-iohk",
         "hackage": "hackage",
         "hls-1.10": "hls-1.10",
diff --git a/flake.nix b/flake.nix
index df4d13ace3..12d8927892 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,7 +11,6 @@
     nixpkgs-2305 = { url = "github:NixOS/nixpkgs/nixpkgs-23.05-darwin"; };
     nixpkgs-unstable = { url = "github:NixOS/nixpkgs/nixpkgs-unstable"; };
     flake-compat = { url = "github:input-output-hk/flake-compat/hkm/gitlab-fix"; flake = false; };
-    flake-utils = { url = "github:numtide/flake-utils"; };
     "hls-1.10" = { url = "github:haskell/haskell-language-server/1.10.0.0"; flake = false; };
     "hls-2.0" = { url = "github:haskell/haskell-language-server/2.0.0.1"; flake = false; };
     "hls-2.2" = { url = "github:haskell/haskell-language-server/2.2.0.0"; flake = false; };
@@ -67,13 +66,26 @@
     };
   };
 
-  outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-2105, nixpkgs-2111, nixpkgs-2205, nixpkgs-2211, nixpkgs-2305, flake-compat, flake-utils, ... }@inputs:
+  outputs =
+    { self
+    , nixpkgs
+    , nixpkgs-unstable
+    , nixpkgs-2105
+    , nixpkgs-2111
+    , nixpkgs-2205
+    , nixpkgs-2211
+    , nixpkgs-2305
+    , flake-compat
+    , ...
+    }@inputs:
     let
       callFlake = import flake-compat;
 
       compiler = "ghc928";
       config = import ./config.nix;
 
+      inherit (nixpkgs) lib;
+
       traceNames = prefix: builtins.mapAttrs (n: v:
         if builtins.isAttrs v
           then if v ? type && v.type == "derivation"
@@ -92,10 +104,24 @@
         "aarch64-darwin"
       ];
 
+      nixpkgsArgs = {
+        inherit config;
+        overlays = [ self.overlay ];
+      };
+
+      forEachSystem = lib.genAttrs systems;
+      forEachSystemPkgs = f: forEachSystem (system: f self.legacyPackages.${system});
+
+      inherit
+        (import ./ci-lib.nix { inherit lib; })
+        stripAttrsForHydra
+        filterDerivations;
+
     in traceHydraJobs ({
       inherit config;
       overlay = self.overlays.combined;
       overlays = import ./overlays { sources = inputs; };
+
       internal = {
         nixpkgsArgs = {
           inherit config;
@@ -104,125 +130,121 @@
 
         sources = inputs;
 
-        overlaysOverrideable = import ./overlays;
+        overlaysOverrideable =
+          lib.warn
+            "Using this attribute is deprecated. Import ${./overlays} directly or use the flake overlays output with override-inut."
+            (import ./overlays);
+
         # Compatibility with old default.nix
-        compat = { checkMaterialization ?
-            false # Allows us to easily switch on materialization checking
-          , system, sourcesOverride ? { }, ... }@args: rec {
-            sources = inputs // sourcesOverride;
-            allOverlays = import ./overlays (args // { inherit sources; });
-            inherit config;
-            # We are overriding 'overlays' and 'nixpkgsArgs' from the
-            # flake outputs so that we can incorporate the args passed
-            # to the compat layer (e.g. sourcesOverride).
-            overlays = [ allOverlays.combined ]
-              ++ (if checkMaterialization then
-                [
-                  (final: prev: {
-                    haskell-nix = prev.haskell-nix // {
-                      checkMaterialization = true;
-                    };
-                  })
-                ]
-              else
-                [ ]);
-            nixpkgsArgs = {
-              inherit config overlays;
-            };
-            pkgs = import nixpkgs
-              (nixpkgsArgs // { localSystem = { inherit system; }; });
-            pkgs-2105 = import nixpkgs-2105
-              (nixpkgsArgs // { localSystem = { inherit system; }; });
-            pkgs-2111 = import nixpkgs-2111
-              (nixpkgsArgs // { localSystem = { inherit system; }; });
-            pkgs-2205 = import nixpkgs-2205
-              (nixpkgsArgs // { localSystem = { inherit system; }; });
-            pkgs-2211 = import nixpkgs-2211
-              (nixpkgsArgs // { localSystem = { inherit system; }; });
-            pkgs-2305 = import nixpkgs-2305
-              (nixpkgsArgs // { localSystem = { inherit system; }; });
-            pkgs-unstable = import nixpkgs-unstable
-              (nixpkgsArgs // { localSystem = { inherit system; }; });
-            hix = import ./hix/default.nix { inherit pkgs; };
-          };
+        compat =
+          lib.warn
+            "Using this attribute is deprecated. You can pass the same arguments to ${./default.nix} instead"
+            (import ./default.nix);
       };
 
+      legacyPackages = forEachSystem (system:
+        import nixpkgs {
+          inherit config;
+          overlays = [ self.overlay ];
+          localSystem = { inherit system; };
+        });
+
+      legacyPackagesUnstable = forEachSystem (system:
+        import nixpkgs-unstable {
+          inherit config;
+          overlays = [ self.overlay ];
+          localSystem = { inherit system; };
+        });
+
+      # Exposed so CI can check that `allow-import-from-derivation=false` works
+      # for core of haskell.nix E.g. this should always work:
+      #   nix build .#roots.x86_64-linux --accept-flake-config --option allow-import-from-derivation false
+      roots = forEachSystem (system:
+        self.legacyPackagesUnstable.${system}.haskell-nix.roots compiler);
+
       # Note: `nix flake check` evaluates outputs for all platforms, and haskell.nix
       # uses IFD heavily, you have to have the ability to build for all platforms
       # supported by haskell.nix, e.g. with remote builders, in order to check this flake.
       # If you want to run the tests for just your platform, run `./test/tests.sh` or
       # `nix-build -A checks.$PLATFORM`
-    } // flake-utils.lib.eachSystem systems (system:
-      let
-        legacyPackages = (self.internal.compat { inherit system; }).pkgs;
-        nix-tools-hydraJobs =
-          let cf = callFlake {
-            pkgs = legacyPackages;
-            inherit system;
-            src = ./nix-tools;
-            override-inputs = {
-              # Avoid downloading another `hackage.nix`.
-              inherit (inputs) hackage;
-            };
-          };
-          in cf.defaultNix.hydraJobs;
-      in rec {
-        inherit legacyPackages;
-        legacyPackagesUnstable = (self.internal.compat { inherit system; }).pkgs-unstable;
-
-        # FIXME: Currently `nix flake check` requires `--impure` because coverage-golden
-        # (and maybe other tests) import projects that use builtins.currentSystem
-        checks = builtins.listToAttrs (map (pkg: {
-          name = pkg.name;
-          value = pkg;
-        }) (nixpkgs.lib.collect nixpkgs.lib.isDerivation (import ./test rec {
-          haskellNix = self.internal.compat { inherit system; };
-          compiler-nix-name = compiler;
-          pkgs = haskellNix.pkgs;
-        })));
-        # Exposed so that buildkite can check that `allow-import-from-derivation=false` works for core of haskell.nix
-        roots = legacyPackagesUnstable.haskell-nix.roots compiler;
+      checks = forEachSystemPkgs (pkgs:
+        builtins.listToAttrs (
+          map
+            (pkg: { name = pkg.name; value = pkg; })
+            (lib.collect
+              lib.isDerivation
+              (import ./test {
+                haskellNix.sources = inputs;
+                haskellNix.nixpkgsArgs = nixpkgsArgs;
+                compiler-nix-name = compiler;
+                inherit pkgs;
+              })
+              )
+            )
+        );
 
-        packages = (self.internal.compat { inherit system; }).hix.apps;
+      # NOTE: these are the hix cli utilities, which is a separate thing from
+      # the hix.nix overlays (which extends haskell.nix with hixProject).
+      packages = forEachSystemPkgs (pkgs:
+        (import ./hix/default.nix { inherit pkgs; }).apps
+      );
 
-        allJobs =
-          let
-            inherit (import ./ci-lib.nix { pkgs = legacyPackagesUnstable; }) stripAttrsForHydra filterDerivations;
-            ci = import ./ci.nix { inherit (self.internal) compat; inherit system; };
-          in stripAttrsForHydra (filterDerivations ci);
+      allJobs = forEachSystem (system:
+        stripAttrsForHydra (filterDerivations (
+          # This is awkward.
+          import ./ci.nix {
+            inherit system;
+            haskellNix = self;
+          })));
 
-        requiredJobs =
-          let
-            inherit (legacyPackages) lib;
-            names = x: lib.filter (n: n != "recurseForDerivations" && n != "meta")
-                (builtins.attrNames x);
-          in
-            builtins.listToAttrs (
-                lib.concatMap (nixpkgsVer:
-                  let nixpkgsJobs = allJobs.${nixpkgsVer};
-                  in lib.concatMap (compiler-nix-name:
-                    let ghcJobs = nixpkgsJobs.${compiler-nix-name};
-                    in builtins.map (crossPlatform: {
-                        name = "required-${nixpkgsVer}-${compiler-nix-name}-${crossPlatform}";
-                        value = legacyPackages.releaseTools.aggregate {
-                          name = "haskell.nix-${nixpkgsVer}-${compiler-nix-name}-${crossPlatform}";
-                          meta.description = "All ${nixpkgsVer} ${compiler-nix-name} ${crossPlatform} jobs";
-                          constituents = lib.collect lib.isDerivation ghcJobs.${crossPlatform};
-                        };
-                    }) (names ghcJobs)
-                  ) (names nixpkgsJobs)
-                ) (names allJobs));
+      requiredJobs = forEachSystem (system:
+        let
+          inherit (self.legacyPackages.${system}) releaseTools;
+        in
+          lib.concatMapAttrs (nixpkgsVer:
+            lib.concatMapAttrs (compiler-nix-name:
+              lib.concatMapAttrs (crossPlatform: ghcJobs:
+                let
+                  name = "required-${nixpkgsVer}-${compiler-nix-name}-${crossPlatform}";
+                  value = releaseTools.aggregate {
+                      name = "haskell.nix-${nixpkgsVer}-${compiler-nix-name}-${crossPlatform}";
+                      meta.description = "All ${nixpkgsVer} ${compiler-nix-name} ${crossPlatform} jobs";
+                      constituents = lib.collect lib.isDerivation ghcJobs;
+                  };
+                in
+                lib.optionalAttrs
+                  (crossPlatform != "recurseForDerivations" && crossPlatform != "meta")
+                  { ${name} = value; })
+              )
+            )
+            self.allJobs.${system}
+          );
 
-        hydraJobs =
-          allJobs
+      hydraJobs = forEachSystem (system:
+        let
           # Include hydraJobs from nix-tools subflake.
           # NOTE: These derivations do not depend on the haskell.nix in ./. but
           # on the version of haskell.nix locked in the subflake. They are
           # evaluated within their own flake and independently of anything
           # else. Here we only expose them in the main flake.
-          // { nix-tools = nix-tools-hydraJobs.${system} or {}; };
+          nix-tools-hydraJobs =
+            let cf = callFlake {
+              inherit system;
+              pkgs = self.legacyPackages.${system};
+              src = ./nix-tools;
+              override-inputs = {
+                # Avoid downloading another `hackage.nix`.
+                inherit (inputs) hackage;
+              };
+            };
+            in cf.defaultNix.hydraJobs;
+        in
+        self.allJobs.${system} // { nix-tools = nix-tools-hydraJobs.${system} or {}; }
+      );
 
-        devShells = with self.legacyPackages.${system}; {
+      devShells = forEachSystemPkgs (pkgs:
+        let inherit (pkgs) mkShell nixUnstable cabal-install haskell-nix;
+        in {
           default =
             mkShell {
               buildInputs = [
@@ -231,23 +253,26 @@
                 haskell-nix.compiler.${compiler}
               ];
             };
-        } // __mapAttrs (compiler-nix-name: compiler:
+        }
+        //
+        builtins.mapAttrs
+          (compiler-nix-name: compiler:
             mkShell {
               buildInputs = [
                 compiler
                 haskell-nix.cabal-install.${compiler-nix-name}
               ];
-            }
-        ) (
-          # Exclude old versions of GHC to speed up `nix flake check`
-          builtins.removeAttrs haskell-nix.compiler
-            [ "ghc844"
-              "ghc861" "ghc862" "ghc863" "ghc864"
-              "ghc881" "ghc882" "ghc883"
-              "ghc8101" "ghc8102" "ghc8103" "ghc8104" "ghc8105" "ghc8106" "ghc810420210212"
-              "ghc901"
-              "ghc921" "ghc922" "ghc923"]);
-    }));
+            })
+          ( # Exclude old versions of GHC to speed up `nix flake check`
+            builtins.removeAttrs haskell-nix.compiler
+              [ "ghc844"
+                "ghc861" "ghc862" "ghc863" "ghc864"
+                "ghc881" "ghc882" "ghc883"
+                "ghc8101" "ghc8102" "ghc8103" "ghc8104" "ghc8105" "ghc8106" "ghc810420210212"
+                "ghc901"
+                "ghc921" "ghc922" "ghc923"])
+      );
+    });
 
   # --- Flake Local Nix Configuration ----------------------------
   nixConfig = {
diff --git a/nix-tools/flake.lock b/nix-tools/flake.lock
index 114c7e66c7..46814b489a 100644
--- a/nix-tools/flake.lock
+++ b/nix-tools/flake.lock
@@ -101,17 +101,19 @@
       }
     },
     "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1679360468,
-        "narHash": "sha256-LGnza3cfXF10Biw3ZTg0u9o9t7s680Ww200t5KkHTh8=",
-        "owner": "hamishmack",
+        "lastModified": 1692799911,
+        "narHash": "sha256-3eihraek4qL744EvQXsK1Ha6C3CR7nnT8X2qWap4RNk=",
+        "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "e1ea268ff47ad475443dbabcd54744b4e5b9d4f5",
+        "rev": "f9e7cf818399d17d347f847525c5a5a8032e4e44",
         "type": "github"
       },
       "original": {
-        "owner": "hamishmack",
-        "ref": "hkm/nested-hydraJobs",
+        "owner": "numtide",
         "repo": "flake-utils",
         "type": "github"
       }
@@ -136,11 +138,11 @@
     "hackage": {
       "flake": false,
       "locked": {
-        "lastModified": 1691195156,
-        "narHash": "sha256-cy5qo3aE/a6lymbzOAcxdW9ZLGRCnanDuu/xQL2dQo8=",
+        "lastModified": 1693786968,
+        "narHash": "sha256-QNQ2dM3iqNV1o+0kWiO5GbMZWNA+of8wCknNKnBBQPI=",
         "owner": "input-output-hk",
         "repo": "hackage.nix",
-        "rev": "4dcf5a4a045945aa55c1f2be9d2dadce968488fa",
+        "rev": "4e9caa4ef2cc7a17a8a31ff7a44bcbbc1a314842",
         "type": "github"
       },
       "original": {
@@ -162,6 +164,7 @@
         "hackage": "hackage",
         "hls-1.10": "hls-1.10",
         "hls-2.0": "hls-2.0",
+        "hls-2.2": "hls-2.2",
         "hpc-coveralls": "hpc-coveralls",
         "hydra": "hydra",
         "iserv-proxy": "iserv-proxy",
@@ -180,11 +183,11 @@
         "stackage": "stackage"
       },
       "locked": {
-        "lastModified": 1691466972,
-        "narHash": "sha256-YWe6Ydc3gcv5Dn6bh3ZU/gE+E1xsGI4oI4QRXzHTG7g=",
+        "lastModified": 1693795950,
+        "narHash": "sha256-tvTquqMdRQqBbefNO7f+198hq3VuVlY0rjiN5hmzGFw=",
         "owner": "input-output-hk",
         "repo": "haskell.nix",
-        "rev": "d7ff136e7fd2a73c740bcb0f9fd32c84fa446893",
+        "rev": "e166d754a739f5e41d389c537498ccdc6150be0b",
         "type": "github"
       },
       "original": {
@@ -227,6 +230,23 @@
         "type": "github"
       }
     },
+    "hls-2.2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1693064058,
+        "narHash": "sha256-8DGIyz5GjuCFmohY6Fa79hHA/p1iIqubfJUTGQElbNk=",
+        "owner": "haskell",
+        "repo": "haskell-language-server",
+        "rev": "b30f4b6cf5822f3112c35d14a0cba51f3fe23b85",
+        "type": "github"
+      },
+      "original": {
+        "owner": "haskell",
+        "ref": "2.2.0.0",
+        "repo": "haskell-language-server",
+        "type": "github"
+      }
+    },
     "hpc-coveralls": {
       "flake": false,
       "locked": {
@@ -493,11 +513,11 @@
     "stackage": {
       "flake": false,
       "locked": {
-        "lastModified": 1691366993,
-        "narHash": "sha256-H58GhNWd4YgJN/JYogAKIZOjuxtqTtjRwa4MAwHvT0U=",
+        "lastModified": 1693786159,
+        "narHash": "sha256-IzpBwbwD90CIdhOKfdzS98+o3AtoADNsSz5QBr281Gg=",
         "owner": "input-output-hk",
         "repo": "stackage.nix",
-        "rev": "28eadbd982b345fca498b098a1827c3418f67b9c",
+        "rev": "69d620fde80c1dfbe78b081db1b5725e9c0ce9e2",
         "type": "github"
       },
       "original": {
@@ -505,6 +525,21 @@
         "repo": "stackage.nix",
         "type": "github"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/overlays/default.nix b/overlays/default.nix
index 2911470dcb..7e1a8227e1 100644
--- a/overlays/default.nix
+++ b/overlays/default.nix
@@ -1,9 +1,8 @@
-{ sources, ...}@args:
-
+{ sources }:
 let
   overlays = {
     wine = import ./wine.nix;
-    haskell = import ./haskell.nix args;
+    haskell = import ./haskell.nix { inherit sources; };
 
     # Here is where we import nix-tools into the overlays that haskell.nix is
     # going to use. To cut the evaluation time of nix-tools (which would itself
@@ -73,7 +72,7 @@ let
     bootstrap = import ./bootstrap.nix;
     ghc = import ./ghc.nix;
     ghc-packages = import ./ghc-packages.nix;
-    hydra = import ./hydra.nix args;
+    hydra = import ./hydra.nix { inherit sources; };
     darwin = import ./darwin.nix;
     windows = import ./windows.nix;
     armv6l-linux = import ./armv6l-linux.nix;
diff --git a/overlays/haskell.nix b/overlays/haskell.nix
index 4eff1c0a5f..cfebe9e267 100644
--- a/overlays/haskell.nix
+++ b/overlays/haskell.nix
@@ -1,4 +1,4 @@
-{ sources, ... }:
+{ sources }:
 # The haskell.nix infrastructure
 #
 # for hygienic reasons we'll use haskell-nix as a prefix.
@@ -105,7 +105,7 @@ final: prev: {
             { stack-pkgs  # Path to the output of stack-to-nix
             , pkg-def-extras ? []
             , modules ? []
-            }@args:
+            }:
             let
                 # The Stackage release referenced in the stack config
                 pkg-def = stackage.${stack-pkgs.resolver} or (throw ''
@@ -238,7 +238,7 @@ final: prev: {
           })
         ];
 
-        dotCabal = { index-state, sha256, cabal-install, extra-hackage-tarballs ? {}, extra-hackage-repos ? {}, nix-tools, ... }@args:
+        dotCabal = { index-state, sha256, cabal-install, extra-hackage-tarballs ? {}, extra-hackage-repos ? {}, nix-tools, ... }:
             let
               # NOTE: root-keys: aaa is because key-threshold: 0 does not seem to be enough by itself
               bootstrapIndexTarball = name: index: final.runCommand "cabal-bootstrap-index-tarball-${name}" {
@@ -741,7 +741,7 @@ final: prev: {
                             then components.library
                             else components.${haskellLib.prefixComponent.${builtins.elemAt m 0}}.${builtins.elemAt m 1};
 
-                      coverageReport = haskellLib.coverageReport (rec {
+                      coverageReport = haskellLib.coverageReport ({
                         name = package.identifier.name + "-" + package.identifier.version;
                         # Include the checks for a single package.
                         checks = final.lib.filter (final.lib.isDerivation) (final.lib.attrValues package'.checks);
diff --git a/overlays/hydra.nix b/overlays/hydra.nix
index 4fd22044c3..71cc6ac501 100644
--- a/overlays/hydra.nix
+++ b/overlays/hydra.nix
@@ -1,4 +1,4 @@
-{ sources, ...}:
+{ sources }:
 # This hydra overlay is required to circumvent problems with builtins.path
 # in restricted eval mode.
 # This can be removed once hydra in nixpkgs is based on a recent enough nix,
diff --git a/test/default.nix b/test/default.nix
index 299efbf927..ae670df841 100644
--- a/test/default.nix
+++ b/test/default.nix
@@ -17,7 +17,7 @@
 with pkgs;
 
 let
-  inherit (import ../ci-lib.nix { inherit pkgs; }) filterAttrsOnlyRecursive;
+  inherit (import ../ci-lib.nix { inherit lib; }) filterAttrsOnlyRecursive;
   isDisabled = d: d.meta.disabled or false;
 
   # Set recurseForDerivations for both children and grand-children values in