diff --git a/flake.nix b/flake.nix
index 1a33850..d22ecd7 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,9 +18,6 @@
       , top-level-flake
       , sp-modules
       }:
-      let
-        lib = nixpkgs.legacyPackages.${system}.lib;
-      in
       {
         sp-nixos = nixpkgs.lib.nixosSystem {
           specialArgs = { inherit system; };
@@ -43,20 +40,42 @@
             }
           ]
           ++
-          # add SP modules, but filter available config attributes for each
+          # add SP modules, but contrain available config attributes for each
+          # (TODO revise evaluation performance of the code below)
           map
-            (sp-module: args@{ pkgs, ... }: (sp-module.nixosModules.default
-              (args // {
-                config =
-                  # TODO use lib.attrsets.mergeAttrsList from nixpkgs 23.05
-                  (builtins.foldl' lib.trivial.mergeAttrs { }
-                    (map
-                      (p: lib.attrsets.setAttrByPath p
-                        (lib.attrsets.getAttrFromPath p args.config))
-                      sp-module.configPathsNeeded));
-              }))
+            (sp-module: args@{ config, pkgs, ... }:
+              let
+                lib = nixpkgs.lib;
+                constrainConfigArgs = args'@{ pkgs, ... }: args' // {
+                  config =
+                    # TODO use lib.attrsets.mergeAttrsList from nixpkgs 23.05
+                    (builtins.foldl' lib.attrsets.recursiveUpdate { }
+                      (map
+                        (p: lib.attrsets.setAttrByPath p
+                          (lib.attrsets.getAttrFromPath p config))
+                        sp-module.configPathsNeeded));
+                };
+                constrainImportsArgsRecursive = lib.attrsets.mapAttrsRecursive
+                  (p: v:
+                    if lib.lists.last p == "imports"
+                    then
+                      map
+                        (m:
+                          (args'@{ pkgs, ... }: constrainImportsArgsRecursive
+                            (if builtins.isPath m
+                            then import m (constrainConfigArgs args')
+                            else
+                              if builtins.isFunction m
+                              then constrainConfigArgs args'
+                              else m))
+                        )
+                        v
+                    else v);
+              in
+              constrainImportsArgsRecursive
+                (sp-module.nixosModules.default (constrainConfigArgs args))
             )
-            (lib.attrsets.attrValues sp-modules);
+            (nixpkgs.lib.attrsets.attrValues sp-modules);
         };
       };
     formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.nixpkgs-fmt;
diff --git a/sp-modules/simple-nixos-mailserver/config-paths-needed.json b/sp-modules/simple-nixos-mailserver/config-paths-needed.json
index bba1684..f58904f 100644
--- a/sp-modules/simple-nixos-mailserver/config-paths-needed.json
+++ b/sp-modules/simple-nixos-mailserver/config-paths-needed.json
@@ -1,24 +1,16 @@
 [
-  [
-    "services",
-    "redis"
-  ],
-  [
-    "mailserver"
-  ],
-  [
-    "selfprivacy",
-    "userdata",
-    "email"
-  ],
-  [
-    "selfprivacy",
-    "userdata",
-    "domain"
-  ],
-  [
-    "selfprivacy",
-    "userdata",
-    "username"
-  ]
+  [ "mailserver" ],
+  [ "selfprivacy", "userdata", "domain" ],
+  [ "selfprivacy", "userdata", "email" ],
+  [ "selfprivacy", "userdata", "hashedMasterPassword" ],
+  [ "selfprivacy", "userdata", "simple-nixos-mailserver" ],
+  [ "selfprivacy", "userdata", "useBinds" ],
+  [ "selfprivacy", "userdata", "username" ],
+  [ "selfprivacy", "userdata", "users" ],
+  [ "services", "dovecot2" ],
+  [ "services", "opendkim" ],
+  [ "services", "postfix", "group" ],
+  [ "services", "postfix", "user" ],
+  [ "services", "redis" ],
+  [ "services", "rspamd" ]
 ]
diff --git a/sp-modules/simple-nixos-mailserver/flake.nix b/sp-modules/simple-nixos-mailserver/flake.nix
index b09fbb5..cdd915b 100644
--- a/sp-modules/simple-nixos-mailserver/flake.nix
+++ b/sp-modules/simple-nixos-mailserver/flake.nix
@@ -6,17 +6,14 @@
 
   outputs = { self, mailserver }: {
     # tricks to rename (alias) the original module
-    nixosModules.default = args@{ pkgs, ... }:
+    nixosModules.default = args@{ pkgs, config, ... }:
       let
         module = mailserver.nixosModules.default args;
       in
       module // {
         imports = module.imports ++ [
           ./config.nix
-          ({ config, ... }: {
-            mailserver =
-              config.selfprivacy.userdata.simple-nixos-mailserver;
-          })
+          { mailserver = config.selfprivacy.userdata.simple-nixos-mailserver; }
         ];
         options = module.options // {
           selfprivacy.userdata.simple-nixos-mailserver =