diff --git a/flake.nix b/flake.nix
index c1dd916..8ea1f46 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,7 +7,6 @@
     selfprivacy-graphql-api.url =
       "git+https://git.selfprivacy.org/SelfPrivacy/selfprivacy-rest-api.git";
     selfprivacy-graphql-api.inputs.nixpkgs.follows = "nixpkgs";
-    # TODO nixpkgs inputs of selfprivacy-graphql-api and this flake must match!
   };
 
   outputs = { self, nixpkgs, selfprivacy-graphql-api }:
@@ -15,21 +14,33 @@
       system = "x86_64-linux";
     in
     {
-      nixosConfigurations-fun = { hardware-configuration, userdata }: {
-        just-nixos = nixpkgs.lib.nixosSystem {
-          specialArgs = {
-            inherit
-              system
+      nixosConfigurations-fun =
+        { hardware-configuration
+        , userdata
+        , top-level-flake
+        }: {
+          just-nixos = nixpkgs.lib.nixosSystem {
+            specialArgs = {
+              inherit
+                system
+                hardware-configuration
+                userdata;
+              selfprivacy-graphql-api =
+                selfprivacy-graphql-api.packages.${system}.default;
+            };
+            modules = [
               hardware-configuration
-              userdata;
-            selfprivacy-graphql-api =
-              selfprivacy-graphql-api.packages.${system}.default;
+              ./configuration.nix
+              {
+                # for running "nix search nixpkgs", etc
+                nix.registry.nixpkgs.flake = nixpkgs;
+                # dirty builds are forbidden
+                system.configurationRevision = top-level-flake.rev; # FIXME
+                # system.configurationRevision = self.rev;
+              }
+            ];
+            inherit system;
           };
-          modules = [
-            hardware-configuration
-            ./configuration.nix
-          ];
         };
-      };
     };
 }