diff --git a/configuration.nix b/configuration.nix
index ad22b24..37889b0 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -74,6 +74,7 @@
     DOMAIN = config.selfprivacy.domain;
   };
   documentation.enable = false; # no {man,info}-pages & docs, etc to save space
+  # (or create a systemd service with `ConditionFirstBoot=yes`?)
   systemd.tmpfiles.rules = [
     "# Completely remove remnants of NIXOS_LUSTRATE."
     "R! /old-root"
@@ -110,10 +111,6 @@
     # allowed-uris = [];
     allow-dirty = false;
   };
-  nix.package =
-    if lib.versionAtLeast pkgs.nix.version "2.15.2"
-    then pkgs.nix.out
-    else pkgs.nixUnstable.out;
   services.journald.extraConfig = "SystemMaxUse=500M";
   boot.kernel.sysctl = {
     "net.ipv4.ip_forward" = 1; # TODO why is it here by default, for VPN only?