diff --git a/ci.nix b/ci.nix
index 8d31950..c0f0f6b 100644
--- a/ci.nix
+++ b/ci.nix
@@ -4,7 +4,7 @@
 }:
 let
   self = builtins.getFlake (toString ./.);
-  nixpkgs = self.inputs.nixpkgs;
+  inherit (self.inputs) nixpkgs;
   stripDomain = name: nixpkgs.lib.head (builtins.match "(.*).nix-community.org" name);
 in
 (nixpkgs.lib.mapAttrs' (name: config: nixpkgs.lib.nameValuePair "nixos-${stripDomain name}" config.config.system.build.toplevel) self.outputs.nixosConfigurations) //
diff --git a/roles/hercules-ci/default.nix b/roles/hercules-ci/default.nix
index e73cb5c..234ec08 100644
--- a/roles/hercules-ci/default.nix
+++ b/roles/hercules-ci/default.nix
@@ -4,7 +4,7 @@ let
     owner = "hercules-ci-agent";
     sopsFile = ./secrets.yaml;
   };
-  secrets = config.sops.secrets;
+  inherit (config.sops) secrets;
 in
 {
   sops.secrets."binary-caches.json" = herculesSecret;
diff --git a/roles/security.nix b/roles/security.nix
index 777c7e6..15bcdc0 100644
--- a/roles/security.nix
+++ b/roles/security.nix
@@ -1,4 +1,3 @@
-{ ... }:
 {
   # Make sure that the firewall is enabled, even if it's the default.
   networking.firewall.enable = true;
diff --git a/services/hydra/default.nix b/services/hydra/default.nix
index 9292c8a..a3538aa 100644
--- a/services/hydra/default.nix
+++ b/services/hydra/default.nix
@@ -99,7 +99,7 @@ in
       "hydra.nix-community.org" = {
         forceSSL = true;
         enableACME = true;
-        locations."/".proxyPass = "http://localhost:${toString (config.services.hydra.port)}";
+        locations."/".proxyPass = "http://localhost:${toString config.services.hydra.port}";
       };
     };
 
diff --git a/users/lib.nix b/users/lib.nix
index 20cfba3..8ce70d9 100644
--- a/users/lib.nix
+++ b/users/lib.nix
@@ -9,7 +9,7 @@ in
     let
       chars = lib.stringToCharacters (builtins.substring 0 4 id);
       n = builtins.map (c: lib.mod (ord c) 10) chars;
-      s = builtins.concatStringsSep "" (builtins.map (i: builtins.toString i) n);
+      s = builtins.concatStringsSep "" (builtins.map builtins.toString n);
     in
     assert builtins.stringLength id >= 4;
     assert builtins.length chars == 4;