diff --git a/hosts/fw/modules/gitea-vm.nix b/hosts/fw/modules/gitea-vm.nix
index 734f306..8615ccf 100644
--- a/hosts/fw/modules/gitea-vm.nix
+++ b/hosts/fw/modules/gitea-vm.nix
@@ -75,6 +75,11 @@ in {
         "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDN/2SAFm50kraB1fepAizox/QRXxB7WbqVbH+5OPalDT47VIJGNKOKhixQoqhABHxEoLxdf/C83wxlCVlPV9poLfDgVkA3Lyt5r3tSFQ6QjjOJAgchWamMsxxyGBedhKvhiEzcr/Lxytnoz3kjDG8fqQJwEpdqMmJoMUfyL2Rqp16u+FQ7d5aJtwO8EUqovhMaNO7rggjPpV/uMOg+tBxxmscliN7DLuP4EMTA/FwXVzcFNbOx3K9BdpMRAaSJt4SWcJO2cS2KHA5n/H+PQI7nz5KN3Yr/upJN5fROhi/SHvK39QOx12Pv7FCuWlc+oR68vLaoCKYhnkl3DnCfc7A7"
       ];
 
+      networking.firewall = {
+        enable = true;               # default, but being explicit is fine
+        allowedTCPPorts = [ 8088 ];
+      };
+
       system.stateVersion = "22.05";
     };
   }) (lib.listToAttrs (lib.lists.imap1 (i: v: { name=v; value=i; }) runners));
diff --git a/hosts/fw/modules/home-assistant/electricity.nix b/hosts/fw/modules/home-assistant/electricity.nix
index 3698843..f086d75 100644
--- a/hosts/fw/modules/home-assistant/electricity.nix
+++ b/hosts/fw/modules/home-assistant/electricity.nix
@@ -1,11 +1,7 @@
-{ config, ... }: 
+{ config, pkgs, ... }: 
 let
-  unstable = import
-      (builtins.fetchTarball https://github.com/nixos/nixpkgs/tarball/nixpkgs-unstable)
-      # reuse the current configuration
-      { config = config.nixpkgs.config; };
 in {
-  services.home-assistant.customComponents = with unstable.home-assistant-custom-components; [
+  services.home-assistant.customComponents = with pkgs.home-assistant-custom-components; [
     epex_spot
   ];
 
diff --git a/hosts/fw/modules/vscode-server.nix b/hosts/fw/modules/vscode-server.nix
index af2c6c9..c857043 100644
--- a/hosts/fw/modules/vscode-server.nix
+++ b/hosts/fw/modules/vscode-server.nix
@@ -2,10 +2,6 @@
 
 let
   hostname = "vscode-server";
-  unstable = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz") {
-    config = config.nixpkgs.config;
-    system = pkgs.system;
-  };
 in {
   microvm.vms.${hostname} = {
     autostart = true;
@@ -24,7 +20,7 @@ in {
       };
 
       environment.systemPackages = [
-        unstable.ddev
+        pkgs.ddev
       ];
 
       # Docker is required for ddev
@@ -37,4 +33,4 @@ in {
       mac = "02:00:00:00:01:01";
     }];
   };
-}
\ No newline at end of file
+}