diff --git a/home-manager/machines.nix b/home-manager/machines.nix
index 3a5df397..a985f953 100644
--- a/home-manager/machines.nix
+++ b/home-manager/machines.nix
@@ -73,7 +73,6 @@ in {
         ./roles/update_tasks.nix
       ]);
     unrestricted = [
-      ./roles/orga.nix
       ./roles/accounting.nix
       ./roles/mail-client.nix
       ./roles/pythia.nix
@@ -86,7 +85,6 @@ in {
   in {
     unrestricted = apolloConfig unrestricted;
     orga = apolloConfig [
-      ./roles/orga.nix
       ./roles/mail-client.nix
       ./roles/accounting.nix
       ./roles/pythia.nix
diff --git a/home-manager/roles/orga.nix b/home-manager/roles/orga.nix
deleted file mode 100644
index 7f5aeb8d..00000000
--- a/home-manager/roles/orga.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ pkgs, config, ... }: {
-  home.packages = [
-    (pkgs.writeShellScriptBin "kassandra"
-      ''exec ${config.home.homeDirectory}/.cargo/bin/kassandra "$@"'')
-  ];
-}
diff --git a/home-manager/roles/update_tasks.nix b/home-manager/roles/update_tasks.nix
index 5736db88..e6b56412 100644
--- a/home-manager/roles/update_tasks.nix
+++ b/home-manager/roles/update_tasks.nix
@@ -5,7 +5,7 @@
       Service = {
         Type = "oneshot";
         Environment = "PATH=${pkgs.taskwarrior}/bin:${pkgs.git}/bin";
-        ExecStart = "${config.home.homeDirectory}/.cargo/bin/update_tasks";
+        ExecStart = "${pkgs.kassandra}/bin/update_tasks";
       };
     };
     timers.update_tasks = {
diff --git a/nix/sources.nix b/nix/sources.nix
index 8a725cb4..b64b8f82 100644
--- a/nix/sources.nix
+++ b/nix/sources.nix
@@ -12,36 +12,29 @@ let
     else
       pkgs.fetchurl { inherit (spec) url sha256; };
 
-  fetch_tarball = pkgs: spec:
-    if spec.builtin or true then
-      builtins_fetchTarball { inherit (spec) url sha256; }
-    else
-      pkgs.fetchzip { inherit (spec) url sha256; };
+  fetch_tarball = pkgs: name: spec:
+    let
+      ok = str: ! builtins.isNull (builtins.match "[a-zA-Z0-9+-._?=]" str);
+      # sanitize the name, though nix will still fail if name starts with period
+      name' = stringAsChars (x: if ! ok x then "-" else x) "${name}-src";
+    in
+      if spec.builtin or true then
+        builtins_fetchTarball { name = name'; inherit (spec) url sha256; }
+      else
+        pkgs.fetchzip { name = name'; inherit (spec) url sha256; };
 
   fetch_git = spec:
     builtins.fetchGit { url = spec.repo; inherit (spec) rev ref; };
 
-  fetch_builtin-tarball = spec:
-    builtins.trace
-      ''
-        WARNING:
-          The niv type "builtin-tarball" will soon be deprecated. You should
-          instead use `builtin = true`.
+  fetch_local = spec: spec.path;
 
-          $ niv modify <package> -a type=tarball -a builtin=true
-      ''
-      builtins_fetchTarball { inherit (spec) url sha256; };
+  fetch_builtin-tarball = name: throw
+    ''[${name}] The niv type "builtin-tarball" is deprecated. You should instead use `builtin = true`.
+        $ niv modify ${name} -a type=tarball -a builtin=true'';
 
-  fetch_builtin-url = spec:
-    builtins.trace
-      ''
-        WARNING:
-          The niv type "builtin-url" will soon be deprecated. You should
-          instead use `builtin = true`.
-
-          $ niv modify <package> -a type=file -a builtin=true
-      ''
-      (builtins_fetchurl { inherit (spec) url sha256; });
+  fetch_builtin-url = name: throw
+    ''[${name}] The niv type "builtin-url" will soon be deprecated. You should instead use `builtin = true`.
+        $ niv modify ${name} -a type=file -a builtin=true'';
 
   #
   # Various helpers
@@ -72,13 +65,23 @@ let
     if ! builtins.hasAttr "type" spec then
       abort "ERROR: niv spec ${name} does not have a 'type' attribute"
     else if spec.type == "file" then fetch_file pkgs spec
-    else if spec.type == "tarball" then fetch_tarball pkgs spec
+    else if spec.type == "tarball" then fetch_tarball pkgs name spec
     else if spec.type == "git" then fetch_git spec
-    else if spec.type == "builtin-tarball" then fetch_builtin-tarball spec
-    else if spec.type == "builtin-url" then fetch_builtin-url spec
+    else if spec.type == "local" then fetch_local spec
+    else if spec.type == "builtin-tarball" then fetch_builtin-tarball name
+    else if spec.type == "builtin-url" then fetch_builtin-url name
     else
       abort "ERROR: niv spec ${name} has unknown type ${builtins.toJSON spec.type}";
 
+  # If the environment variable NIV_OVERRIDE_${name} is set, then use
+  # the path directly as opposed to the fetched source.
+  replace = name: drv:
+    let
+      saneName = stringAsChars (c: if isNull (builtins.match "[a-zA-Z0-9]" c) then "_" else c) name;
+      ersatz = builtins.getEnv "NIV_OVERRIDE_${saneName}";
+    in
+      if ersatz == "" then drv else ersatz;
+
   # Ports of functions for older nix versions
 
   # a Nix version of mapAttrs if the built-in doesn't exist
@@ -87,13 +90,23 @@ let
     listToAttrs (map (attr: { name = attr; value = f attr set.${attr}; }) (attrNames set))
   );
 
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
+  range = first: last: if first > last then [] else builtins.genList (n: first + n) (last - first + 1);
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257
+  stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1));
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
+  stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
+  concatStrings = builtins.concatStringsSep "";
+
   # fetchTarball version that is compatible between all the versions of Nix
-  builtins_fetchTarball = { url, sha256 }@attrs:
+  builtins_fetchTarball = { url, name, sha256 }@attrs:
     let
       inherit (builtins) lessThan nixVersion fetchTarball;
     in
       if lessThan nixVersion "1.12" then
-        fetchTarball { inherit url; }
+        fetchTarball { inherit name url; }
       else
         fetchTarball attrs;
 
@@ -115,13 +128,13 @@ let
         then abort
           "The values in sources.json should not have an 'outPath' attribute"
         else
-          spec // { outPath = fetch config.pkgs name spec; }
+          spec // { outPath = replace name (fetch config.pkgs name spec); }
     ) config.sources;
 
   # The "config" used by the fetchers
   mkConfig =
-    { sourcesFile ? ./sources.json
-    , sources ? builtins.fromJSON (builtins.readFile sourcesFile)
+    { sourcesFile ? if builtins.pathExists ./sources.json then ./sources.json else null
+    , sources ? if isNull sourcesFile then {} else builtins.fromJSON (builtins.readFile sourcesFile)
     , pkgs ? mkPkgs sources
     }: rec {
       # The sources, i.e. the attribute set of spec name to spec
@@ -130,5 +143,6 @@ let
       # The "pkgs" (evaluated nixpkgs) to use for e.g. non-builtin fetchers
       inherit pkgs;
     };
+
 in
 mkSources (mkConfig {}) // { __functor = _: settings: mkSources (mkConfig settings); }
diff --git a/nixos/machines/hera/boot.nix b/nixos/machines/hera/boot.nix
index 1d7013fa..6be2b7b6 100644
--- a/nixos/machines/hera/boot.nix
+++ b/nixos/machines/hera/boot.nix
@@ -1,6 +1,6 @@
 { ... }: {
 
-  m-0.server.initSSHKey = ./secret/ssh_boot_rsa;
+  m-0.server.initSSHKey = "${./secret/ssh_boot_rsa}";
 
   boot = {
     loader.grub = {
diff --git a/overlays/pkgSets.nix b/overlays/pkgSets.nix
index 26ea9dc7..06c46f1a 100644
--- a/overlays/pkgSets.nix
+++ b/overlays/pkgSets.nix
@@ -33,13 +33,11 @@ self: super: {
     '';
   };
   desktop-pkgs = {
-    inherit (self) lm_sensors xwayland xdg_utils libnotify;
+    inherit (self) lm_sensors xwayland xdg_utils libnotify kassandra;
     inherit (self.gnomeExtensions) appindicator system-monitor;
     inherit (self.gnome3)
       dconf dconf-editor gnome-tweaks gnome-shell-extensions adwaita-icon-theme
       gnome-session;
-    hotkeys = super.writeShellScriptBin "hotkeys"
-      ''exec /home/maralorn/.cargo/bin/hotkeys "$@"'';
   };
   home-pkgs = {
     inherit (self.pythonPackages) yapf jsbeautifier;