diff --git a/flake.nix b/flake.nix
index 4e0648b1..a3073a2f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -241,9 +241,12 @@
             (! elem name [ "feeds" "pythonPackagesExtensions" ])
             && (allPkgs.lib.meta.availableOn allPkgs.stdenv.hostPlatform pkg)
           )
-          (allPkgs.sane // {
-            inherit (allPkgs) uninsane-dot-org;
-          })
+          (
+            # expose sane packages and chosen inputs (uninsane.org)
+            (import ./pkgs { pkgs = allPkgs; }) // {
+              inherit (allPkgs) uninsane-dot-org;
+            }
+          )
         )
         # self.legacyPackages;
         { inherit (self.legacyPackages) x86_64-linux; }
@@ -260,13 +263,13 @@
         in {
           update-feeds = {
             type = "app";
-            program = "${pkgs.feeds.passthru.updateScript}";
+            program = "${pkgs.feeds.updateScript}";
           };
 
           init-feed = {
             # use like `nix run '.#init-feed' uninsane.org`
             type = "app";
-            program = "${pkgs.feeds.passthru.initFeedScript}";
+            program = "${pkgs.feeds.initFeedScript}";
           };
 
           deploy-moby-test = {
diff --git a/integrations/nur/default.nix b/integrations/nur/default.nix
new file mode 100644
index 00000000..d969af89
--- /dev/null
+++ b/integrations/nur/default.nix
@@ -0,0 +1,36 @@
+# Nix User Repository (NUR)
+# - <https://github.com/nix-community/NUR>
+#
+# this file is not reachable from the top-level of my nixos configs (i.e. toplevel flake.nix)
+# nor is it intended for anyone who wants to reference my config directly
+#   (consider the toplevel flake.nix outputs instead).
+#
+# rather, this is the entrypoint through which NUR finds my packages, modules, overlays.
+# it's reachable only from those using this repo via NUR.
+#
+# to manually query available packages, modules, etc, try:
+# - nix eval --impure --expr 'builtins.attrNames (import ./. {})'
+#
+# to validate this before a push that would propagate to NUR:
+#   NIX_PATH= NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM=1 nix-env -f . -qa \* --meta --xml \
+#     --allowed-uris https://static.rust-lang.org \
+#     --option restrict-eval true \
+#     --option allow-import-from-derivation true \
+#     --drv-path --show-trace \
+#     -I nixpkgs=$(nix-instantiate --find-file nixpkgs) \
+#     -I ../../
+# ^ source: <https://github.com/nix-community/nur-packages-template/blob/master/.github/workflows/build.yml#L63>
+#   N.B.: nur eval allows only PATH (inherited) and NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM="1" (forced),
+#   hence the erasing of NIX_PATH above (to remove external overlays)
+
+{ pkgs ? import <nixpkgs> {} }:
+let
+  sanePkgs = import ../../pkgs { inherit pkgs; };
+in
+({
+  overlays.pkgs = import ../../overlays/pkgs.nix;
+  pkgs = sanePkgs;
+
+  modules = import ../../modules { inherit (pkgs) lib; };
+  lib = import ../../modules/lib { inherit (pkgs) lib; };
+} // sanePkgs)
diff --git a/modules/default.nix b/modules/default.nix
index 892d6540..f984a038 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -1,4 +1,4 @@
-{ lib, utils, ... }:
+{ lib, ... }:
 
 {
   imports = [
@@ -15,7 +15,7 @@
   ];
 
   _module.args =  {
-    sane-lib = import ./lib { inherit lib utils; };
+    sane-lib = import ./lib { inherit lib; };
     sane-data = import ./data { inherit lib; };
   };
 }
diff --git a/modules/lib/default.nix b/modules/lib/default.nix
index c7da9363..6d98524c 100644
--- a/modules/lib/default.nix
+++ b/modules/lib/default.nix
@@ -1,12 +1,12 @@
-{ lib, ... }@moduleArgs:
+{ lib, ... }:
 
 let
 sane-lib = rec {
-  feeds = import ./feeds.nix moduleArgs;
-  fs = import ./fs.nix moduleArgs;
-  merge = import ./merge.nix ({ inherit sane-lib; } // moduleArgs);
-  path = import ./path.nix moduleArgs;
-  types = import ./types.nix moduleArgs;
+  feeds = import ./feeds.nix { inherit lib; };
+  fs = import ./fs.nix { inherit lib; };
+  merge = import ./merge.nix { inherit lib sane-lib; };
+  path = import ./path.nix { inherit lib; };
+  types = import ./types.nix { inherit lib; };
 
   # re-exports
   inherit (merge) mkTypedMerge;
diff --git a/modules/lib/path.nix b/modules/lib/path.nix
index 6866b663..6bdef6a2 100644
--- a/modules/lib/path.nix
+++ b/modules/lib/path.nix
@@ -1,4 +1,4 @@
-{ lib, utils, ... }:
+{ lib, ... }:
 
 let path = rec {
 
diff --git a/overlays/pkgs.nix b/overlays/pkgs.nix
index d8d44d2d..124f14bd 100644
--- a/overlays/pkgs.nix
+++ b/overlays/pkgs.nix
@@ -1,64 +1,8 @@
 (next: prev:
-  with next;
-  let
-    sane = rec {
-      sane-lib = import ../modules/lib next;
-      #### my own, non-upstreamable packages:
-      static-nix-shell = callPackages ../pkgs/static-nix-shell { };
-      sane-scripts = callPackage ../pkgs/sane-scripts { };
-      mx-sanebot = callPackage ../pkgs/mx-sanebot { };
-      feeds = recurseIntoAttrs (callPackage ../pkgs/feeds { });
-      tow-boot-pinephone = callPackage ../pkgs/tow-boot-pinephone { };
-      tow-boot-rpi4 = callPackage ../pkgs/tow-boot-rpi4 { };
-      bootpart-uefi-x86_64 = callPackage ../pkgs/bootpart-uefi-x86_64 { };
-      bootpart-tow-boot-rpi-aarch64 = callPackage ../pkgs/bootpart-tow-boot-rpi-aarch64 { };
-      bootpart-u-boot-rpi-aarch64 = callPackage ../pkgs/bootpart-u-boot-rpi-aarch64 { };
-      rtl8723cs-firmware = callPackage ../pkgs/rtl8723cs-firmware { };
-      linux-megous = callPackage ../pkgs/linux-megous {
-        kernelPatches = [
-          prev.kernelPatches.bridge_stp_helper
-          prev.kernelPatches.request_key_helper
-        ];
-      };
-
-      sublime-music-mobile = callPackage ../pkgs/sublime-music-mobile { };
-
-      #### customized packages
-      fluffychat-moby = callPackage ../pkgs/fluffychat-moby { };
-      gpodder-configured = callPackage ../pkgs/gpodder-configured { };
-      # jackett doesn't allow customization of the bind address: this will probably always be here.
-      jackett = callPackage ../pkgs/jackett { inherit (prev) jackett; };
-      # mozilla keeps nerfing itself and removing configuration options
-      firefox-unwrapped = callPackage ../pkgs/firefox-unwrapped { inherit (prev) firefox-unwrapped; };
-
-      # patch rpi uboot with something that fixes USB HDD boot
-      ubootRaspberryPi4_64bit = callPackage ../pkgs/ubootRaspberryPi4_64bit { };
-
-      gocryptfs = callPackage ../pkgs/gocryptfs { inherit (prev) gocryptfs; };
-
-      browserpass = callPackage ../pkgs/browserpass { inherit (prev) browserpass; };
-
-      fractal-latest = callPackage ../pkgs/fractal-latest { };
-
-      #### TEMPORARY: PACKAGES WAITING TO BE UPSTREAMED
-
-      cargo-docset = callPackage ../pkgs/cargo-docset { };
-
-      pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
-        (py-final: py-prev: {
-          feedsearch-crawler = py-final.callPackage ../pkgs/feedsearch-crawler { };
-        })
-      ];
-
-      kaiteki = callPackage ../pkgs/kaiteki { };
-      lightdm-mobile-greeter = callPackage ../pkgs/lightdm-mobile-greeter { };
-      browserpass-extension = callPackage ../pkgs/browserpass-extension { };
-      gopass-native-messaging-host = callPackage ../pkgs/gopass-native-messaging-host { };
-      tokodon = prev.libsForQt5.callPackage ../pkgs/tokodon { };
-
-      # provided by nixpkgs patch or upstream preview
-      # splatmoji = callPackage ../pkgs/splatmoji { };
-    };
-  in sane // { inherit sane; }
+  # expose all my packages into the root scope:
+  # - `additional` packages
+  # - `patched` versions of nixpkgs (which necessarily shadow their nixpkgs version)
+  # - `pythonPackagesExtensions`
+  import ../pkgs
+    { pkgs = next; lib = prev.lib; unpatched = prev; }
 )
-
diff --git a/pkgs/bootpart-tow-boot-rpi-aarch64/config.txt b/pkgs/additional/bootpart-tow-boot-rpi-aarch64/config.txt
similarity index 100%
rename from pkgs/bootpart-tow-boot-rpi-aarch64/config.txt
rename to pkgs/additional/bootpart-tow-boot-rpi-aarch64/config.txt
diff --git a/pkgs/bootpart-tow-boot-rpi-aarch64/default.nix b/pkgs/additional/bootpart-tow-boot-rpi-aarch64/default.nix
similarity index 100%
rename from pkgs/bootpart-tow-boot-rpi-aarch64/default.nix
rename to pkgs/additional/bootpart-tow-boot-rpi-aarch64/default.nix
diff --git a/pkgs/bootpart-u-boot-rpi-aarch64/config.txt b/pkgs/additional/bootpart-u-boot-rpi-aarch64/config.txt
similarity index 100%
rename from pkgs/bootpart-u-boot-rpi-aarch64/config.txt
rename to pkgs/additional/bootpart-u-boot-rpi-aarch64/config.txt
diff --git a/pkgs/bootpart-u-boot-rpi-aarch64/default.nix b/pkgs/additional/bootpart-u-boot-rpi-aarch64/default.nix
similarity index 100%
rename from pkgs/bootpart-u-boot-rpi-aarch64/default.nix
rename to pkgs/additional/bootpart-u-boot-rpi-aarch64/default.nix
diff --git a/pkgs/bootpart-uefi-x86_64/default.nix b/pkgs/additional/bootpart-uefi-x86_64/default.nix
similarity index 100%
rename from pkgs/bootpart-uefi-x86_64/default.nix
rename to pkgs/additional/bootpart-uefi-x86_64/default.nix
diff --git a/pkgs/browserpass-extension/default.nix b/pkgs/additional/browserpass-extension/default.nix
similarity index 100%
rename from pkgs/browserpass-extension/default.nix
rename to pkgs/additional/browserpass-extension/default.nix
diff --git a/pkgs/cargo-docset/default.nix b/pkgs/additional/cargo-docset/default.nix
similarity index 100%
rename from pkgs/cargo-docset/default.nix
rename to pkgs/additional/cargo-docset/default.nix
diff --git a/pkgs/feeds/default.nix b/pkgs/additional/feeds/default.nix
similarity index 82%
rename from pkgs/feeds/default.nix
rename to pkgs/additional/feeds/default.nix
index d3393453..ac9551c5 100644
--- a/pkgs/feeds/default.nix
+++ b/pkgs/additional/feeds/default.nix
@@ -1,15 +1,15 @@
 { lib
 , callPackage
 , python3
+, sane-data
 , static-nix-shell
 , writeShellScript
 }:
 
 let
   # TODO: dependency-inject this.
-  sane-data = import ../../modules/data { inherit lib; };
   template = callPackage ./template.nix;
-  feed-pkgs = lib.mapAttrs
+  feed-pkgs' = lib.mapAttrs
     (name: feed-details: template {
       feedName = name;
       jsonPath = "modules/data/feeds/sources/${name}/default.json";
@@ -18,9 +18,9 @@ let
     sane-data.feeds;
   update-scripts = lib.mapAttrsToList
     (name: feed: builtins.concatStringsSep " " feed.passthru.updateScript)
-    feed-pkgs;
+    feed-pkgs';
 in rec {  # TODO: make this a scope
-  inherit feed-pkgs;
+  feed-pkgs = lib.recurseIntoAttrs feed-pkgs';
   update = static-nix-shell.mkPython3Bin {
     pname = "update";
     src = ./.;
@@ -49,10 +49,9 @@ in rec {  # TODO: make this a scope
       ${update}/bin/update.py "$name" "$json_path"
       cat "$json_path"
     '';
-  passthru = {
-    updateScript = writeShellScript
-      "feeds-update"
-      (builtins.concatStringsSep "\n" update-scripts);
-    initFeedScript = init-feed;
-  };
+
+  updateScript = writeShellScript
+    "feeds-update"
+    (builtins.concatStringsSep "\n" update-scripts);
+  initFeedScript = init-feed;
 }
diff --git a/pkgs/feeds/template.nix b/pkgs/additional/feeds/template.nix
similarity index 100%
rename from pkgs/feeds/template.nix
rename to pkgs/additional/feeds/template.nix
diff --git a/pkgs/feeds/update.py b/pkgs/additional/feeds/update.py
similarity index 100%
rename from pkgs/feeds/update.py
rename to pkgs/additional/feeds/update.py
diff --git a/pkgs/fluffychat-moby/default.nix b/pkgs/additional/fluffychat-moby/default.nix
similarity index 100%
rename from pkgs/fluffychat-moby/default.nix
rename to pkgs/additional/fluffychat-moby/default.nix
diff --git a/pkgs/fractal-latest/default.nix b/pkgs/additional/fractal-latest/default.nix
similarity index 100%
rename from pkgs/fractal-latest/default.nix
rename to pkgs/additional/fractal-latest/default.nix
diff --git a/pkgs/gopass-native-messaging-host/com.justwatch.gopass.json b/pkgs/additional/gopass-native-messaging-host/com.justwatch.gopass.json
similarity index 100%
rename from pkgs/gopass-native-messaging-host/com.justwatch.gopass.json
rename to pkgs/additional/gopass-native-messaging-host/com.justwatch.gopass.json
diff --git a/pkgs/gopass-native-messaging-host/default.nix b/pkgs/additional/gopass-native-messaging-host/default.nix
similarity index 100%
rename from pkgs/gopass-native-messaging-host/default.nix
rename to pkgs/additional/gopass-native-messaging-host/default.nix
diff --git a/pkgs/gopass-native-messaging-host/gopass-wrapper.sh b/pkgs/additional/gopass-native-messaging-host/gopass-wrapper.sh
similarity index 100%
rename from pkgs/gopass-native-messaging-host/gopass-wrapper.sh
rename to pkgs/additional/gopass-native-messaging-host/gopass-wrapper.sh
diff --git a/pkgs/gpodder-configured/default.nix b/pkgs/additional/gpodder-configured/default.nix
similarity index 100%
rename from pkgs/gpodder-configured/default.nix
rename to pkgs/additional/gpodder-configured/default.nix
diff --git a/pkgs/gpodder-configured/gpodder-remove-extra b/pkgs/additional/gpodder-configured/gpodder-remove-extra
similarity index 100%
rename from pkgs/gpodder-configured/gpodder-remove-extra
rename to pkgs/additional/gpodder-configured/gpodder-remove-extra
diff --git a/pkgs/kaiteki/default.nix b/pkgs/additional/kaiteki/default.nix
similarity index 100%
rename from pkgs/kaiteki/default.nix
rename to pkgs/additional/kaiteki/default.nix
diff --git a/pkgs/lightdm-mobile-greeter/default.nix b/pkgs/additional/lightdm-mobile-greeter/default.nix
similarity index 100%
rename from pkgs/lightdm-mobile-greeter/default.nix
rename to pkgs/additional/lightdm-mobile-greeter/default.nix
diff --git a/pkgs/linux-megous/default.nix b/pkgs/additional/linux-megous/default.nix
similarity index 79%
rename from pkgs/linux-megous/default.nix
rename to pkgs/additional/linux-megous/default.nix
index 5c1ca67c..583c4303 100644
--- a/pkgs/linux-megous/default.nix
+++ b/pkgs/additional/linux-megous/default.nix
@@ -1,8 +1,18 @@
-{ lib, buildPackages, fetchFromGitHub, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
+{ lib
+, buildLinux
+, buildPackages
+, fetchFromGitHub
+, kernelPatches
+, modDirVersionArg ? null
+, nixosTests
+, perl
+, ...
+} @ args:
 
 with lib;
 
 let
+  kernelPatches' = kernelPatches;
   base = "6.2.0";
   # set to empty if not a release candidate
   rc = "-rc5";
@@ -15,6 +25,11 @@ in buildLinux (args // rec {
   # branchVersion needs to be x.y
   extraMeta.branch = versions.majorMinor version;
 
+  kernelPatches = [
+    kernelPatches'.bridge_stp_helper
+    kernelPatches'.request_key_helper
+  ];
+
   src = fetchFromGitHub {
     # HOW TO UPDATE:
     # - `git fetch` from megous' github.
diff --git a/pkgs/mx-sanebot/Cargo.lock b/pkgs/additional/mx-sanebot/Cargo.lock
similarity index 100%
rename from pkgs/mx-sanebot/Cargo.lock
rename to pkgs/additional/mx-sanebot/Cargo.lock
diff --git a/pkgs/mx-sanebot/Cargo.toml b/pkgs/additional/mx-sanebot/Cargo.toml
similarity index 100%
rename from pkgs/mx-sanebot/Cargo.toml
rename to pkgs/additional/mx-sanebot/Cargo.toml
diff --git a/pkgs/mx-sanebot/default.nix b/pkgs/additional/mx-sanebot/default.nix
similarity index 100%
rename from pkgs/mx-sanebot/default.nix
rename to pkgs/additional/mx-sanebot/default.nix
diff --git a/pkgs/mx-sanebot/flake.lock b/pkgs/additional/mx-sanebot/flake.lock
similarity index 100%
rename from pkgs/mx-sanebot/flake.lock
rename to pkgs/additional/mx-sanebot/flake.lock
diff --git a/pkgs/mx-sanebot/flake.nix b/pkgs/additional/mx-sanebot/flake.nix
similarity index 100%
rename from pkgs/mx-sanebot/flake.nix
rename to pkgs/additional/mx-sanebot/flake.nix
diff --git a/pkgs/mx-sanebot/shell.nix b/pkgs/additional/mx-sanebot/shell.nix
similarity index 100%
rename from pkgs/mx-sanebot/shell.nix
rename to pkgs/additional/mx-sanebot/shell.nix
diff --git a/pkgs/mx-sanebot/src/main.rs b/pkgs/additional/mx-sanebot/src/main.rs
similarity index 100%
rename from pkgs/mx-sanebot/src/main.rs
rename to pkgs/additional/mx-sanebot/src/main.rs
diff --git a/pkgs/mx-sanebot/src/msg_handler.rs b/pkgs/additional/mx-sanebot/src/msg_handler.rs
similarity index 100%
rename from pkgs/mx-sanebot/src/msg_handler.rs
rename to pkgs/additional/mx-sanebot/src/msg_handler.rs
diff --git a/pkgs/mx-sanebot/src/parsing.rs b/pkgs/additional/mx-sanebot/src/parsing.rs
similarity index 100%
rename from pkgs/mx-sanebot/src/parsing.rs
rename to pkgs/additional/mx-sanebot/src/parsing.rs
diff --git a/pkgs/rtl8723cs-firmware/default.nix b/pkgs/additional/rtl8723cs-firmware/default.nix
similarity index 100%
rename from pkgs/rtl8723cs-firmware/default.nix
rename to pkgs/additional/rtl8723cs-firmware/default.nix
diff --git a/pkgs/sane-scripts/default.nix b/pkgs/additional/sane-scripts/default.nix
similarity index 100%
rename from pkgs/sane-scripts/default.nix
rename to pkgs/additional/sane-scripts/default.nix
diff --git a/pkgs/sane-scripts/resholve-prologue b/pkgs/additional/sane-scripts/resholve-prologue
similarity index 100%
rename from pkgs/sane-scripts/resholve-prologue
rename to pkgs/additional/sane-scripts/resholve-prologue
diff --git a/pkgs/sane-scripts/src/sane-backup-ls b/pkgs/additional/sane-scripts/src/sane-backup-ls
similarity index 100%
rename from pkgs/sane-scripts/src/sane-backup-ls
rename to pkgs/additional/sane-scripts/src/sane-backup-ls
diff --git a/pkgs/sane-scripts/src/sane-backup-restore b/pkgs/additional/sane-scripts/src/sane-backup-restore
similarity index 100%
rename from pkgs/sane-scripts/src/sane-backup-restore
rename to pkgs/additional/sane-scripts/src/sane-backup-restore
diff --git a/pkgs/sane-scripts/src/sane-bt-add b/pkgs/additional/sane-scripts/src/sane-bt-add
similarity index 100%
rename from pkgs/sane-scripts/src/sane-bt-add
rename to pkgs/additional/sane-scripts/src/sane-bt-add
diff --git a/pkgs/sane-scripts/src/sane-bt-search b/pkgs/additional/sane-scripts/src/sane-bt-search
similarity index 100%
rename from pkgs/sane-scripts/src/sane-bt-search
rename to pkgs/additional/sane-scripts/src/sane-bt-search
diff --git a/pkgs/sane-scripts/src/sane-bt-show b/pkgs/additional/sane-scripts/src/sane-bt-show
similarity index 100%
rename from pkgs/sane-scripts/src/sane-bt-show
rename to pkgs/additional/sane-scripts/src/sane-bt-show
diff --git a/pkgs/sane-scripts/src/sane-date-math b/pkgs/additional/sane-scripts/src/sane-date-math
similarity index 100%
rename from pkgs/sane-scripts/src/sane-date-math
rename to pkgs/additional/sane-scripts/src/sane-date-math
diff --git a/pkgs/sane-scripts/src/sane-deadlines b/pkgs/additional/sane-scripts/src/sane-deadlines
similarity index 100%
rename from pkgs/sane-scripts/src/sane-deadlines
rename to pkgs/additional/sane-scripts/src/sane-deadlines
diff --git a/pkgs/sane-scripts/src/sane-dev-cargo-loop b/pkgs/additional/sane-scripts/src/sane-dev-cargo-loop
similarity index 100%
rename from pkgs/sane-scripts/src/sane-dev-cargo-loop
rename to pkgs/additional/sane-scripts/src/sane-dev-cargo-loop
diff --git a/pkgs/sane-scripts/src/sane-find-dotfiles b/pkgs/additional/sane-scripts/src/sane-find-dotfiles
similarity index 100%
rename from pkgs/sane-scripts/src/sane-find-dotfiles
rename to pkgs/additional/sane-scripts/src/sane-find-dotfiles
diff --git a/pkgs/sane-scripts/src/sane-git-init b/pkgs/additional/sane-scripts/src/sane-git-init
similarity index 100%
rename from pkgs/sane-scripts/src/sane-git-init
rename to pkgs/additional/sane-scripts/src/sane-git-init
diff --git a/pkgs/sane-scripts/src/sane-ip-check b/pkgs/additional/sane-scripts/src/sane-ip-check
similarity index 100%
rename from pkgs/sane-scripts/src/sane-ip-check
rename to pkgs/additional/sane-scripts/src/sane-ip-check
diff --git a/pkgs/sane-scripts/src/sane-ip-check-router-wan b/pkgs/additional/sane-scripts/src/sane-ip-check-router-wan
similarity index 100%
rename from pkgs/sane-scripts/src/sane-ip-check-router-wan
rename to pkgs/additional/sane-scripts/src/sane-ip-check-router-wan
diff --git a/pkgs/sane-scripts/src/sane-ip-reconnect b/pkgs/additional/sane-scripts/src/sane-ip-reconnect
similarity index 100%
rename from pkgs/sane-scripts/src/sane-ip-reconnect
rename to pkgs/additional/sane-scripts/src/sane-ip-reconnect
diff --git a/pkgs/sane-scripts/src/sane-mount-servo b/pkgs/additional/sane-scripts/src/sane-mount-servo
similarity index 100%
rename from pkgs/sane-scripts/src/sane-mount-servo
rename to pkgs/additional/sane-scripts/src/sane-mount-servo
diff --git a/pkgs/sane-scripts/src/sane-mount-servo-root b/pkgs/additional/sane-scripts/src/sane-mount-servo-root
similarity index 100%
rename from pkgs/sane-scripts/src/sane-mount-servo-root
rename to pkgs/additional/sane-scripts/src/sane-mount-servo-root
diff --git a/pkgs/sane-scripts/src/sane-private-change-passwd b/pkgs/additional/sane-scripts/src/sane-private-change-passwd
similarity index 100%
rename from pkgs/sane-scripts/src/sane-private-change-passwd
rename to pkgs/additional/sane-scripts/src/sane-private-change-passwd
diff --git a/pkgs/sane-scripts/src/sane-private-do b/pkgs/additional/sane-scripts/src/sane-private-do
similarity index 100%
rename from pkgs/sane-scripts/src/sane-private-do
rename to pkgs/additional/sane-scripts/src/sane-private-do
diff --git a/pkgs/sane-scripts/src/sane-private-init b/pkgs/additional/sane-scripts/src/sane-private-init
similarity index 100%
rename from pkgs/sane-scripts/src/sane-private-init
rename to pkgs/additional/sane-scripts/src/sane-private-init
diff --git a/pkgs/sane-scripts/src/sane-private-lock b/pkgs/additional/sane-scripts/src/sane-private-lock
similarity index 100%
rename from pkgs/sane-scripts/src/sane-private-lock
rename to pkgs/additional/sane-scripts/src/sane-private-lock
diff --git a/pkgs/sane-scripts/src/sane-private-unlock b/pkgs/additional/sane-scripts/src/sane-private-unlock
similarity index 100%
rename from pkgs/sane-scripts/src/sane-private-unlock
rename to pkgs/additional/sane-scripts/src/sane-private-unlock
diff --git a/pkgs/sane-scripts/src/sane-rcp b/pkgs/additional/sane-scripts/src/sane-rcp
similarity index 100%
rename from pkgs/sane-scripts/src/sane-rcp
rename to pkgs/additional/sane-scripts/src/sane-rcp
diff --git a/pkgs/sane-scripts/src/sane-reboot b/pkgs/additional/sane-scripts/src/sane-reboot
similarity index 100%
rename from pkgs/sane-scripts/src/sane-reboot
rename to pkgs/additional/sane-scripts/src/sane-reboot
diff --git a/pkgs/sane-scripts/src/sane-reclaim-boot-space b/pkgs/additional/sane-scripts/src/sane-reclaim-boot-space
similarity index 100%
rename from pkgs/sane-scripts/src/sane-reclaim-boot-space
rename to pkgs/additional/sane-scripts/src/sane-reclaim-boot-space
diff --git a/pkgs/sane-scripts/src/sane-reclaim-disk-space b/pkgs/additional/sane-scripts/src/sane-reclaim-disk-space
similarity index 100%
rename from pkgs/sane-scripts/src/sane-reclaim-disk-space
rename to pkgs/additional/sane-scripts/src/sane-reclaim-disk-space
diff --git a/pkgs/sane-scripts/src/sane-secrets-dump b/pkgs/additional/sane-scripts/src/sane-secrets-dump
similarity index 100%
rename from pkgs/sane-scripts/src/sane-secrets-dump
rename to pkgs/additional/sane-scripts/src/sane-secrets-dump
diff --git a/pkgs/sane-scripts/src/sane-secrets-unlock b/pkgs/additional/sane-scripts/src/sane-secrets-unlock
similarity index 100%
rename from pkgs/sane-scripts/src/sane-secrets-unlock
rename to pkgs/additional/sane-scripts/src/sane-secrets-unlock
diff --git a/pkgs/sane-scripts/src/sane-secrets-update-keys b/pkgs/additional/sane-scripts/src/sane-secrets-update-keys
similarity index 100%
rename from pkgs/sane-scripts/src/sane-secrets-update-keys
rename to pkgs/additional/sane-scripts/src/sane-secrets-update-keys
diff --git a/pkgs/sane-scripts/src/sane-shutdown b/pkgs/additional/sane-scripts/src/sane-shutdown
similarity index 100%
rename from pkgs/sane-scripts/src/sane-shutdown
rename to pkgs/additional/sane-scripts/src/sane-shutdown
diff --git a/pkgs/sane-scripts/src/sane-ssl-dump b/pkgs/additional/sane-scripts/src/sane-ssl-dump
similarity index 100%
rename from pkgs/sane-scripts/src/sane-ssl-dump
rename to pkgs/additional/sane-scripts/src/sane-ssl-dump
diff --git a/pkgs/sane-scripts/src/sane-stop-all-servo b/pkgs/additional/sane-scripts/src/sane-stop-all-servo
similarity index 100%
rename from pkgs/sane-scripts/src/sane-stop-all-servo
rename to pkgs/additional/sane-scripts/src/sane-stop-all-servo
diff --git a/pkgs/sane-scripts/src/sane-sudo-redirect b/pkgs/additional/sane-scripts/src/sane-sudo-redirect
similarity index 100%
rename from pkgs/sane-scripts/src/sane-sudo-redirect
rename to pkgs/additional/sane-scripts/src/sane-sudo-redirect
diff --git a/pkgs/sane-scripts/src/sane-sync-from-iphone b/pkgs/additional/sane-scripts/src/sane-sync-from-iphone
similarity index 100%
rename from pkgs/sane-scripts/src/sane-sync-from-iphone
rename to pkgs/additional/sane-scripts/src/sane-sync-from-iphone
diff --git a/pkgs/sane-scripts/src/sane-sync-from-servo b/pkgs/additional/sane-scripts/src/sane-sync-from-servo
similarity index 100%
rename from pkgs/sane-scripts/src/sane-sync-from-servo
rename to pkgs/additional/sane-scripts/src/sane-sync-from-servo
diff --git a/pkgs/sane-scripts/src/sane-test b/pkgs/additional/sane-scripts/src/sane-test
similarity index 100%
rename from pkgs/sane-scripts/src/sane-test
rename to pkgs/additional/sane-scripts/src/sane-test
diff --git a/pkgs/sane-scripts/src/sane-vpn-down b/pkgs/additional/sane-scripts/src/sane-vpn-down
similarity index 100%
rename from pkgs/sane-scripts/src/sane-vpn-down
rename to pkgs/additional/sane-scripts/src/sane-vpn-down
diff --git a/pkgs/sane-scripts/src/sane-vpn-up b/pkgs/additional/sane-scripts/src/sane-vpn-up
similarity index 100%
rename from pkgs/sane-scripts/src/sane-vpn-up
rename to pkgs/additional/sane-scripts/src/sane-vpn-up
diff --git a/pkgs/sane-scripts/src/sane-which b/pkgs/additional/sane-scripts/src/sane-which
similarity index 100%
rename from pkgs/sane-scripts/src/sane-which
rename to pkgs/additional/sane-scripts/src/sane-which
diff --git a/pkgs/splatmoji/default.nix b/pkgs/additional/splatmoji/default.nix
similarity index 100%
rename from pkgs/splatmoji/default.nix
rename to pkgs/additional/splatmoji/default.nix
diff --git a/pkgs/static-nix-shell/default.nix b/pkgs/additional/static-nix-shell/default.nix
similarity index 89%
rename from pkgs/static-nix-shell/default.nix
rename to pkgs/additional/static-nix-shell/default.nix
index 24e2ac99..c0f5e061 100644
--- a/pkgs/static-nix-shell/default.nix
+++ b/pkgs/additional/static-nix-shell/default.nix
@@ -2,14 +2,12 @@
 , lib
 , makeWrapper
 , python3
-, sane-lib
 , stdenv
 }:
 
 let
-  inherit (builtins) attrNames attrValues concatStringsSep map typeOf;
+  inherit (builtins) attrNames attrValues concatStringsSep foldl' map typeOf;
   inherit (lib) concatMapAttrs;
-  inherit (sane-lib) mapToAttrs;
   pkgs' = pkgs;
 in {
   # transform a file which uses `#!/usr/bin/env nix-shell` shebang with a `python3` interpreter
@@ -28,10 +26,9 @@ in {
       #   <value> = package to provide
       pkgsToAttrs = prefix: pkgSet: expr: ({
         "lambda" = expr: pkgsToAttrs prefix pkgSet (expr pkgSet);
-        "list" = expr: mapToAttrs (pname: {
-          name = prefix + pname;
-          value = pkgSet."${pname}";
-        }) expr;
+        "list" = expr: foldl' (acc: pname: acc // {
+          "${prefix + pname}" = pkgSet."${pname}";
+        }) {} expr;
         "set" = expr: expr;
       })."${typeOf expr}" expr;
       pyEnv = python3.withPackages (ps: attrValues (
diff --git a/pkgs/sublime-music-mobile/default.nix b/pkgs/additional/sublime-music-mobile/default.nix
similarity index 100%
rename from pkgs/sublime-music-mobile/default.nix
rename to pkgs/additional/sublime-music-mobile/default.nix
diff --git a/pkgs/tokodon/default.nix b/pkgs/additional/tokodon/default.nix
similarity index 100%
rename from pkgs/tokodon/default.nix
rename to pkgs/additional/tokodon/default.nix
diff --git a/pkgs/tow-boot-pinephone/default.nix b/pkgs/additional/tow-boot-pinephone/default.nix
similarity index 100%
rename from pkgs/tow-boot-pinephone/default.nix
rename to pkgs/additional/tow-boot-pinephone/default.nix
diff --git a/pkgs/tow-boot-rpi4/default.nix b/pkgs/additional/tow-boot-rpi4/default.nix
similarity index 100%
rename from pkgs/tow-boot-rpi4/default.nix
rename to pkgs/additional/tow-boot-rpi4/default.nix
diff --git a/pkgs/ubootRaspberryPi4_64bit/01-skip-lba-check.patch b/pkgs/additional/ubootRaspberryPi4_64bit/01-skip-lba-check.patch
similarity index 100%
rename from pkgs/ubootRaspberryPi4_64bit/01-skip-lba-check.patch
rename to pkgs/additional/ubootRaspberryPi4_64bit/01-skip-lba-check.patch
diff --git a/pkgs/ubootRaspberryPi4_64bit/03-verbose-log.patch b/pkgs/additional/ubootRaspberryPi4_64bit/03-verbose-log.patch
similarity index 100%
rename from pkgs/ubootRaspberryPi4_64bit/03-verbose-log.patch
rename to pkgs/additional/ubootRaspberryPi4_64bit/03-verbose-log.patch
diff --git a/pkgs/ubootRaspberryPi4_64bit/default.nix b/pkgs/additional/ubootRaspberryPi4_64bit/default.nix
similarity index 100%
rename from pkgs/ubootRaspberryPi4_64bit/default.nix
rename to pkgs/additional/ubootRaspberryPi4_64bit/default.nix
diff --git a/pkgs/browserpass/default.nix b/pkgs/browserpass/default.nix
deleted file mode 100644
index a8708858..00000000
--- a/pkgs/browserpass/default.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ lib
-, browserpass
-, bash
-, fetchFromGitea
-, gnused
-, sane-scripts
-, sops
-, stdenv
-, substituteAll
-}:
-
-let
-  sane-browserpass-gpg = stdenv.mkDerivation {
-    pname = "sane-browserpass-gpg";
-    version = "0.1.0";
-    src = ./.;
-
-    inherit bash gnused sops;
-    sane_scripts = sane-scripts;
-    installPhase = ''
-      mkdir -p $out/bin
-      substituteAll ${./sops-gpg-adapter} $out/bin/gpg
-      chmod +x $out/bin/gpg
-      ln -s $out/bin/gpg $out/bin/gpg2
-    '';
-
-  };
-in
-(browserpass.overrideAttrs (upstream: {
-  src = fetchFromGitea {
-    domain = "git.uninsane.org";
-    owner = "colin";
-    repo = "browserpass-native";
-    # don't forcibly append '.gpg'
-    rev = "d3ef88e12cb127914fb0ead762b7baee6913592f";
-    hash = "sha256-FRnFmCJI/1f92DOI1VXSPivSBzIR372gmgLUfLLiuPc=";
-  };
-  installPhase = ''
-    make install
-
-    wrapProgram $out/bin/browserpass \
-      --prefix PATH : ${lib.makeBinPath [ sane-browserpass-gpg ]}
-
-    # This path is used by our firefox wrapper for finding native messaging hosts
-    mkdir -p $out/lib/mozilla/native-messaging-hosts
-    ln -s $out/lib/browserpass/hosts/firefox/*.json $out/lib/mozilla/native-messaging-hosts
-  '';
-}))
diff --git a/pkgs/default.nix b/pkgs/default.nix
new file mode 100644
index 00000000..18e8a939
--- /dev/null
+++ b/pkgs/default.nix
@@ -0,0 +1,73 @@
+{ pkgs ? import <nixpkgs> {}, lib ? pkgs.lib, unpatched ? pkgs }:
+let
+
+  pythonPackagesOverlay = py-final: py-prev: import ./python-packages {
+    inherit (py-final) callPackage;
+  };
+  # this scope ensures that my packages can all take each other as inputs,
+  # even when evaluated bare (i.e. outside of an overlay)
+  sane = lib.makeScope pkgs.newScope (self: with self; {
+    sane-data = import ../modules/data { inherit lib; };
+    sane-lib = import ../modules/lib pkgs;
+
+    ### ADDITIONAL PACKAGES
+    bootpart-uefi-x86_64 = callPackage ./additional/bootpart-uefi-x86_64 { };
+    browserpass-extension = callPackage ./additional/browserpass-extension { };
+    cargo-docset = callPackage ./additional/cargo-docset { };
+    feeds = lib.recurseIntoAttrs (callPackage ./additional/feeds { });
+    gopass-native-messaging-host = callPackage ./additional/gopass-native-messaging-host { };
+    gpodder-configured = callPackage ./additional/gpodder-configured { };
+    lightdm-mobile-greeter = callPackage ./additional/lightdm-mobile-greeter { };
+    linux-megous = callPackage ./additional/linux-megous { };
+    mx-sanebot = callPackage ./additional/mx-sanebot { };
+    rtl8723cs-firmware = callPackage ./additional/rtl8723cs-firmware { };
+    sane-scripts = callPackage ./additional/sane-scripts { };
+    static-nix-shell = callPackage ./additional/static-nix-shell { };
+    sublime-music-mobile = callPackage ./additional/sublime-music-mobile { };
+    tow-boot-pinephone = callPackage ./additional/tow-boot-pinephone { };
+
+    # packages i haven't used for a while, may or may not still work
+    # fluffychat-moby = callPackage ./additional/fluffychat-moby { };
+    # fractal-latest = callPackage ./additional/fractal-latest { };
+    # kaiteki = callPackage ./additional/kaiteki { };
+    # tokodon = libsForQt5.callPackage ./additional/tokodon { };
+
+    # old rpi packages that may or may not still work
+    # bootpart-tow-boot-rpi-aarch64 = callPackage ./additional/bootpart-tow-boot-rpi-aarch64 { };
+    # bootpart-u-boot-rpi-aarch64 = callPackage ./additional/bootpart-u-boot-rpi-aarch64 { };
+    # tow-boot-rpi4 = callPackage ./additional/tow-boot-rpi4 { };
+    # patch rpi uboot with something that fixes USB HDD boot
+    # ubootRaspberryPi4_64bit = callPackage ./additional/ubootRaspberryPi4_64bit { };
+
+    # provided by nixpkgs patch or upstream PR
+    # splatmoji = callPackage ./additional/splatmoji { };
+
+
+    ### PATCHED PACKAGES
+
+    # XXX: the `inherit`s here are because:
+    # - pkgs.callPackage draws from the _final_ package set.
+    # - unpatched.XYZ draws (selectively) from the _unpatched_ package set.
+    # see <overlays/pkgs.nix>
+    browserpass = callPackage ./patched/browserpass { inherit (unpatched) browserpass; };
+
+    # mozilla keeps nerfing itself and removing configuration options
+    firefox-unwrapped = callPackage ./patched/firefox-unwrapped { inherit (unpatched) firefox-unwrapped; };
+
+    gocryptfs = callPackage ./patched/gocryptfs { inherit (unpatched) gocryptfs; };
+
+    # jackett doesn't allow customization of the bind address: this will probably always be here.
+    jackett = callPackage ./patched/jackett { inherit (unpatched) jackett; };
+
+
+    ### PYTHON PACKAGES
+    pythonPackagesExtensions = (unpatched.pythonPackagesExtensions or []) ++ [
+      pythonPackagesOverlay
+    ];
+    # when this scope's applied as an overlay pythonPackagesExtensions is propagated as desired.
+    # but when freestanding (e.g. NUR), it never gets plumbed into the outer pkgs, so we have to do that explicitly.
+    python3 = unpatched.python3.override {
+      packageOverrides = pythonPackagesOverlay;
+    };
+  });
+in sane.packages sane
diff --git a/pkgs/patched/browserpass/default.nix b/pkgs/patched/browserpass/default.nix
new file mode 100644
index 00000000..ab3dd277
--- /dev/null
+++ b/pkgs/patched/browserpass/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, browserpass
+, bash
+, fetchFromGitea
+, gnused
+, sane-scripts
+, sops
+, stdenv
+, substituteAll
+}:
+
+let
+  sane-browserpass-gpg = stdenv.mkDerivation {
+    pname = "sane-browserpass-gpg";
+    version = "0.1.0";
+    src = ./.;
+
+    inherit bash gnused sops;
+    sane_scripts = sane-scripts;
+    installPhase = ''
+      mkdir -p $out/bin
+      substituteAll ${./sops-gpg-adapter} $out/bin/gpg
+      chmod +x $out/bin/gpg
+      ln -s $out/bin/gpg $out/bin/gpg2
+    '';
+
+  };
+in
+  browserpass.overrideAttrs (upstream: {
+    src = fetchFromGitea {
+      domain = "git.uninsane.org";
+      owner = "colin";
+      repo = "browserpass-native";
+      # don't forcibly append '.gpg'
+      rev = "d3ef88e12cb127914fb0ead762b7baee6913592f";
+      hash = "sha256-FRnFmCJI/1f92DOI1VXSPivSBzIR372gmgLUfLLiuPc=";
+    };
+    installPhase = ''
+      make install
+
+      wrapProgram $out/bin/browserpass \
+        --prefix PATH : ${lib.makeBinPath [ sane-browserpass-gpg ]}
+
+      # This path is used by our firefox wrapper for finding native messaging hosts
+      mkdir -p $out/lib/mozilla/native-messaging-hosts
+      ln -s $out/lib/browserpass/hosts/firefox/*.json $out/lib/mozilla/native-messaging-hosts
+    '';
+  })
diff --git a/pkgs/browserpass/sops-gpg-adapter b/pkgs/patched/browserpass/sops-gpg-adapter
similarity index 100%
rename from pkgs/browserpass/sops-gpg-adapter
rename to pkgs/patched/browserpass/sops-gpg-adapter
diff --git a/pkgs/firefox-unwrapped/allow-searchengines-non-esr.patch b/pkgs/patched/firefox-unwrapped/allow-searchengines-non-esr.patch
similarity index 100%
rename from pkgs/firefox-unwrapped/allow-searchengines-non-esr.patch
rename to pkgs/patched/firefox-unwrapped/allow-searchengines-non-esr.patch
diff --git a/pkgs/firefox-unwrapped/default.nix b/pkgs/patched/firefox-unwrapped/default.nix
similarity index 100%
rename from pkgs/firefox-unwrapped/default.nix
rename to pkgs/patched/firefox-unwrapped/default.nix
diff --git a/pkgs/gocryptfs/default.nix b/pkgs/patched/gocryptfs/default.nix
similarity index 100%
rename from pkgs/gocryptfs/default.nix
rename to pkgs/patched/gocryptfs/default.nix
diff --git a/pkgs/jackett/01-fix-bind-host.patch b/pkgs/patched/jackett/01-fix-bind-host.patch
similarity index 100%
rename from pkgs/jackett/01-fix-bind-host.patch
rename to pkgs/patched/jackett/01-fix-bind-host.patch
diff --git a/pkgs/jackett/default.nix b/pkgs/patched/jackett/default.nix
similarity index 100%
rename from pkgs/jackett/default.nix
rename to pkgs/patched/jackett/default.nix
diff --git a/pkgs/python-packages/default.nix b/pkgs/python-packages/default.nix
new file mode 100644
index 00000000..50c34775
--- /dev/null
+++ b/pkgs/python-packages/default.nix
@@ -0,0 +1,4 @@
+{ callPackage }:
+{
+  feedsearch-crawler = callPackage ./feedsearch-crawler { };
+}
diff --git a/pkgs/feedsearch-crawler/0001-response-chunk-size.patch b/pkgs/python-packages/feedsearch-crawler/0001-response-chunk-size.patch
similarity index 100%
rename from pkgs/feedsearch-crawler/0001-response-chunk-size.patch
rename to pkgs/python-packages/feedsearch-crawler/0001-response-chunk-size.patch
diff --git a/pkgs/feedsearch-crawler/default.nix b/pkgs/python-packages/feedsearch-crawler/default.nix
similarity index 100%
rename from pkgs/feedsearch-crawler/default.nix
rename to pkgs/python-packages/feedsearch-crawler/default.nix