diff --git a/hosts/by-name/desko/default.nix b/hosts/by-name/desko/default.nix
index ec21e50b5..561af5182 100644
--- a/hosts/by-name/desko/default.nix
+++ b/hosts/by-name/desko/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ ... }:
 {
   imports = [
     ./fs.nix
@@ -46,8 +46,6 @@
 
   sane.programs.mpv.config.defaultProfile = "high-quality";
 
-  sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
-
   # needed to use libimobiledevice/ifuse, for iphone sync
   services.usbmuxd.enable = true;
 
diff --git a/hosts/by-name/flowy/default.nix b/hosts/by-name/flowy/default.nix
index e7df6b112..b05d1a6c3 100644
--- a/hosts/by-name/flowy/default.nix
+++ b/hosts/by-name/flowy/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ ... }:
 {
   imports = [
     ./fs.nix
@@ -11,7 +11,6 @@
   # sane.ovpn.addrV4 = "172.23.119.72";
 
   # sane.guest.enable = true;
-  sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
 
   sane.programs.sane-private-unlock-remote.enableFor.user.colin = true;
   sane.programs.sane-private-unlock-remote.config.hosts = [ "servo" ];
diff --git a/hosts/by-name/lappy/default.nix b/hosts/by-name/lappy/default.nix
index 3a0242770..e0d9931ba 100644
--- a/hosts/by-name/lappy/default.nix
+++ b/hosts/by-name/lappy/default.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ lib, ... }:
 {
   imports = [
     ./fs.nix
@@ -11,7 +11,6 @@
   # sane.ovpn.addrV6 = "fd00:0000:1337:cafe:1111:1111:0332:aa96/128";
 
   # sane.guest.enable = true;
-  sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
 
   sane.programs.sane-private-unlock-remote.enableFor.user.colin = true;
   sane.programs.sane-private-unlock-remote.config.hosts = [ "servo" ];
diff --git a/hosts/by-name/rescue/default.nix b/hosts/by-name/rescue/default.nix
index 2556d1836..7877b2486 100644
--- a/hosts/by-name/rescue/default.nix
+++ b/hosts/by-name/rescue/default.nix
@@ -1,10 +1,9 @@
-{ pkgs, ... }:
+{ ... }:
 {
   imports = [
     ./fs.nix
   ];
 
-  sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
   sane.persist.enable = false;  # what we mean here is that the image is immutable; `/` is still tmpfs.
   sane.nixcache.enable = false;  # don't want to be calling out to dead machines that we're *trying* to rescue
 
diff --git a/hosts/by-name/servo/default.nix b/hosts/by-name/servo/default.nix
index 2f97a6519..2fea1d226 100644
--- a/hosts/by-name/servo/default.nix
+++ b/hosts/by-name/servo/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ ... }:
 
 {
   imports = [
@@ -31,8 +31,6 @@
   # XXX(2024-07-27): this is incompatible if using s6, which needs to auto-login as `colin` to start its user services.
   services.getty.autologinUser = "root";
 
-  sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
-
   # both transmission and ipfs try to set different net defaults.
   # we just use the most aggressive of the two here:
   boot.kernel.sysctl = {
diff --git a/hosts/modules/hal/x86_64.nix b/hosts/modules/hal/x86_64.nix
index b37b21e73..22cad47a1 100644
--- a/hosts/modules/hal/x86_64.nix
+++ b/hosts/modules/hal/x86_64.nix
@@ -29,5 +29,7 @@ in
 
     hardware.cpu.amd.updateMicrocode = true;    # desktop
     hardware.cpu.intel.updateMicrocode = true;  # laptop
+
+    sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
   };
 }