diff --git a/hosts/common/programs/aerc.nix b/hosts/common/programs/aerc.nix
index 39d6629b..d8f82e94 100644
--- a/hosts/common/programs/aerc.nix
+++ b/hosts/common/programs/aerc.nix
@@ -1,5 +1,5 @@
 # Terminal UI mail client
-{ config, sane-lib, ... }:
+{ ... }:
 
 {
   sane.programs.aerc.secrets.".config/aerc/accounts.conf" = ../../../secrets/universal/aerc_accounts.conf.bin;
diff --git a/hosts/common/programs/git.nix b/hosts/common/programs/git.nix
index 51e76d28..11a24413 100644
--- a/hosts/common/programs/git.nix
+++ b/hosts/common/programs/git.nix
@@ -1,10 +1,10 @@
-{ lib, pkgs, sane-lib, ... }:
+{ lib, pkgs, ... }:
 
 let
   mkCfg = lib.generators.toINI { };
 in
 {
-  sane.programs.git.fs.".config/git/config" = sane-lib.fs.wantedText (mkCfg {
+  sane.programs.git.fs.".config/git/config".symlink.text = mkCfg {
     user.name = "Colin";
     user.email = "colin@uninsane.org";
     alias.co = "checkout";
@@ -14,5 +14,5 @@ in
     difftool.prompt = false;
     "difftool \"difftastic\"".cmd = ''${pkgs.difftastic}/bin/difft "$LOCAL" "$REMOTE"'';
     # now run `git difftool` to use difftastic git
-  });
+  };
 }
diff --git a/hosts/common/programs/gnome-feeds.nix b/hosts/common/programs/gnome-feeds.nix
index eb66dae3..6cab6a42 100644
--- a/hosts/common/programs/gnome-feeds.nix
+++ b/hosts/common/programs/gnome-feeds.nix
@@ -6,37 +6,35 @@ let
   all-feeds = config.sane.feeds;
   wanted-feeds = feeds.filterByFormat ["text" "image"] all-feeds;
 in {
-  sane.programs.gnome-feeds.fs.".config/org.gabmus.gfeeds.json" = sane-lib.fs.wantedText (
-    builtins.toJSON {
-      # feed format is a map from URL to a dict,
-      #   with dict["tags"] a list of string tags.
-      feeds = sane-lib.mapToAttrs (feed: {
-        name = feed.url;
-        value.tags = [ feed.cat feed.freq ];
-      }) wanted-feeds;
-      dark_reader = false;
-      new_first = true;
-      # windowsize = {
-      #   width = 350;
-      #   height = 650;
-      # };
-      max_article_age_days = 90;
-      enable_js = false;
-      max_refresh_threads = 3;
-      # saved_items = {};
-      # read_items = [];
-      show_read_items = true;
-      full_article_title = true;
-      # views: "webview", "reader", "rsscont"
-      default_view = "rsscont";
-      open_links_externally = true;
-      full_feed_name = false;
-      refresh_on_startup = true;
-      tags = lib.unique (
-        (builtins.catAttrs "cat" wanted-feeds) ++ (builtins.catAttrs "freq" wanted-feeds)
-      );
-      open_youtube_externally = false;
-      media_player = "vlc";  # default: mpv
-    }
-  );
+  sane.programs.gnome-feeds.fs.".config/org.gabmus.gfeeds.json".symlink.text = builtins.toJSON {
+    # feed format is a map from URL to a dict,
+    #   with dict["tags"] a list of string tags.
+    feeds = sane-lib.mapToAttrs (feed: {
+      name = feed.url;
+      value.tags = [ feed.cat feed.freq ];
+    }) wanted-feeds;
+    dark_reader = false;
+    new_first = true;
+    # windowsize = {
+    #   width = 350;
+    #   height = 650;
+    # };
+    max_article_age_days = 90;
+    enable_js = false;
+    max_refresh_threads = 3;
+    # saved_items = {};
+    # read_items = [];
+    show_read_items = true;
+    full_article_title = true;
+    # views: "webview", "reader", "rsscont"
+    default_view = "rsscont";
+    open_links_externally = true;
+    full_feed_name = false;
+    refresh_on_startup = true;
+    tags = lib.unique (
+      (builtins.catAttrs "cat" wanted-feeds) ++ (builtins.catAttrs "freq" wanted-feeds)
+    );
+    open_youtube_externally = false;
+    media_player = "vlc";  # default: mpv
+  };
 }
diff --git a/hosts/common/programs/gpodder.nix b/hosts/common/programs/gpodder.nix
index eafc3e80..6e941f30 100644
--- a/hosts/common/programs/gpodder.nix
+++ b/hosts/common/programs/gpodder.nix
@@ -6,7 +6,7 @@ let
   all-feeds = config.sane.feeds;
   wanted-feeds = feeds.filterByFormat ["podcast"] all-feeds;
 in {
-  sane.programs.gpodder.fs.".config/gpodderFeeds.opml" = sane-lib.fs.wantedText (
+  sane.programs.gpodder.fs.".config/gpodderFeeds.opml".symlink.text =
     feeds.feedsToOpml wanted-feeds
-  );
+  ;
 }
diff --git a/hosts/common/programs/kitty/default.nix b/hosts/common/programs/kitty/default.nix
index e81cbe35..209dd195 100644
--- a/hosts/common/programs/kitty/default.nix
+++ b/hosts/common/programs/kitty/default.nix
@@ -1,7 +1,7 @@
-{ pkgs, sane-lib, ... }:
+{ ... }:
 
 {
-  sane.programs.kitty.fs.".config/kitty/kitty.conf" = sane-lib.fs.wantedText ''
+  sane.programs.kitty.fs.".config/kitty/kitty.conf".symlink.text = ''
     # docs: https://sw.kovidgoyal.net/kitty/conf/
     # disable terminal bell (when e.g. you backspace too many times)
     enable_audio_bell no
diff --git a/hosts/common/programs/libreoffice.nix b/hosts/common/programs/libreoffice.nix
index 69379d56..4b29f2ea 100644
--- a/hosts/common/programs/libreoffice.nix
+++ b/hosts/common/programs/libreoffice.nix
@@ -1,8 +1,8 @@
-{ sane-lib, ... }:
+{ ... }:
 
 {
   # libreoffice: disable first-run stuff
-  sane.programs.libreoffice-fresh.fs.".config/libreoffice/4/user/registrymodifications.xcu" = sane-lib.fs.wantedText ''
+  sane.programs.libreoffice-fresh.fs.".config/libreoffice/4/user/registrymodifications.xcu".symlink.text = ''
     <?xml version="1.0" encoding="UTF-8"?>
     <oor:items xmlns:oor="http://openoffice.org/2001/registry" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
       <item oor:path="/org.openoffice.Office.Common/Misc"><prop oor:name="FirstRun" oor:op="fuse"><value>false</value></prop></item>
diff --git a/hosts/common/programs/mpv.nix b/hosts/common/programs/mpv.nix
index 7ee62611..89c5e6da 100644
--- a/hosts/common/programs/mpv.nix
+++ b/hosts/common/programs/mpv.nix
@@ -1,10 +1,10 @@
-{ sane-lib, ... }:
+{ ... }:
 
 {
   sane.programs.mpv = {
     persist.plaintext = [ ".config/mpv/watch_later" ];
     # format is <key>=%<length>%<value>
-    fs.".config/mpv/mpv.conf" = sane-lib.fs.wantedText ''
+    fs.".config/mpv/mpv.conf".symlink.text = ''
       save-position-on-quit=%3%yes
       keep-open=%3%yes
     '';
diff --git a/hosts/common/programs/newsflash.nix b/hosts/common/programs/newsflash.nix
index ff36d8cd..2b4acac2 100644
--- a/hosts/common/programs/newsflash.nix
+++ b/hosts/common/programs/newsflash.nix
@@ -8,8 +8,8 @@ let
 in {
   sane.programs.newsflash = {
     persist.plaintext = [ ".local/share/news-flash" ];
-    fs.".config/newsflashFeeds.opml" = sane-lib.fs.wantedText (
+    fs.".config/newsflashFeeds.opml".symlink.text =
       feeds.feedsToOpml wanted-feeds
-    );
+    ;
   };
 }
diff --git a/hosts/common/programs/ripgrep.nix b/hosts/common/programs/ripgrep.nix
index e7e7c1b1..74d83cd4 100644
--- a/hosts/common/programs/ripgrep.nix
+++ b/hosts/common/programs/ripgrep.nix
@@ -1,9 +1,9 @@
-{ sane-lib, ... }:
+{ ... }:
 {
   # .ignore file is read by ripgrep (rg), silver searcher (ag), maybe others.
   # ignore translation files by default when searching, as they tend to have
   # a LOT of duplicate text.
-  sane.programs.ripgrep.fs.".ignore" = sane-lib.fs.wantedText ''
+  sane.programs.ripgrep.fs.".ignore".symlink.text = ''
     po/
   '';
 }
diff --git a/hosts/common/programs/splatmoji.nix b/hosts/common/programs/splatmoji.nix
index 6cadf68c..4b9b153b 100644
--- a/hosts/common/programs/splatmoji.nix
+++ b/hosts/common/programs/splatmoji.nix
@@ -1,12 +1,12 @@
 # borrows from:
 # - default config: <https://github.com/cspeterson/splatmoji/blob/master/splatmoji.config>
 # - wayland: <https://github.com/cspeterson/splatmoji/issues/32#issuecomment-830862566>
-{ pkgs, sane-lib, ... }:
+{ pkgs, ... }:
 
 {
   sane.programs.splatmoji = {
     persist.plaintext = [ ".local/state/splatmoji" ];
-    fs.".config/splatmoji/splatmoji.config" = sane-lib.fs.wantedText ''
+    fs.".config/splatmoji/splatmoji.config".symlink.text = ''
       # XXX doesn't seem to understand ~ as shorthand for `$HOME`
       history_file=/home/colin/.local/state/splatmoji/history
       history_length=5
diff --git a/hosts/common/programs/vlc.nix b/hosts/common/programs/vlc.nix
index a0774a00..b3ac69d5 100644
--- a/hosts/common/programs/vlc.nix
+++ b/hosts/common/programs/vlc.nix
@@ -12,7 +12,7 @@ in
   sane.programs.vlc = {
     # vlc remembers play position in ~/.config/vlc/vlc-qt-interface.conf
     persist.plaintext = [ ".config/vlc" ];
-    fs.".config/vlc/vlcrc" = sane-lib.fs.wantedText ''
+    fs.".config/vlc/vlcrc".symlink.text = ''
       [podcast]
       podcast-urls=${podcast-urls}
       [core]
diff --git a/hosts/common/programs/web-browser.nix b/hosts/common/programs/web-browser.nix
index c45ee3f3..3bc1b25c 100644
--- a/hosts/common/programs/web-browser.nix
+++ b/hosts/common/programs/web-browser.nix
@@ -6,7 +6,7 @@
 # many of the settings below won't have effect without those patches.
 # see: https://gitlab.com/librewolf-community/settings/-/blob/master/distribution/policies.json
 
-{ config, lib, pkgs, sane-lib, ...}:
+{ config, lib, pkgs, ...}:
 with lib;
 let
   cfg = config.sane.programs.web-browser.config;
@@ -167,7 +167,7 @@ in
         # the specific attribute path is found via scraping ublock code here:
         # - <https://github.com/gorhill/uBlock/blob/master/src/js/storage.js>
         # - <https://github.com/gorhill/uBlock/blob/master/assets/assets.json>
-        fs."${cfg.browser.dotDir}/managed-storage/uBlock0@raymondhill.net.json" = sane-lib.fs.wantedText ''
+        fs."${cfg.browser.dotDir}/managed-storage/uBlock0@raymondhill.net.json".symlink.text = ''
           {
            "name": "uBlock0@raymondhill.net",
            "description": "ignored",
@@ -177,16 +177,16 @@ in
            }
           }
         '';
-        fs."${cfg.browser.dotDir}/${cfg.browser.libName}.overrides.cfg" = sane-lib.fs.wantedText ''
+        fs."${cfg.browser.dotDir}/${cfg.browser.libName}.overrides.cfg".symlink.text = ''
           // if we can't query the revocation status of a SSL cert because the issuer is offline,
           // treat it as unrevoked.
           // see: <https://librewolf.net/docs/faq/#im-getting-sec_error_ocsp_server_error-what-can-i-do>
           defaultPref("security.OCSP.require", false);
         '';
-        fs."${cfg.browser.dotDir}/default" = sane-lib.fs.wantedDir;
+        fs."${cfg.browser.dotDir}/default".dir = {};
         # instruct Firefox to put the profile in a predictable directory (so we can do things like persist just it).
         # XXX: the directory *must* exist, even if empty; Firefox will not create the directory itself.
-        fs."${cfg.browser.dotDir}/profiles.ini" = sane-lib.fs.wantedText ''
+        fs."${cfg.browser.dotDir}/profiles.ini".symlink.text = ''
           [Profile0]
           Name=default
           IsRelative=1
diff --git a/hosts/common/programs/zeal.nix b/hosts/common/programs/zeal.nix
index b9f1de04..3a614a9f 100644
--- a/hosts/common/programs/zeal.nix
+++ b/hosts/common/programs/zeal.nix
@@ -1,8 +1,7 @@
-{ config, lib, pkgs, sane-lib, ... }:
+{ config, lib, pkgs, ... }:
 let
   inherit (builtins) map;
   inherit (lib) mkIf mkOption optionalString types;
-  inherit (sane-lib) mapToAttrs;
   cfg = config.sane.programs.docsets.config;
   configOpts = types.submodule {
     options = {
@@ -18,7 +17,7 @@ in {
       ".cache/Zeal"
       ".local/share/Zeal"
     ];
-    fs.".local/share/Zeal/Zeal/docsets/system" = sane-lib.fs.wantedSymlinkTo "/run/current-system/sw/share/docset";
+    fs.".local/share/Zeal/Zeal/docsets/system".symlink.target = "/run/current-system/sw/share/docset";
     suggestedPrograms = [ "docsets" ];
   };
 
diff --git a/hosts/common/programs/zsh/default.nix b/hosts/common/programs/zsh/default.nix
index 10409a79..8df13559 100644
--- a/hosts/common/programs/zsh/default.nix
+++ b/hosts/common/programs/zsh/default.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, sane-lib, ... }:
+{ config, lib, pkgs, ... }:
 
 let
   inherit (lib) mkIf mkMerge mkOption types;
@@ -51,12 +51,12 @@ in
         ];
 
         # zsh/prezto complains if zshrc doesn't exist; but it does allow an "empty" file.
-        fs.".config/zsh/.zshrc" = sane-lib.fs.wantedText "# ";
+        fs.".config/zsh/.zshrc".symlink.text = "# ";
 
         # prezto = oh-my-zsh fork; controls prompt, auto-completion, etc.
         # see: https://github.com/sorin-ionescu/prezto
         # i believe this file is auto-sourced by the prezto init.zsh script.
-        fs.".config/zsh/.zpreztorc" = sane-lib.fs.wantedText ''
+        fs.".config/zsh/.zpreztorc".symlink.text = ''
           zstyle ':prezto:*:*' color 'yes'
 
           # modules (they ship with prezto):
diff --git a/modules/programs.nix b/modules/programs.nix
index f5b17403..2e0620bc 100644
--- a/modules/programs.nix
+++ b/modules/programs.nix
@@ -145,9 +145,10 @@ let
     sane.users = mapAttrs (user: en: optionalAttrs en {
       inherit (p) persist;
       fs = mkMerge [
-        p.fs
+        # make every fs entry wanted by system boot:
+        (mapAttrs (_path: sane-lib.fs.wanted) p.fs)
+        # link every secret into the fs:
         (mapAttrs
-          # link every secret into the fs
           # TODO: user the user's *actual* home directory, don't guess.
           (homePath: _src: sane-lib.fs.wantedSymlinkTo "/run/secrets/home/${user}/${homePath}")
           p.secrets