diff --git a/hosts/common/hardware/default.nix b/hosts/common/hardware/default.nix
index 1db73d3c..e07287a7 100644
--- a/hosts/common/hardware/default.nix
+++ b/hosts/common/hardware/default.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 {
   imports = [
@@ -68,6 +68,11 @@
     HandlePowerKey=ignore
   '';
 
+  # some packages build only if binfmt *isn't* present
+  nix.settings.system-features = lib.mkIf (config.boot.binfmt.emulatedSystems == []) [
+    "no-binfmt"
+  ];
+
   # services.snapper.configs = {
   #   root = {
   #     subvolume = "/";
diff --git a/hosts/modules/nixcache.nix b/hosts/modules/nixcache.nix
index 170bdedd..6a94f352 100644
--- a/hosts/modules/nixcache.nix
+++ b/hosts/modules/nixcache.nix
@@ -94,6 +94,7 @@ in
         speedFactor = 2;
         supportedFeatures = [
           # "big-parallel"  # it can't reliably build webkitgtk
+          "no-binfmt"
         ];
         mandatoryFeatures = [ ];
         sshUser = "nixremote";
diff --git a/overlays/cross.nix b/overlays/cross.nix
index 1deaed19..4afc97d8 100644
--- a/overlays/cross.nix
+++ b/overlays/cross.nix
@@ -60,7 +60,8 @@ let
       pkg
     );
 
-  needsBinfmt = pkg: pkg.overrideAttrs (upstream: {
+  needsBinfmt = pkg: (pkg.overrideAttrs or (updater: pkg // (updater pkg))) (upstream: {
+    # weird signature to support passing *either* a package, or an ordinary attrset
     # "kvm" isn't precisely the right feature here.
     # but the effect is that if you build a `needsBinfmt` package with `-j0`,
     # then nix will try to find a builder that's been marked with `kvm` feature,
@@ -68,6 +69,9 @@ let
     # be built on a binfmt-enabled builder (or not built, if no binfmt builders).
     requiredSystemFeatures = (upstream.requiredSystemFeatures or []) ++ [ "kvm" ];
   });
+  cantBinfmt = pkg: (pkg.overrideAttrs or (updater: pkg // (updater pkg))) (upstream: {
+    requiredSystemFeatures = (upstream.requiredSystemFeatures or []) ++ [ "no-binfmt" ];
+  });
 
   # such packages could build with `needsBinfmt` *or* `buildInQemu`.
   # - the former is [an order of magnitude] faster, but the latter gets me closer to a pure installation.