diff --git a/flake.nix b/flake.nix
index d78f92b78..d4e8f985a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -111,7 +111,7 @@
 
       nixpkgsCompiledBy = system: nixpkgs.legacyPackages."${system}";
 
-      evalHost = { name, local, target }: nixpkgs.lib.nixosSystem {
+      evalHost = { name, local, target, light ? false }: nixpkgs.lib.nixosSystem {
         system = target;
         modules = [
           {
@@ -124,6 +124,9 @@
             # nixpkgs.buildPlatform = local;  # set by instantiate.nix instead
             # nixpkgs.config.replaceStdenv = { pkgs }: pkgs.ccacheStdenv;
           }
+          (optionalAttrs light {
+            sane.enableSlowPrograms = false;
+          })
           (import ./hosts/instantiate.nix { hostName = name; })
           self.nixosModules.default
           self.nixosModules.passthru
@@ -139,21 +142,21 @@
       nixosConfigurations =
         let
           hosts = {
-            servo =  { name = "servo"; local = "x86_64-linux"; target = "x86_64-linux"; };
-            desko =  { name = "desko"; local = "x86_64-linux"; target = "x86_64-linux"; };
-            lappy =  { name = "lappy"; local = "x86_64-linux"; target = "x86_64-linux"; };
-            moby  =  { name = "moby";  local = "x86_64-linux"; target = "aarch64-linux"; };
-            rescue = { name = "rescue"; local = "x86_64-linux"; target = "x86_64-linux"; };
+            servo       = { name = "servo";  local = "x86_64-linux"; target = "x86_64-linux";  };
+            desko       = { name = "desko";  local = "x86_64-linux"; target = "x86_64-linux";  };
+            desko-light = { name = "desko";  local = "x86_64-linux"; target = "x86_64-linux";  light = true; };
+            lappy       = { name = "lappy";  local = "x86_64-linux"; target = "x86_64-linux";  };
+            lappy-light = { name = "lappy";  local = "x86_64-linux"; target = "x86_64-linux";  light = true; };
+            moby        = { name = "moby";   local = "x86_64-linux"; target = "aarch64-linux"; };
+            moby-light  = { name = "moby";   local = "x86_64-linux"; target = "aarch64-linux"; light = true; };
+            rescue      = { name = "rescue"; local = "x86_64-linux"; target = "x86_64-linux";  };
           };
           # cross-compiled builds: instead of emulating the host, build using a cross-compiler.
           # - these are faster to *build* than the emulated variants (useful when tweaking packages),
           # - but fewer of their packages can be found in upstream caches.
           cross = mapAttrValues evalHost hosts;
           emulated = mapAttrValues
-            ({name, local, target}: evalHost {
-              inherit name target;
-              local = null;
-            })
+            (args: evalHost (args // { local = null; }))
             hosts;
           prefixAttrs = prefix: attrs: mapAttrs'
             (name: value: {
@@ -165,9 +168,9 @@
           (prefixAttrs "cross-" cross) //
           (prefixAttrs "emulated-" emulated) // {
             # prefer native builds for these machines:
-            inherit (emulated) servo desko lappy rescue;
+            inherit (emulated) servo desko desko-light lappy lappy-light rescue;
             # prefer cross-compiled builds for these machines:
-            inherit (cross) moby;
+            inherit (cross) moby moby-light;
           };
 
       # unofficial output
@@ -332,7 +335,7 @@
                 - `nix run '.#update.feeds'`
                   - updates metadata for all feeds
                 - `nix run '.#init-feed' <url>`
-                - `nix run '.#deploy-{lappy,moby,moby-test,servo}' [nixos-rebuild args ...]`
+                - `nix run '.#deploy.{desko,lappy,moby,servo}[-light][.test]' [nixos-rebuild args ...]`
                 - `nix run '.#check'`
                   - make sure all systems build; NUR evaluates
 
@@ -354,22 +357,14 @@
             program = "${pkgs.feeds.init-feed}";
           };
 
-          deploy-lappy = {
+          deploy = mapAttrValues (host: {
             type = "app";
-            program = ''${deployScript "lappy" "lappy" "switch"}'';
-          };
-          deploy-moby-test = {
-            type = "app";
-            program = ''${deployScript "moby" "moby-hn" "test"}'';
-          };
-          deploy-moby = {
-            type = "app";
-            program = ''${deployScript "moby" "moby-hn" "switch"}'';
-          };
-          deploy-servo = {
-            type = "app";
-            program = ''${deployScript "servo" "servo" "switch"}'';
-          };
+            program  = ''${deployScript host host "switch"}'';
+            test = {
+              type = "app";
+              program  = ''${deployScript host host "test"}'';
+            };
+          }) self.nixosConfigurations;
 
           sync-moby = {
             # copy music from the current device to moby
diff --git a/hosts/by-name/moby/default.nix b/hosts/by-name/moby/default.nix
index f8ad889a5..d4c8e1687 100644
--- a/hosts/by-name/moby/default.nix
+++ b/hosts/by-name/moby/default.nix
@@ -59,7 +59,6 @@
   # HACK/TODO: make `programs.P.env.VAR` behave according to `mime.priority`
   sane.programs.firefox.env = lib.mkForce {};
   sane.programs.epiphany.env.BROWSER = "epiphany";
-  sane.programs.firefox.enableFor.user.colin = false;  # use epiphany instead
 
   # note the .conf.d approach: using ~/.config/pipewire/pipewire.conf directly breaks all audio,
   # presumably because that deletes the defaults entirely whereas the .conf.d approach selectively overrides defaults
diff --git a/hosts/common/programs/firefox.nix b/hosts/common/programs/firefox.nix
index 4e58ef139..a3a155acd 100644
--- a/hosts/common/programs/firefox.nix
+++ b/hosts/common/programs/firefox.nix
@@ -198,6 +198,8 @@ in
           "x-scheme-handler/unknown" = desktop;
         };
 
+        slowToBuild = true;  # compared to e.g. epiphany or webkit-based browsers
+
         # env.BROWSER = "${package}/bin/${cfg.browser.libName}";
         env.BROWSER = cfg.browser.libName;  # used by misc tools like xdg-email, as fallback
 
diff --git a/hosts/common/programs/geary.nix b/hosts/common/programs/geary.nix
index 4cb83061b..9b1b7ea1d 100644
--- a/hosts/common/programs/geary.nix
+++ b/hosts/common/programs/geary.nix
@@ -19,6 +19,7 @@ in
       };
     };
 
+    slowToBuild = true;  # uses webkitgtk 4.1
     persist.byStore.private = [
       # attachments, and email -- contained in a sqlite db
       ".local/share/geary"
diff --git a/hosts/common/programs/libreoffice.nix b/hosts/common/programs/libreoffice.nix
index 9aa30c581..047b36a39 100644
--- a/hosts/common/programs/libreoffice.nix
+++ b/hosts/common/programs/libreoffice.nix
@@ -6,6 +6,8 @@
     # package = pkgs.libreoffice-still;
     package = pkgs.libreoffice-fresh;
 
+    slowToBuild = true;
+
     # disable first-run stuff
     fs.".config/libreoffice/4/user/registrymodifications.xcu".symlink.text = ''
       <?xml version="1.0" encoding="UTF-8"?>
diff --git a/hosts/common/programs/tangram.nix b/hosts/common/programs/tangram.nix
index 1412ac39a..21caf7fd5 100644
--- a/hosts/common/programs/tangram.nix
+++ b/hosts/common/programs/tangram.nix
@@ -27,6 +27,8 @@ in
       '' + (upstream.preFixup or "");
     });
 
+    slowToBuild = true;  # only true for cross-compiled tangram
+
     persist.byStore.private = [
       ".cache/Tangram"
       ".local/share/Tangram"
diff --git a/hosts/common/programs/wireshark.nix b/hosts/common/programs/wireshark.nix
index b2c38187a..448b341c3 100644
--- a/hosts/common/programs/wireshark.nix
+++ b/hosts/common/programs/wireshark.nix
@@ -1,4 +1,6 @@
 { config, ... }:
 {
+  sane.programs.wireshark.slowToBuild = true;
+
   programs.wireshark.enable = config.sane.programs.wireshark.enabled;
 }
diff --git a/hosts/common/programs/zeal.nix b/hosts/common/programs/zeal.nix
index a4c1cff77..bd1b757e9 100644
--- a/hosts/common/programs/zeal.nix
+++ b/hosts/common/programs/zeal.nix
@@ -15,6 +15,7 @@ in {
   sane.programs.zeal = {
     # package = pkgs.zeal-qt6;  #< TODO: upgrade system to qt6 versions of everything (i.e. jellyfin-media-player, nheko)
     package = pkgs.zeal-qt5;
+    slowToBuild = true;
     persist.byStore.plaintext = [
       ".cache/Zeal"
       ".local/share/Zeal"
diff --git a/modules/programs.nix b/modules/programs.nix
index 616ddb9e5..f99641be6 100644
--- a/modules/programs.nix
+++ b/modules/programs.nix
@@ -1,5 +1,6 @@
 { config, lib, options, pkgs, sane-lib, utils, ... }:
 let
+  saneCfg = config.sane;
   cfg = config.sane.programs;
 
   # create a map:
@@ -141,6 +142,14 @@ let
           the type at this level is obscured only to as to allow passthrough to `sane.users` w/ proper option merging
         '';
       };
+      slowToBuild = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          whether this package is very slow, or has unique dependencies which are very slow to build.
+          marking packages like this can be used to achieve faster, but limited, rebuilds/deploys (by omitting the package).
+        '';
+      };
       configOption = mkOption {
         type = types.raw;
         default = mkOption {
@@ -156,8 +165,11 @@ let
       config = config.configOption;
     };
 
-    config = {
-      enabled = config.enableFor.system || builtins.any (en: en) (lib.attrValues config.enableFor.user);
+    config = let
+      enabledForUser = builtins.any (en: en) (lib.attrValues config.enableFor.user);
+      passesSlowTest = saneCfg.enableSlowPrograms || !config.slowToBuild;
+    in {
+      enabled = (config.enableFor.system || enabledForUser) && passesSlowTest;
     };
   });
   toPkgSpec = with lib; types.coercedTo types.package (p: { package = p; }) pkgSpec;
@@ -169,18 +181,18 @@ let
     }) p.suggestedPrograms;
 
     # conditionally add to system PATH and env
-    environment = lib.optionalAttrs p.enableFor.system {
+    environment = lib.optionalAttrs (p.enabled && p.enableFor.system) {
       systemPackages = lib.optional (p.package != null) p.package;
       variables = p.env;
     };
 
     # conditionally add to user(s) PATH
     users.users = lib.mapAttrs (user: en: {
-      packages = lib.optional (p.package != null && en) p.package;
+      packages = lib.optional (p.package != null && en && p.enabled) p.package;
     }) p.enableFor.user;
 
     # conditionally persist relevant user dirs and create files
-    sane.users = lib.mapAttrs (user: en: lib.optionalAttrs en {
+    sane.users = lib.mapAttrs (user: en: lib.optionalAttrs (en && p.enabled) {
       inherit (p) persist;
       services = lib.mapAttrs (_: lib.mkMerge) p.services;
       environment = p.env;
@@ -197,7 +209,7 @@ let
 
     # make secrets available for each user
     sops.secrets = lib.concatMapAttrs
-      (user: en: lib.optionalAttrs en (
+      (user: en: lib.optionalAttrs (en && p.enabled) (
         lib.mapAttrs'
           (homePath: src: {
             # TODO: user the user's *actual* home directory, don't guess.
@@ -218,10 +230,18 @@ let
 in
 {
   options = with lib; {
+    # TODO: consolidate these options under one umbrella attrset
     sane.programs = mkOption {
       type = types.attrsOf toPkgSpec;
       default = {};
     };
+    sane.enableSlowPrograms = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        whether to ship programs which are uniquely slow to build.
+      '';
+    };
   };
 
   config =