diff --git a/hosts/by-name/moby/gps.nix b/hosts/by-name/moby/gps.nix
index c2ee42f7..04391f03 100644
--- a/hosts/by-name/moby/gps.nix
+++ b/hosts/by-name/moby/gps.nix
@@ -45,24 +45,7 @@
   services.gpsd.enable = true;
   services.gpsd.devices = [ "/dev/ttyUSB1" ];
 
-  # test geoclue2 by building `geoclue2-with-demo-agent`
-  # and running "${geoclue2-with-demo-agent}/libexec/geoclue-2.0/demos/where-am-i"
-  # note that geoclue is dbus-activated, and auto-stops after 60s with no caller
-  services.geoclue2.enable = true;
-  services.geoclue2.appConfig.where-am-i = {
-    # this is the default "agent", shipped by geoclue package: allow it to use location
-    isAllowed = true;
-    isSystem = false;
-    # XXX: setting users != [] might be causing `where-am-i` to time out
-    users = [
-      # restrict to only one set of users. empty array (default) means "allow any user to access geolocation".
-      (builtins.toString config.users.users.colin.uid)
-    ];
-  };
-  systemd.services.geoclue.after = lib.mkForce [];  #< defaults to network-online, but not all my sources require network
   users.users.geoclue.extraGroups = [
     "dialout"  # TODO: figure out if dialout is required. that's for /dev/ttyUSB1, but geoclue probably doesn't read that?
   ];
-
-  sane.programs.where-am-i.enableFor.user.colin = true;
 }
diff --git a/hosts/common/programs/default.nix b/hosts/common/programs/default.nix
index 4337535f..812d703e 100644
--- a/hosts/common/programs/default.nix
+++ b/hosts/common/programs/default.nix
@@ -54,7 +54,7 @@
     ./gdbus.nix
     ./geary.nix
     ./geoclue-demo-agent.nix
-    ./geoclue2
+    ./geoclue2.nix
     ./git.nix
     ./gnome-clocks.nix
     ./gnome-feeds.nix
diff --git a/hosts/common/programs/geoclue2/default.nix b/hosts/common/programs/geoclue2.nix
similarity index 53%
rename from hosts/common/programs/geoclue2/default.nix
rename to hosts/common/programs/geoclue2.nix
index 0cff96ad..7655f9be 100644
--- a/hosts/common/programs/geoclue2/default.nix
+++ b/hosts/common/programs/geoclue2.nix
@@ -29,31 +29,32 @@ in
     ];
   };
 
-  sane.programs.geoclue2.enableFor.system = lib.mkIf (builtins.any (en: en) (builtins.attrValues cfg.enableFor.user)) true;
+  # sane.programs.geoclue2.enableFor.system = lib.mkIf (builtins.any (en: en) (builtins.attrValues cfg.enableFor.user)) true;
 
-  systemd.packages = lib.mkIf cfg.enableFor.system [ cfg.package ];
-  services.dbus.packages = lib.mkIf cfg.enableFor.system [ cfg.package ];
-
-  # TODO: i should be able to run this as an ordinary user
-  users = lib.mkIf cfg.enableFor.system {
-    users.geoclue = {
-      isSystemUser = true;
-      home = "/var/lib/geoclue";
-      group = "geoclue";
-      description = "Geoinformation service";
+  services.geoclue2 = lib.mkIf cfg.enabled {
+    enable = true;
+    geoProviderUrl = "http://127.0.0.1:8088/v1/geolocate";  #< ols
+    appConfig.geoclue-where-am-i = {
+      isAllowed = true;
+      isSystem = false;
+      users = [
+        # restrict to only one set of users. empty array (default) means "allow any user to access geolocation".
+        "1000"
+      ];
+    };
+    appConfig.where-am-i = {
+      # TODO: i think this one is safe to remove
+      isAllowed = true;
+      isSystem = false;
+      users = [
+        # restrict to only one set of users. empty array (default) means "allow any user to access geolocation".
+        "1000"
+      ];
     };
-
-    groups.geoclue = {};
   };
-
-  systemd.services.geoclue = lib.mkIf cfg.enableFor.system {
-    restartTriggers = [
-      config.environment.etc."geoclue/geoclue.conf".source
-    ];
-    serviceConfig.StateDirectory = "geoclue";
-  };
-
-  environment.etc."geoclue/geoclue.conf" = lib.mkIf cfg.enableFor.system {
-    source = ./geoclue.conf;
+  systemd.user.services = lib.mkIf cfg.enabled {
+    # nixos services.geoclue2 runs the agent as a user service by default, but i don't use systemd so that doesn't work.
+    # i manage the agent myself, in sane.programs.geoclue-demo-agent.
+    geoclue-agent.enable = false;
   };
 }
diff --git a/hosts/common/programs/geoclue2/geoclue.conf b/hosts/common/programs/geoclue2/geoclue.conf
deleted file mode 100644
index ef1df34c..00000000
--- a/hosts/common/programs/geoclue2/geoclue.conf
+++ /dev/null
@@ -1,44 +0,0 @@
-[3g]
-enable=true
-
-[agent]
-whitelist=geoclue-demo-agent;gnome-shell;io.elementary.desktop.agent-geoclue2
-
-[cdma]
-enable=true
-
-[epiphany]
-allowed=true
-system=false
-users=
-
-[firefox]
-allowed=true
-system=false
-users=
-
-[geoclue-where-am-i]
-allowed=true
-system=false
-users=1000
-
-[modem-gps]
-enable=true
-
-[network-nmea]
-enable=true
-
-# i think this one is wrong, and is supposed to be `geoclue-where-am-i`
-[where-am-i]
-allowed=true
-system=false
-users=1000
-
-[wifi]
-enable=true
-# submission-nick=geoclue
-# submission-url=https://location.services.mozilla.com/v1/submit?key=geoclue
-submit-data=false
-# url=https://location.services.mozilla.com/v1/geolocate?key=geoclue
-# ols is at http://127.0.0.1:8088/v1/geolocate
-url=http://127.0.0.1:8088/v1/geolocate
diff --git a/hosts/common/programs/mepo.nix b/hosts/common/programs/mepo.nix
index 2d548f74..d0bb705d 100644
--- a/hosts/common/programs/mepo.nix
+++ b/hosts/common/programs/mepo.nix
@@ -16,10 +16,12 @@
       { type = "file"; path = ".cache/mepo/savestate"; }
     ];
 
-    # give mepo access to gpsd for location data, if that's enabled.
-    # same with geoclue2.
-    suggestedPrograms = lib.optional config.services.gpsd.enable "gpsd"
-      ++ lib.optional config.services.geoclue2.enable "geoclue2-with-demo-agent"
+    # enable geoclue2 integration,
+    # and give mepo access to gpsd for location data, if that's enabled.
+    # TODO: this gpsd stuff should be moved to its own file!
+    suggestedPrograms = [
+      "geoclue2"
+    ] ++ lib.optional config.services.gpsd.enable "gpsd"
     ;
   };