diff --git a/hosts/by-name/servo/services/export/sftpgo.nix b/hosts/by-name/servo/services/export/sftpgo.nix
index 9cc859ed..aab77034 100644
--- a/hosts/by-name/servo/services/export/sftpgo.nix
+++ b/hosts/by-name/servo/services/export/sftpgo.nix
@@ -91,7 +91,7 @@ let
   authFailJson = pkgs.writeText "sftp-auth-fail.json" (builtins.toJSON authResponseFail);
   unwrappedAuthProgram = pkgs.static-nix-shell.mkBash {
     pname = "sftpgo_external_auth_hook";
-    src = ./.;
+    srcRoot = ./.;
     pkgs = [ "coreutils" ];
   };
   authProgram = pkgs.writeShellScript "sftpgo-auth-hook" ''
diff --git a/hosts/by-name/servo/services/ntfy/ntfy-waiter.nix b/hosts/by-name/servo/services/ntfy/ntfy-waiter.nix
index 2a3a7c0e..d7393bff 100644
--- a/hosts/by-name/servo/services/ntfy/ntfy-waiter.nix
+++ b/hosts/by-name/servo/services/ntfy/ntfy-waiter.nix
@@ -49,7 +49,7 @@ in
       type = types.package;
       default = pkgs.static-nix-shell.mkPython3Bin {
         pname = "ntfy-waiter";
-        src = ./.;
+        srcRoot = ./.;
         pkgs = [ "ntfy-sh" ];
       };
       description = ''
diff --git a/hosts/common/programs/conky/default.nix b/hosts/common/programs/conky/default.nix
index aa67418a..60d76264 100644
--- a/hosts/common/programs/conky/default.nix
+++ b/hosts/common/programs/conky/default.nix
@@ -16,7 +16,7 @@
       let
         battery_estimate = pkgs.static-nix-shell.mkBash {
           pname = "battery_estimate";
-          src = ./.;
+          srcRoot = ./.;
         };
       in pkgs.substituteAll {
         src = ./conky.conf;
diff --git a/hosts/common/programs/mimeo/default.nix b/hosts/common/programs/mimeo/default.nix
index 0559e17f..0cb3c9e7 100644
--- a/hosts/common/programs/mimeo/default.nix
+++ b/hosts/common/programs/mimeo/default.nix
@@ -5,7 +5,7 @@
 let
   mimeo-open-desktop = pkgs.static-nix-shell.mkPython3Bin {
     pname = "mimeo-open-desktop";
-    src = ./.;
+    srcRoot = ./.;
     pkgs = [ "mimeo" ];
   };
 
diff --git a/hosts/common/programs/sway-autoscaler/default.nix b/hosts/common/programs/sway-autoscaler/default.nix
index 97824327..b4f3eab5 100644
--- a/hosts/common/programs/sway-autoscaler/default.nix
+++ b/hosts/common/programs/sway-autoscaler/default.nix
@@ -26,7 +26,7 @@ in
     packageUnwrapped = pkgs.static-nix-shell.mkBash {
       pname = "sway-autoscaler";
       pkgs = [ "jq" "sway" "util-linux" ];
-      src = ./.;
+      srcRoot = ./.;
     };
 
     services.sway-autoscaler = {
diff --git a/hosts/common/programs/unl0kr/default.nix b/hosts/common/programs/unl0kr/default.nix
index 67d1a230..be2230c2 100644
--- a/hosts/common/programs/unl0kr/default.nix
+++ b/hosts/common/programs/unl0kr/default.nix
@@ -5,7 +5,7 @@ let
   tty = "tty${builtins.toString cfg.config.vt}";
   redirect-tty = pkgs.static-nix-shell.mkPython3Bin {
     pname = "redirect-tty";
-    src = ./.;
+    srcRoot = ./.;
   };
   launcher = pkgs.writeShellApplication {
     name = "unl0kr-login";
diff --git a/hosts/common/programs/waybar/waybar-top.nix b/hosts/common/programs/waybar/waybar-top.nix
index b54c3ede..c3509ea0 100644
--- a/hosts/common/programs/waybar/waybar-top.nix
+++ b/hosts/common/programs/waybar/waybar-top.nix
@@ -5,7 +5,7 @@
 let
   waybar-media = pkgs.static-nix-shell.mkBash {
     pname = "waybar-media";
-    src = ./.;
+    srcRoot = ./.;
     pkgs = [ "jq" "playerctl" ];
   };
 in
diff --git a/hosts/common/programs/wob/default.nix b/hosts/common/programs/wob/default.nix
index 7439f826..338c5a93 100644
--- a/hosts/common/programs/wob/default.nix
+++ b/hosts/common/programs/wob/default.nix
@@ -10,7 +10,7 @@
 let
   wob-pulse = pkgs.static-nix-shell.mkBash {
     pname = "wob-pulse";
-    src = ./.;
+    srcRoot = ./.;
     pkgs = [ "coreutils" "gnugrep" "gnused" "pulseaudio" ];
   };
   cfg = config.sane.programs.wob;
diff --git a/hosts/modules/derived-secrets/default.nix b/hosts/modules/derived-secrets/default.nix
index 5f5e271d..561421ae 100644
--- a/hosts/modules/derived-secrets/default.nix
+++ b/hosts/modules/derived-secrets/default.nix
@@ -4,7 +4,7 @@ let
 
   hash-path-with-salt = pkgs.static-nix-shell.mkBash {
     pname = "hash-path-with-salt";
-    src = ./.;
+    srcRoot = ./.;
   };
 
   cfg = config.sane.derived-secrets;
diff --git a/hosts/modules/gui/sxmo/default.nix b/hosts/modules/gui/sxmo/default.nix
index b2ebc2a4..2b223b8f 100644
--- a/hosts/modules/gui/sxmo/default.nix
+++ b/hosts/modules/gui/sxmo/default.nix
@@ -71,32 +71,32 @@ let
     block_suspend = pkgs.static-nix-shell.mkBash {
       pname = "sxmo_hook_block_suspend.sh";
       pkgs = [ "procps" ];
-      src = ./hooks;
+      srcRoot = ./hooks;
     };
     inputhandler = pkgs.static-nix-shell.mkBash {
       pname = "sxmo_hook_inputhandler.sh";
       pkgs = [ "coreutils" "playerctl" "pulseaudio" ];
-      src = ./hooks;
+      srcRoot = ./hooks;
     };
     postwake = pkgs.static-nix-shell.mkBash {
       pname = "sxmo_hook_postwake.sh";
       pkgs = [ "coreutils" ];
-      src = ./hooks;
+      srcRoot = ./hooks;
     };
     rotate = pkgs.static-nix-shell.mkBash {
       pname = "sxmo_hook_rotate.sh";
       pkgs = [ "sway" ];
-      src = ./hooks;
+      srcRoot = ./hooks;
     };
     start = pkgs.static-nix-shell.mkBash {
       pname = "sxmo_hook_start.sh";
       pkgs = [ "systemd" "xdg-user-dirs" ];
-      src = ./hooks;
+      srcRoot = ./hooks;
     };
     suspend = pkgs.static-nix-shell.mkPython3Bin {
       pname = "sxmo_suspend.sh";
       pkgs = [ "rtl8723cs-wowlan" "util-linux" ];
-      src = ./hooks;
+      srcRoot = ./hooks;
       extraMakeWrapperArgs = [ "--add-flags" "--verbose" ];
     };
   };
diff --git a/hosts/modules/gui/sxmo/waybar-top.nix b/hosts/modules/gui/sxmo/waybar-top.nix
index 6196b00d..80959494 100644
--- a/hosts/modules/gui/sxmo/waybar-top.nix
+++ b/hosts/modules/gui/sxmo/waybar-top.nix
@@ -5,7 +5,7 @@
 let
   waybar-sxmo-status = pkgs.static-nix-shell.mkBash {
     pname = "waybar-sxmo-status";
-    src = ./.;
+    srcRoot = ./.;
     pkgs = [ "sxmo-utils" "sxmo-utils.runtimeDeps" ];
   };
 in
diff --git a/hosts/modules/roles/client/bluetooth-pairings.nix b/hosts/modules/roles/client/bluetooth-pairings.nix
index 028139e2..0b3f01e3 100644
--- a/hosts/modules/roles/client/bluetooth-pairings.nix
+++ b/hosts/modules/roles/client/bluetooth-pairings.nix
@@ -3,7 +3,7 @@
 let
   install-bluetooth = pkgs.static-nix-shell.mkBash {
     pname = "install-bluetooth";
-    src = ./.;
+    srcRoot = ./.;
     pkgs = [ "gnused" ];
   };
 in
diff --git a/hosts/modules/roles/client/wifi-pairings.nix b/hosts/modules/roles/client/wifi-pairings.nix
index ccdffd71..9b016d33 100644
--- a/hosts/modules/roles/client/wifi-pairings.nix
+++ b/hosts/modules/roles/client/wifi-pairings.nix
@@ -3,7 +3,7 @@
 let
   install-nm = pkgs.static-nix-shell.mkPython3Bin {
     pname = "install-nm";
-    src = ./.;
+    srcRoot = ./.;
   };
 in
 {
diff --git a/modules/fs/default.nix b/modules/fs/default.nix
index 5bd960b0..9e227eb6 100644
--- a/modules/fs/default.nix
+++ b/modules/fs/default.nix
@@ -7,19 +7,19 @@ let
 
   ensure-dir = pkgs.static-nix-shell.mkBash {
     pname = "ensure-dir";
-    src = ./.;
+    srcRoot = ./.;
   };
   ensure-file = pkgs.static-nix-shell.mkBash {
     pname = "ensure-file";
-    src = ./.;
+    srcRoot = ./.;
   };
   ensure-symlink = pkgs.static-nix-shell.mkBash {
     pname = "ensure-symlink";
-    src = ./.;
+    srcRoot = ./.;
   };
   ensure-perms = pkgs.static-nix-shell.mkBash {
     pname = "ensure-perms";
-    src = ./.;
+    srcRoot = ./.;
   };
 
   mountNameFor = path: "${utils.escapeSystemdPath path}.mount";
diff --git a/pkgs/additional/eg25-control/default.nix b/pkgs/additional/eg25-control/default.nix
index 3ae328d8..7a432e70 100644
--- a/pkgs/additional/eg25-control/default.nix
+++ b/pkgs/additional/eg25-control/default.nix
@@ -1,6 +1,6 @@
 { static-nix-shell }:
 static-nix-shell.mkPython3Bin {
   pname = "eg25-control";
-  src = ./.;
+  srcRoot = ./.;
   pkgs = [ "curl" "modemmanager" ];
 }
diff --git a/pkgs/additional/feeds/default.nix b/pkgs/additional/feeds/default.nix
index 8fcd4726..a6e84949 100644
--- a/pkgs/additional/feeds/default.nix
+++ b/pkgs/additional/feeds/default.nix
@@ -18,7 +18,7 @@ lib.makeScope newScope (self: with self; {
   );
   update-feed = static-nix-shell.mkPython3Bin {
     pname = "update";
-    src = ./.;
+    srcRoot = ./.;
     pyPkgs = [ "feedsearch-crawler" ];
     srcPath = "update.py";
   };
diff --git a/pkgs/additional/gpodder-configured/default.nix b/pkgs/additional/gpodder-configured/default.nix
index 0cf92f84..93310d94 100644
--- a/pkgs/additional/gpodder-configured/default.nix
+++ b/pkgs/additional/gpodder-configured/default.nix
@@ -9,7 +9,7 @@ gnome-feeds
 let
   remove-extra = static-nix-shell.mkPython3Bin {
     pname = "gpodder-remove-extra";
-    src = ./.;
+    srcRoot = ./.;
     pyPkgs = _ps: {
       "gnome-feeds.listparser" = gnome-feeds.listparser;
     };
diff --git a/pkgs/additional/rtl8723cs-wowlan/default.nix b/pkgs/additional/rtl8723cs-wowlan/default.nix
index e79c4fa3..b56e2218 100644
--- a/pkgs/additional/rtl8723cs-wowlan/default.nix
+++ b/pkgs/additional/rtl8723cs-wowlan/default.nix
@@ -6,7 +6,7 @@
 
 static-nix-shell.mkPython3Bin {
   pname = "rtl8723cs-wowlan";
-  src = ./.;
+  srcRoot = ./.;
   pkgs = {
     inherit hostname-debian iw wirelesstools;
   };
diff --git a/pkgs/additional/sane-scripts/default.nix b/pkgs/additional/sane-scripts/default.nix
index db2ea16d..7fa5036a 100644
--- a/pkgs/additional/sane-scripts/default.nix
+++ b/pkgs/additional/sane-scripts/default.nix
@@ -35,172 +35,172 @@ let
     # and is made available through `sane-scripts.passthru`
     backup-ls = static-nix-shell.mkBash {
       pname = "sane-backup-ls";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "duplicity" ];
     };
     backup-restore = static-nix-shell.mkBash {
       pname = "sane-backup-restore";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "duplicity" ];
     };
     bt-add = static-nix-shell.mkPython3Bin {
       pname = "sane-bt-add";
-      src = ./src;
+      srcRoot = ./src;
       pyPkgs = [ "requests" "sane-lib.bt" ];
       pkgs = [ "sane-scripts.lib.bt.propagatedBuildInputs" ];
     };
     bt-rm = static-nix-shell.mkPython3Bin {
       pname = "sane-bt-rm";
-      src = ./src;
+      srcRoot = ./src;
       pyPkgs = [ "sane-lib.bt" ];
       pkgs = [ "sane-scripts.lib.bt.propagatedBuildInputs" ];
     };
     bt-search = static-nix-shell.mkPython3Bin {
       pname = "sane-bt-search";
-      src = ./src;
+      srcRoot = ./src;
       pyPkgs = [ "natsort" "requests" ];
     };
     bt-show = static-nix-shell.mkPython3Bin {
       pname = "sane-bt-show";
-      src = ./src;
+      srcRoot = ./src;
       pyPkgs = [ "sane-lib.bt" ];
       pkgs = [ "sane-scripts.lib.bt.propagatedBuildInputs" ];
     };
     clone = static-nix-shell.mkBash {
       pname = "sane-clone";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "nix" ];
     };
     deadlines = static-nix-shell.mkBash {
       pname = "sane-deadlines";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "coreutils-full" "gnused" ];
     };
     dev-cargo-loop = static-nix-shell.mkBash {
       pname = "sane-dev-cargo-loop";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "inotify-tools" "ncurses" ];
     };
     find-dotfiles = static-nix-shell.mkBash {
       pname = "sane-find-dotfiles";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "findutils" ];
     };
     ip-check = static-nix-shell.mkPython3Bin {
       pname = "sane-ip-check";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "miniupnpc" ];
       pyPkgs = [ "requests" "sane-lib.ssdp" ];
     };
     ip-port-forward = static-nix-shell.mkPython3Bin {
       pname = "sane-ip-port-forward";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "inetutils" "miniupnpc" ];
       pyPkgs = [ "sane-lib.ssdp" ];
     };
     private-change-passwd = static-nix-shell.mkBash {
       pname = "sane-private-change-passwd";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "gocryptfs" "rsync" ];
     };
     private-do = static-nix-shell.mkBash {
       pname = "sane-private-do";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "util-linux" ];
     };
     private-init = static-nix-shell.mkBash {
       pname = "sane-private-init";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "gocryptfs" ];
     };
     private-lock = static-nix-shell.mkBash {
       pname = "sane-private-lock";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "util-linux.mount" ];
     };
     private-unlock = static-nix-shell.mkBash {
       pname = "sane-private-unlock";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "util-linux.mount" ];
     };
     rcp = static-nix-shell.mkBash {
       pname = "sane-rcp";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "rsync" ];
     };
     reboot = static-nix-shell.mkBash {
       pname = "sane-reboot";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "nettools" "systemd" ];
     };
     reclaim-boot-space = static-nix-shell.mkPython3Bin {
       pname = "sane-reclaim-boot-space";
-      src = ./src;
+      srcRoot = ./src;
     };
     reclaim-disk-space = static-nix-shell.mkBash {
       pname = "sane-reclaim-disk-space";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "nix" ];
     };
     secrets-dump = static-nix-shell.mkBash {
       pname = "sane-secrets-dump";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "gnugrep" "sops" "oath-toolkit" ];
     };
     secrets-unlock = static-nix-shell.mkBash {
       pname = "sane-secrets-unlock";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "coreutils-full" "openssh" "ssh-to-age" ];
     };
     secrets-update-keys = static-nix-shell.mkBash {
       pname = "sane-secrets-update-keys";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "coreutils-full" "findutils" "sops" ];
     };
     shutdown = static-nix-shell.mkBash {
       pname = "sane-shutdown";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "nettools" "systemd" ];
     };
     stop-all-servo = static-nix-shell.mkBash {
       pname = "sane-stop-all-servo";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "systemd" ];
     };
     sudo-redirect = static-nix-shell.mkBash {
       pname = "sane-sudo-redirect";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "coreutils-full" ];
     };
     sync-from-iphone = static-nix-shell.mkZsh {
       pname = "sane-sync-from-iphone";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "coreutils-full" "ifuse" "rsync" ];
     };
     sync-music = static-nix-shell.mkPython3Bin {
       pname = "sane-sync-music";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "ffmpeg" "sox" ];
       pyPkgs = [ "unidecode" ];
     };
     tag-music = static-nix-shell.mkPython3Bin {
       pname = "sane-tag-music";
-      src = ./src;
+      srcRoot = ./src;
       pyPkgs = [ "mutagen" ];
     };
     vpn = static-nix-shell.mkBash {
       pname = "sane-vpn";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "coreutils-full" "sane-scripts.ip-check" ];
     };
     which = static-nix-shell.mkBash {
       pname = "sane-which";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "coreutils-full" "file" ];
     };
     wipe = static-nix-shell.mkBash {
       pname = "sane-wipe";
-      src = ./src;
+      srcRoot = ./src;
       pkgs = [ "dconf" "libsecret" "systemd" ];
     };
   };