diff --git a/hosts/common/default.nix b/hosts/common/default.nix
index d3cd574b..58b07522 100644
--- a/hosts/common/default.nix
+++ b/hosts/common/default.nix
@@ -7,12 +7,13 @@
     ./net.nix
     ./secrets.nix
     ./ssh.nix
-    ./system-packages.nix
     ./users.nix
     ./vpn.nix
   ];
 
   sane.nixcache.enable-trusted-keys = true;
+  sane.packages.enableConsolePkgs = true;
+  sane.packages.enableSystemPkgs = true;
 
   nixpkgs.config.allowUnfree = true;
 }
diff --git a/hosts/common/system-packages.nix b/hosts/common/system-packages.nix
deleted file mode 100644
index 01d58fd3..00000000
--- a/hosts/common/system-packages.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ pkgs, ... }:
-{
-  # general-purpose utilities that we want any user to be able to access
-  #   (specifically: root, in case of rescue)
-  environment.systemPackages = with pkgs; [
-    btrfs-progs
-    cryptsetup
-    dig
-    efibootmgr
-    fatresize
-    fd
-    file
-    gptfdisk
-    hdparm
-    htop
-    iftop
-    inetutils  # for telnet
-    iotop
-    iptables
-    jq
-    killall
-    lsof
-    netcat
-    nethogs
-    nmap
-    openssl
-    parted
-    pciutils
-    powertop
-    ripgrep
-    screen
-    smartmontools
-    socat
-    usbutils
-    wget
-  ];
-}
-
diff --git a/modules/packages.nix b/modules/packages.nix
index a49720f9..7c0472e0 100644
--- a/modules/packages.nix
+++ b/modules/packages.nix
@@ -4,7 +4,7 @@ with lib;
 with pkgs;
 let
   cfg = config.sane.packages;
-  universalPkgs = [
+  consolePkgs = [
     backblaze-b2
     cdrtools
     duplicity
@@ -168,6 +168,41 @@ let
     { pkg = zecwallet-lite; dir = ".zcash"; }
   ] else []);
 
+  # general-purpose utilities that we want any user to be able to access
+  #   (specifically: root, in case of rescue)
+  systemPkgs = [
+    btrfs-progs
+    cryptsetup
+    dig
+    efibootmgr
+    fatresize
+    fd
+    file
+    gptfdisk
+    hdparm
+    htop
+    iftop
+    inetutils  # for telnet
+    iotop
+    iptables
+    jq
+    killall
+    lsof
+    netcat
+    nethogs
+    nmap
+    openssl
+    parted
+    pciutils
+    powertop
+    ripgrep
+    screen
+    smartmontools
+    socat
+    usbutils
+    wget
+  ];
+
   # useful devtools:
   devPkgs = [
     bison
@@ -186,6 +221,10 @@ let
 in
 {
   options = {
+    sane.packages.enableConsolePkgs = mkOption {
+      default = false;
+      type = types.bool;
+    };
     sane.packages.enableGuiPkgs = mkOption {
       default = false;
       type = types.bool;
@@ -198,10 +237,20 @@ in
       default = false;
       type = types.bool;
     };
+    sane.packages.enableSystemPkgs = mkOption {
+      default = false;
+      type = types.bool;
+      description = "enable system-wide packages";
+    };
   };
+
   config = {
-    sane.home-manager.extraPackages = universalPkgs
+    sane.home-manager.extraPackages = []
+      ++ (if cfg.enableConsolePkgs then consolePkgs else [])
       ++ (if cfg.enableGuiPkgs then guiPkgs else [])
-      ++ (if cfg.enableDevPkgs then devPkgs else []);
+      ++ (if cfg.enableDevPkgs then devPkgs else [])
+    ;
+
+    environment.systemPackages = mkIf cfg.enableSystemPkgs systemPkgs;
   };
 }