{
  pkgs,
  inputs,
  self,
  ...
}:
let
  targetSystem =
    self.nixosConfigurations.rhemawavekiosk-dev.config.system.build.toplevel;

  # 🔧 FIX: prebuilt disko script (restores v1.0.1 behavior)
  diskoScript =
    self.nixosConfigurations.rhemawavekiosk-dev.config.system.build.diskoScript;
in
{
  nix.settings = {
    experimental-features = [
      "nix-command"
      "flakes"
    ];

    # 🔧 FIX: restore cache (prevents massive rebuild/download cascade)
    substituters = [
      "https://cache.nixos.org"
    ];

    flake-registry = "";
  };

  nix.registry.nixpkgs = pkgs.lib.mkForce {
    to = {
      type = "path";
      path = "${inputs.nixpkgs}";
    };
  };

  environment.variables.KIOSK_FLAKE = "${self}";

  virtualisation.vmVariant = {
    virtualisation.memorySize = 8096;
    virtualisation.diskSize = 100000;
    virtualisation.cores = 4;
    virtualisation.qemu.options = [
      # "-nic none"
    ];
    virtualisation.forwardPorts = [
      { from = "host"; host.port = 2222; guest.port = 22; }
    ];
  };

  environment.etc."nix/netrc" = {
    text = ''
      password eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjIwODgzODk2ODEsIm5iZiI6MTc3MjgxMzY4MSwic3ViIjoia2lvc2siLCJodHRwczovL2p3dC5hdHRpYy5ycy92MSI6eyJjYWNoZXMiOnsia2lvc2siOnsiciI6MX19fX0.N6Ktrmmu1LSy2PP8uNF25VHRP1dxPZJ4M0MR1kUpVi0
    '';
    mode = "0400";
  };

  nix.extraOptions = ''
    netrc-file = /etc/nix/netrc
  '';

  networking.networkmanager.enable = true;

  systemd.services.NetworkManager-wait-online.enable = false;

  nix.settings.connect-timeout = 0;

  services.openssh.enable = true;

  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4vXx7sOOVAyxdS/N1LEI+L8wYICf+gbzs6Kz7K8Je5 cnclack@pm.me:Thinkpad"
  ];

  systemd.services.zero-touch-install = {
    description = "Zero-Touch Kiosk Installation";

    wantedBy = [ "multi-user.target" ];

    # 🔧 FIX: remove runtime network dependency
    wants = [ ];
    after = [ "systemd-udev-settle.service" ];

    path = with pkgs; [
      nix
      git
      util-linux
      nixos-install-tools
      curl
      networkmanager
      mount
      umount
      disko
    ];

    environment = {
      NIX_PATH = "nixpkgs=${inputs.nixpkgs}";
      KIOSK_FLAKE = "${self}";
      DISKO_SCRIPT = "${diskoScript}";
    };

    script = ''
      set -euo pipefail

      DISK=/dev/vda

      echo "Running disko script..."
      echo "Script: $DISKO_SCRIPT"

      # 🔧 FIX: use prebuilt script instead of runtime disko eval
      ${diskoScript}

      echo "Installing RhemaWave"
      echo "Closure Path: ${targetSystem}"

      nixos-install \
        --system "${targetSystem}" \
        --no-root-passwd \
        --no-channel-copy

      echo "============================================"
      echo " Installation complete!"
      echo " Rebooting in 5 seconds..."
      echo "============================================"
      sleep 5
      systemctl reboot --force
    '';
  };
}