diff --git a/doc/install-nixos.md b/doc/install-nixos.md
index a1a731d..0d10571 100644
--- a/doc/install-nixos.md
+++ b/doc/install-nixos.md
@@ -10,7 +10,7 @@ build compiles everything: the dependency build is kept in the local
 Nix store and reused, so following the repository rebuilds just the
 ReFineID crates.
 
-## Fresh machine, shortest path
+## Fresh machine, shortest path (not recommended)
 
 Add to `/etc/nixos/configuration.nix`:
 
@@ -20,10 +20,12 @@ Add to `/etc/nixos/configuration.nix`:
     ((builtins.getFlake "github:ReFineID/ReFineID-Unix").nixosModules.default)
   ];
   programs.refineid.enable = true;
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-  # Keep the dependency build in the store across garbage collection,
-  # so updates never recompile more than the ReFineID crates.
-  nix.settings.keep-outputs = true;
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    # Keep the dependency build in the store across garbage collection,
+    # so updates never recompile more than the ReFineID crates.
+    keep-outputs = true;
+  };
 ```
 
 Browser card login needs `programs.firefox.enable = true;` -- already
@@ -70,8 +72,8 @@ system configuration).
 
 ## 1. System-wide install (recommended)
 
-Works on any NixOS 26.05 or newer with flakes enabled. Flakes are on
-by default on recent installs; if not, add to
+Works on any NixOS 26.05 or newer with flakes enabled.
+If flakes are not enabled, add to
 `/etc/nixos/configuration.nix`:
 
 ```nix
@@ -86,7 +88,10 @@ Add the input and the module to your system flake:
 {
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
-    refineid.url = "github:ReFineID/ReFineID-Unix";
+    refineid = {
+      url = "github:ReFineID/ReFineID-Unix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = { nixpkgs, refineid, ... }: {
@@ -129,7 +134,7 @@ in
 `fetchTarball`.) Then:
 
 ```sh
-sudo nixos-rebuild switch
+sudo NIX_CONFIG="experimental-features = nix-command flakes" nixos-rebuild switch
 ```
 
 ### What the option does
@@ -177,14 +182,16 @@ rest lives in that user's profile. In `/etc/nixos/configuration.nix`:
 
 ```nix
   services.pcscd.enable = true;
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-  nix.settings.keep-outputs = true;
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    keep-outputs = true;
+  };
 ```
 
 then, as the user:
 
 ```sh
-nix profile install github:ReFineID/ReFineID-Unix
+nix profile add github:ReFineID/ReFineID-Unix
 ```
 
 That user gets the `refineid` CLI and the GUI, application-menu
diff --git a/flake.nix b/flake.nix
index c335cea..c7c6e9c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,7 +9,11 @@
   };
 
   outputs =
-    { self, nixpkgs, crane }:
+    {
+      self,
+      nixpkgs,
+      crane,
+    }:
     let
       systems = [
         "x86_64-linux"
@@ -24,37 +28,15 @@
         default = refineid;
       });
 
-      nixosModules.refineid = import ./nix/module.nix { refineidPackage = packageFor; };
-      nixosModules.default = self.nixosModules.refineid;
+      nixosModules = {
+        refineid = import ./nix/module.nix { refineidPackage = packageFor; };
+        default = self.nixosModules.refineid;
+      };
 
       overlays.default = final: prev: { refineid = packageFor final; };
 
       devShells = forAllSystems (pkgs: {
-        default = pkgs.mkShell {
-          inputsFrom = [ (packageFor pkgs) ];
-          packages = with pkgs; [
-            clippy
-            rustfmt
-            pcsc-tools # pcsc_scan for reader debugging
-            opensc # pkcs11-tool for module debugging
-            nss.tools # tstclnt/certutil/modutil for the hardware cert-auth rig
-          ];
-          # The GUI dlopens the windowing/GL stack; a dev build has no
-          # baked rpath, so provide the libraries via the environment.
-          LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath (
-            with pkgs;
-            [
-              libGL
-              libxkbcommon
-              wayland
-              gtk3
-              libx11
-              libxcursor
-              libxi
-              libxrandr
-            ]
-          );
-        };
+        default = import ./shell.nix { inherit pkgs; };
       });
     };
 }
diff --git a/nix/module.nix b/nix/module.nix
index 80a9f28..17938be 100644
--- a/nix/module.nix
+++ b/nix/module.nix
@@ -49,11 +49,8 @@ in
 
     # System-wide p11-kit registration: OpenSSL (pkcs11-provider),
     # GnuTLS, and OpenSSH discover the card through p11-kit.
-    environment.etc."pkcs11/modules/refineid.module".text = ''
-      module: ${cfg.package}/lib/librefineid_pkcs11.so
-      trust-policy: no
-      critical: no
-    '';
+    environment.etc."pkcs11/modules/refineid.module".source =
+      "${cfg.package}/share/p11-kit/modules/refineid.module";
 
     # Firefox does not consult p11-kit on NixOS; the enterprise
     # policy loads the module directly.
diff --git a/shell.nix b/shell.nix
index 3bed2c0..30b5562 100644
--- a/shell.nix
+++ b/shell.nix
@@ -12,6 +12,8 @@ pkgs.mkShell {
     opensc # pkcs11-tool for module debugging
     nss.tools # tstclnt/certutil/modutil for the hardware cert-auth rig
   ];
+  # The GUI dlopens the windowing/GL stack; a dev build has no
+  # baked rpath, so provide the libraries via the environment.
   LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath (
     with pkgs;
     [