diff --git a/flake-parts/dev-shell.nix b/flake-parts/dev-shell.nix
new file mode 100644
index 0000000..5318e8c
--- /dev/null
+++ b/flake-parts/dev-shell.nix
@@ -0,0 +1,12 @@
+_: {
+  perSystem =
+    { pkgs, ... }:
+    {
+      devShells.default = pkgs.mkShellNoCC {
+        packages = [
+          pkgs.just
+          pkgs.nh
+        ];
+      };
+    };
+}
diff --git a/flake-parts/lib.nix b/flake-parts/lib.nix
index 5922d99..97d0fee 100644
--- a/flake-parts/lib.nix
+++ b/flake-parts/lib.nix
@@ -1,19 +1,7 @@
-{ self, lib, ... }:
+{ self, inputs, ... }:
 {
-  flake.lib = {
-    isPrivateDomain = domain: domain |> lib.hasSuffix ".splitleaf.de";
-
-    listNixFilesRecursively =
-      dir: dir |> lib.filesystem.listFilesRecursive |> lib.filter (lib.hasSuffix ".nix");
-
-    listDirectoryNames =
-      path: path |> builtins.readDir |> lib.filterAttrs (_: type: type == "directory") |> lib.attrNames;
-
-    genAttrs = f: names: lib.genAttrs names f;
-
-    mkUnprotectedMessage =
-      name: "${name} should only be exposed on private networks; access control isn't yet configured";
-
-    relativePath = path: path |> toString |> lib.removePrefix "${self}/";
+  flake.lib = import "${self}/lib" {
+    inherit (inputs.nixpkgs) lib;
+    inherit self;
   };
 }
diff --git a/flake.lock b/flake.lock
index 3625521..4aa9abf 100644
--- a/flake.lock
+++ b/flake.lock
@@ -87,11 +87,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1770091431,
-        "narHash": "sha256-9Sqq/hxq8ZDLRSzu+edn0OfWG+FAPWFpwMKaJobeLec=",
+        "lastModified": 1769832227,
+        "narHash": "sha256-hpfniy1borNcmVUr+I3iamwT9KB+1rXfT8QWVF6rs2Q=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "4f827ff035c6ddc58d04c45abe5b777d356b926a",
+        "rev": "aaa750c668f39351876b9c94a62ffecc3428aee8",
         "type": "gitlab"
       },
       "original": {
@@ -122,11 +122,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1769996383,
-        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "lastModified": 1768135262,
+        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
         "type": "github"
       },
       "original": {
@@ -247,11 +247,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1769909678,
-        "narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=",
+        "lastModified": 1765674936,
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "72716169fe93074c333e8d0173151350670b824c",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
         "type": "github"
       },
       "original": {
@@ -262,11 +262,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1770115704,
-        "narHash": "sha256-KHFT9UWOF2yRPlAnSXQJh6uVcgNcWlFqqiAZ7OVlHNc=",
+        "lastModified": 1769461804,
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e6eae2ee2110f3d31110d5c222cd395303343b08",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
         "type": "github"
       },
       "original": {
@@ -278,11 +278,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1770136044,
-        "narHash": "sha256-tlFqNG/uzz2++aAmn4v8J0vAkV3z7XngeIIB3rM3650=",
+        "lastModified": 1769598131,
+        "narHash": "sha256-e7VO/kGLgRMbWtpBqdWl0uFg8Y2XWFMdz0uUJvlML8o=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e576e3c9cf9bad747afcddd9e34f51d18c855b4e",
+        "rev": "fa83fd837f3098e3e678e6cf017b2b36102c7211",
         "type": "github"
       },
       "original": {
@@ -334,11 +334,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770145881,
-        "narHash": "sha256-ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=",
+        "lastModified": 1769469829,
+        "narHash": "sha256-wFcr32ZqspCxk4+FvIxIL0AZktRs6DuF8oOsLt59YBU=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c",
+        "rev": "c5eebd4eb2e3372fe12a8d70a248a6ee9dd02eff",
         "type": "github"
       },
       "original": {
@@ -389,11 +389,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770086828,
-        "narHash": "sha256-mufcsiTsh04F5pocBQcdKWjIah0YwFGtM57UXXmiBm4=",
+        "lastModified": 1769826952,
+        "narHash": "sha256-8CpJxXwRyN8gSzjT0e4QjWPwVs/W0uHRJ6fEPGaTk7I=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "4badc6c89256856f3537d05e14dce64674f39382",
+        "rev": "2b93cd3f310d6a9d24ccfc154740d591288d6754",
         "type": "github"
       },
       "original": {
diff --git a/lib/default.nix b/lib/default.nix
new file mode 100644
index 0000000..29e074a
--- /dev/null
+++ b/lib/default.nix
@@ -0,0 +1,20 @@
+{
+  lib,
+  self,
+}:
+{
+  isPrivateDomain = domain: domain |> lib.hasSuffix ".splitleaf.de";
+
+  listNixFilesRecursively =
+    dir: dir |> lib.filesystem.listFilesRecursive |> lib.filter (lib.hasSuffix ".nix");
+
+  listDirectoryNames =
+    path: path |> builtins.readDir |> lib.filterAttrs (_: type: type == "directory") |> lib.attrNames;
+
+  genAttrs = f: names: lib.genAttrs names f;
+
+  mkUnprotectedMessage =
+    name: "${name} should only be exposed on private networks; access control isn't yet configured";
+
+  relativePath = path: path |> toString |> lib.removePrefix "${self}/";
+}