diff --git a/.drone.yml b/.drone.yml
index a170d5a2..7da733c4 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -107,13 +107,13 @@ steps:
         path: /var/nix/iso-cache
     settings:
       host:
-        from_secret: ssh_host
+        from_secret: iso_web_ssh_host
       user:
-        from_secret: ssh_user
+        from_secret: iso_web_ssh_user
       port:
-        from_secret: ssh_port
+        from_secret: iso_web_ssh_port
       key:
-        from_secret: ssh_key
+        from_secret: iso_web_ssh_key
       target: /srv/os
       source:
         - /var/nix/iso-cache/*.iso
@@ -134,6 +134,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 5d7c0ef5519ffe68189271b18d9084db55c9e14831f95234655f5387f9426db0
+hmac: 2b930bb5fe02006203b7c2fae8af75814749e8cec5f976ec0d6e64eae1b0c5db
 
 ...
diff --git a/flake.nix b/flake.nix
index ad0c767a..4bb0249f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -93,7 +93,10 @@
             imports = [ (digga.lib.importExportableModules ./modules) ];
             modules = [
               { lib.our = self.lib; }
-              digga.nixosModules.bootstrapIso
+              # FIXME: upstream module causes a huge number of unnecessary
+              # dependencies to be pulled in for all systems -- many of them are
+              # graphical. should only be imported as needed.
+              # digga.nixosModules.bootstrapIso
               digga.nixosModules.nixConfig
               home.nixosModules.home-manager
               agenix.nixosModules.age
@@ -103,6 +106,11 @@
           imports = [ (digga.lib.importHosts ./hosts) ];
           hosts = {
             /* set host specific properties here */
+            bootstrap = {
+              modules = [
+                digga.nixosModules.bootstrapIso
+              ];
+            };
             PubSolarOS = {
               tests = [
                 (import ./tests/first-test.nix { pkgs = nixos.legacyPackages.x86_64-linux; lib = nixos.lib; })
diff --git a/modules/sway/swayidle.service.nix b/modules/sway/swayidle.service.nix
index f10675fb..685d0f1d 100644
--- a/modules/sway/swayidle.service.nix
+++ b/modules/sway/swayidle.service.nix
@@ -12,11 +12,11 @@
     Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin";
     ExecStart = ''${pkgs.swayidle}/bin/swayidle -w \
         after-resume 'swaymsg "output * dpms on"' \
-        before-sleep 'swaylock-bg' '' + (if psCfg.paranoia.enable then '' \
+        before-sleep '${pkgs.swaylock-bg}/bin/swaylock-bg' '' + (if psCfg.paranoia.enable then '' \
         timeout 120 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"' \
         timeout 150 'systemctl hibernate'
       '' else '' \
-        timeout 600 'swaylock-bg'
+        timeout 600 '${pkgs.swaylock-bg}/bin/swaylock-bg' \
         timeout 900 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"'
       '');
   };
diff --git a/pkgs/swaylock-bg.nix b/pkgs/swaylock-bg.nix
index b55c32ae..75bcd7de 100644
--- a/pkgs/swaylock-bg.nix
+++ b/pkgs/swaylock-bg.nix
@@ -3,18 +3,17 @@ self: with self; ''
   # swaylock
 
   # Make sure we aren't running twice
-  RUNNING=$(ps -A | grep swaylock | wc -l)
-  if [ $RUNNING -ne 0 ]; then
+  RUNNING=$(${procps}/bin/pgrep -c ${swaylock}/bin/swaylock)
+  if [ "$RUNNING" -ne 0 ]; then
     exit 0
   fi
 
-  IMAGE=$XDG_CONFIG_HOME/wallpaper.jpg
+  IMAGE="$XDG_CONFIG_HOME/wallpaper.jpg"
   LOCKARGS=""
 
-  for OUTPUT in `${sway}/bin/swaymsg -t get_outputs | jq -r '.[].name'`
+  for OUTPUT in $(${sway}/bin/swaymsg -t get_outputs | ${jq}/bin/jq -r '.[].name')
   do
       LOCKARGS="''${LOCKARGS} --image ''${OUTPUT}:''${IMAGE}"
-      IMAGES="''${IMAGES} ''${IMAGE}"
   done
   exec ${swaylock}/bin/swaylock $LOCKARGS
 ''