diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index dd1a099ac1f2..510680a11c2a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -616,8 +616,14 @@ in
   pyload = runTest ./pyload.nix;
   oci-containers = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./oci-containers.nix { };
   odoo = runTest ./odoo.nix;
-  odoo17 = handleTest ./odoo.nix { package = pkgs.odoo17; };
-  odoo16 = handleTest ./odoo.nix { package = pkgs.odoo16; };
+  odoo17 = runTest {
+    imports = [ ./odoo.nix ];
+    _module.args.package = pkgs.odoo17;
+  };
+  odoo16 = runTest {
+    imports = [ ./odoo.nix ];
+    _module.args.package = pkgs.odoo16;
+  };
   oncall = runTest ./web-apps/oncall.nix;
   # 9pnet_virtio used to mount /nix partition doesn't support
   # hibernation. This test happens to work on x86_64-linux but
@@ -1297,8 +1303,9 @@ in
   systemd-initrd-btrfs-raid = runTest ./systemd-initrd-btrfs-raid.nix;
   systemd-initrd-luks-fido2 = runTest ./systemd-initrd-luks-fido2.nix;
   systemd-initrd-luks-keyfile = runTest ./systemd-initrd-luks-keyfile.nix;
-  systemd-initrd-luks-empty-passphrase = handleTest ./initrd-luks-empty-passphrase.nix {
-    systemdStage1 = true;
+  systemd-initrd-luks-empty-passphrase = runTest {
+    imports = [ ./initrd-luks-empty-passphrase.nix ];
+    _module.args.systemdStage1 = true;
   };
   systemd-initrd-luks-password = runTest ./systemd-initrd-luks-password.nix;
   systemd-initrd-luks-tpm2 = runTest ./systemd-initrd-luks-tpm2.nix;
@@ -1310,7 +1317,10 @@ in
     "x86_64-linux"
     "i686-linux"
   ] ./initrd-network-openvpn { systemdStage1 = true; };
-  systemd-initrd-shutdown = handleTest ./systemd-shutdown.nix { systemdStage1 = true; };
+  systemd-initrd-shutdown = runTest {
+    imports = [ ./systemd-shutdown.nix ];
+    _module.args.systemdStage1 = true;
+  };
   systemd-initrd-simple = runTest ./systemd-initrd-simple.nix;
   systemd-initrd-swraid = runTest ./systemd-initrd-swraid.nix;
   systemd-initrd-vconsole = runTest ./systemd-initrd-vconsole.nix;
diff --git a/nixos/tests/breitbandmessung.nix b/nixos/tests/breitbandmessung.nix
index 809a995cfcc5..3b5ba5584af6 100644
--- a/nixos/tests/breitbandmessung.nix
+++ b/nixos/tests/breitbandmessung.nix
@@ -3,6 +3,8 @@
   name = "breitbandmessung";
   meta.maintainers = with lib.maintainers; [ b4dm4n ];
 
+  node.pkgsReadOnly = false;
+
   nodes.machine =
     { pkgs, ... }:
     {
diff --git a/nixos/tests/brscan5.nix b/nixos/tests/brscan5.nix
index af70f362cb92..9155846c14a8 100644
--- a/nixos/tests/brscan5.nix
+++ b/nixos/tests/brscan5.nix
@@ -1,34 +1,30 @@
 # integration tests for brscan5 sane driver
-#
-
-{ pkgs, ... }:
+{ lib, ... }:
 {
   name = "brscan5";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ mattchrist ];
-  };
+  meta.maintainers = with lib.maintainers; [ mattchrist ];
 
-  nodes.machine =
-    { pkgs, ... }:
-    {
-      nixpkgs.config.allowUnfree = true;
-      hardware.sane = {
+  node.pkgsReadOnly = false;
+
+  nodes.machine = {
+    nixpkgs.config.allowUnfree = true;
+    hardware.sane = {
+      enable = true;
+      brscan5 = {
         enable = true;
-        brscan5 = {
-          enable = true;
-          netDevices = {
-            "a" = {
-              model = "ADS-1200";
-              nodename = "BRW0080927AFBCE";
-            };
-            "b" = {
-              model = "ADS-1200";
-              ip = "192.168.1.2";
-            };
+        netDevices = {
+          "a" = {
+            model = "ADS-1200";
+            nodename = "BRW0080927AFBCE";
+          };
+          "b" = {
+            model = "ADS-1200";
+            ip = "192.168.1.2";
           };
         };
       };
     };
+  };
 
   testScript = ''
     import re
diff --git a/nixos/tests/consul.nix b/nixos/tests/consul.nix
index 8dc141b674f7..da72d1d132bd 100644
--- a/nixos/tests/consul.nix
+++ b/nixos/tests/consul.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ lib, ... }:
 
 let
   # Settings for both servers and agents
@@ -117,6 +117,8 @@ in
 {
   name = "consul";
 
+  node.pkgsReadOnly = false;
+
   nodes = {
     server1 = server 0;
     server2 = server 1;
diff --git a/nixos/tests/deconz.nix b/nixos/tests/deconz.nix
index ea0e19a74683..6272e44ff77c 100644
--- a/nixos/tests/deconz.nix
+++ b/nixos/tests/deconz.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ lib, ... }:
 let
   httpPort = 800;
 in
@@ -9,24 +9,19 @@ in
     bjornfor
   ];
 
-  nodes.machine =
-    {
-      config,
-      pkgs,
-      lib,
-      ...
-    }:
-    {
-      nixpkgs.config.allowUnfree = true;
-      services.deconz = {
-        enable = true;
-        inherit httpPort;
-        extraArgs = [
-          "--dbg-err=2"
-          "--dbg-info=2"
-        ];
-      };
+  node.pkgsReadOnly = false;
+
+  nodes.machine = {
+    nixpkgs.config.allowUnfree = true;
+    services.deconz = {
+      enable = true;
+      inherit httpPort;
+      extraArgs = [
+        "--dbg-err=2"
+        "--dbg-info=2"
+      ];
     };
+  };
 
   testScript = ''
     machine.wait_for_unit("deconz.service")
diff --git a/nixos/tests/discourse.nix b/nixos/tests/discourse.nix
index 8db47f2b1ad1..cff71f17a134 100644
--- a/nixos/tests/discourse.nix
+++ b/nixos/tests/discourse.nix
@@ -4,9 +4,9 @@
 #  3. replying to that message via email.
 
 {
+  package,
   pkgs,
   lib,
-  package ? pkgs.discourse,
   ...
 }:
 let
@@ -24,9 +24,9 @@ let
 in
 {
   name = "discourse";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ talyz ];
-  };
+  meta.maintainers = with lib.maintainers; [ talyz ];
+
+  _module.args.package = lib.mkDefault pkgs.discourse;
 
   nodes.discourse =
     { nodes, ... }:
@@ -62,7 +62,7 @@ in
 
       services.discourse = {
         enable = true;
-        inherit admin package;
+        inherit admin;
         hostname = discourseDomain;
         sslCertificate = "${certs.${discourseDomain}.cert}";
         sslCertificateKey = "${certs.${discourseDomain}.key}";
diff --git a/nixos/tests/fanout.nix b/nixos/tests/fanout.nix
index 8a75d51e07a6..797a679b9b0c 100644
--- a/nixos/tests/fanout.nix
+++ b/nixos/tests/fanout.nix
@@ -1,28 +1,15 @@
-{
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-}:
-{ lib, pkgs, ... }:
+{ lib, ... }:
 {
   name = "fanout";
-  meta.maintainers = [ lib.maintainers.therishidesai ];
+  meta.maintainers = with lib.maintainers; [ therishidesai ];
 
-  nodes =
-    let
-      cfg =
-        { ... }:
-        {
-          services.fanout = {
-            enable = true;
-            fanoutDevices = 2;
-            bufferSize = 8192;
-          };
-        };
-    in
-    {
-      machine = cfg;
+  nodes.machine = {
+    services.fanout = {
+      enable = true;
+      fanoutDevices = 2;
+      bufferSize = 8192;
     };
+  };
 
   testScript = ''
     start_all()
diff --git a/nixos/tests/gnome-extensions.nix b/nixos/tests/gnome-extensions.nix
index fa20d5e7e840..0bd77dab1819 100644
--- a/nixos/tests/gnome-extensions.nix
+++ b/nixos/tests/gnome-extensions.nix
@@ -3,6 +3,8 @@
   name = "gnome-extensions";
   meta.maintainers = [ ];
 
+  node.pkgsReadOnly = false;
+
   nodes.machine =
     { pkgs, ... }:
     {
@@ -21,16 +23,14 @@
 
       # Configure GDM
       services.xserver.enable = true;
-      services.xserver.displayManager = {
-        gdm = {
-          enable = true;
-          debug = true;
-          wayland = true;
-        };
-        autoLogin = {
-          enable = true;
-          user = "alice";
-        };
+      services.xserver.displayManager.gdm = {
+        enable = true;
+        debug = true;
+        wayland = true;
+      };
+      services.displayManager.autoLogin = {
+        enable = true;
+        user = "alice";
       };
 
       # Configure Gnome
diff --git a/nixos/tests/initrd-luks-empty-passphrase.nix b/nixos/tests/initrd-luks-empty-passphrase.nix
index e9f4a1776d52..47215c4bc998 100644
--- a/nixos/tests/initrd-luks-empty-passphrase.nix
+++ b/nixos/tests/initrd-luks-empty-passphrase.nix
@@ -1,22 +1,21 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-  systemdStage1 ? false,
+  systemdStage1,
+  lib,
+  pkgs,
+  ...
 }:
-{ lib, pkgs, ... }:
 let
-
   keyfile = pkgs.writeText "luks-keyfile" ''
     MIGHAoGBAJ4rGTSo/ldyjQypd0kuS7k2OSsmQYzMH6TNj3nQ/vIUjDn7fqa3slt2
     gV6EK3TmTbGc4tzC1v4SWx2m+2Bjdtn4Fs4wiBwn1lbRdC6i5ZYCqasTWIntWn+6
     FllUkMD5oqjOR/YcboxG8Z3B5sJuvTP9llsF+gnuveWih9dpbBr7AgEC
   '';
-
 in
 {
   name = "initrd-luks-empty-passphrase";
 
+  _module.args.systemdStage1 = lib.mkDefault false;
+
   nodes.machine =
     { pkgs, ... }:
     {
diff --git a/nixos/tests/minecraft-server.nix b/nixos/tests/minecraft-server.nix
index 3630025ec224..32d4619cd5cd 100644
--- a/nixos/tests/minecraft-server.nix
+++ b/nixos/tests/minecraft-server.nix
@@ -3,12 +3,12 @@ let
   rcon-pass = "foobar";
   rcon-port = 43000;
 in
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 {
   name = "minecraft-server";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ nequissimus ];
-  };
+  meta.maintainers = with lib.maintainers; [ nequissimus ];
+
+  node.pkgsReadOnly = false;
 
   nodes.server =
     { ... }:
diff --git a/nixos/tests/odoo.nix b/nixos/tests/odoo.nix
index 7749fec7f3d9..a36a7a5b9801 100644
--- a/nixos/tests/odoo.nix
+++ b/nixos/tests/odoo.nix
@@ -1,37 +1,33 @@
 {
-  pkgs,
+  package,
   lib,
-  package ? pkgs.odoo,
+  pkgs,
   ...
 }:
 {
   name = "odoo";
   meta.maintainers = with lib.maintainers; [ mkg20001 ];
 
-  nodes = {
-    server =
-      { ... }:
-      {
-        services.nginx = {
-          enable = true;
-          recommendedProxySettings = true;
-        };
+  _module.args.package = lib.mkDefault pkgs.odoo;
 
-        services.odoo = {
-          enable = true;
-          package = package;
-          autoInit = true;
-          autoInitExtraFlags = [ "--without-demo=all" ];
-          domain = "localhost";
-        };
-      };
+  nodes.server = {
+    services.nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+    };
+
+    services.odoo = {
+      enable = true;
+      package = package;
+      autoInit = true;
+      autoInitExtraFlags = [ "--without-demo=all" ];
+      domain = "localhost";
+    };
   };
 
-  testScript =
-    { nodes, ... }:
-    ''
-      server.wait_for_unit("odoo.service")
-      server.wait_until_succeeds("curl -s http://localhost:8069/web/database/selector | grep '<title>Odoo</title>'")
-      server.succeed("curl -s http://localhost/web/database/selector | grep '<title>Odoo</title>'")
-    '';
+  testScript = ''
+    server.wait_for_unit("odoo.service")
+    server.wait_until_succeeds("curl -s http://localhost:8069/web/database/selector | grep '<title>Odoo</title>'")
+    server.succeed("curl -s http://localhost/web/database/selector | grep '<title>Odoo</title>'")
+  '';
 }
diff --git a/nixos/tests/openldap.nix b/nixos/tests/openldap.nix
index 49af853cb9a3..b1b196d9c5ec 100644
--- a/nixos/tests/openldap.nix
+++ b/nixos/tests/openldap.nix
@@ -54,7 +54,7 @@ in
   name = "openldap";
 
   nodes.machine =
-    { pkgs, ... }:
+    { config, pkgs, ... }:
     {
       environment.etc."openldap/root_password".text = "notapassword";
 
@@ -124,6 +124,8 @@ in
           configuration =
             { ... }:
             {
+              nixpkgs.hostPlatform = config.nixpkgs.hostPlatform;
+
               users.ldap = ldapClientConfig;
               services.openldap = {
                 enable = true;
@@ -133,6 +135,7 @@ in
         };
       };
     };
+
   testScript =
     { nodes, ... }:
     let
diff --git a/nixos/tests/outline.nix b/nixos/tests/outline.nix
index 4beb58a3c408..e2691c205056 100644
--- a/nixos/tests/outline.nix
+++ b/nixos/tests/outline.nix
@@ -15,28 +15,28 @@ in
 
   meta.maintainers = lib.teams.cyberus.members;
 
-  nodes = {
-    outline =
-      { pkgs, config, ... }:
-      {
-        nixpkgs.config.allowUnfree = true;
-        environment.systemPackages = [ pkgs.minio-client ];
-        services.outline = {
-          enable = true;
-          forceHttps = false;
-          storage = {
-            inherit accessKey secretKeyFile;
-            uploadBucketUrl = "http://localhost:9000";
-            uploadBucketName = "outline";
-            region = config.services.minio.region;
-          };
-        };
-        services.minio = {
-          enable = true;
-          inherit rootCredentialsFile;
+  node.pkgsReadOnly = false;
+
+  nodes.outline =
+    { pkgs, config, ... }:
+    {
+      nixpkgs.config.allowUnfree = true;
+      environment.systemPackages = [ pkgs.minio-client ];
+      services.outline = {
+        enable = true;
+        forceHttps = false;
+        storage = {
+          inherit accessKey secretKeyFile;
+          uploadBucketUrl = "http://localhost:9000";
+          uploadBucketName = "outline";
+          region = config.services.minio.region;
         };
       };
-  };
+      services.minio = {
+        enable = true;
+        inherit rootCredentialsFile;
+      };
+    };
 
   testScript = ''
     machine.wait_for_unit("minio.service")
diff --git a/nixos/tests/quake3.nix b/nixos/tests/quake3.nix
index d56be93890a9..67867796be56 100644
--- a/nixos/tests/quake3.nix
+++ b/nixos/tests/quake3.nix
@@ -1,7 +1,5 @@
-{ pkgs, lib, ... }:
-
+{ lib, ... }:
 let
-
   # Build Quake with coverage instrumentation.
   overrides = pkgs: {
     quake3game = pkgs.quake3game.override (args: {
@@ -23,7 +21,6 @@ let
 
   client =
     { pkgs, ... }:
-
     {
       imports = [ ./common/x11.nix ];
       hardware.graphics.enable = true;
@@ -31,14 +28,12 @@ let
       nixpkgs.config.packageOverrides = overrides;
       nixpkgs.config.allowUnfreePredicate = unfreePredicate;
     };
-
 in
-
-rec {
+{
   name = "quake3";
-  meta = with lib.maintainers; {
-    maintainers = [ domenkozar ];
-  };
+  meta.maintainers = with lib.maintainers; [ domenkozar ];
+
+  node.pkgsReadOnly = false;
 
   # TODO: lcov doesn't work atm
   #makeCoverageReport = true;
@@ -46,7 +41,6 @@ rec {
   nodes = {
     server =
       { pkgs, ... }:
-
       {
         systemd.services.quake3-server = {
           wantedBy = [ "multi-user.target" ];
@@ -96,5 +90,4 @@ rec {
     client2.shutdown()
     server.stop_job("quake3-server")
   '';
-
 }
diff --git a/nixos/tests/sabnzbd.nix b/nixos/tests/sabnzbd.nix
index a1a954d8b1e5..92d574d717b2 100644
--- a/nixos/tests/sabnzbd.nix
+++ b/nixos/tests/sabnzbd.nix
@@ -1,12 +1,12 @@
-{ pkgs, lib, ... }:
+{ lib, ... }:
 {
   name = "sabnzbd";
-  meta = with pkgs.lib; {
-    maintainers = with maintainers; [ jojosch ];
-  };
+  meta.maintainers = with lib.maintainers; [ jojosch ];
+
+  node.pkgsReadOnly = false;
 
   nodes.machine =
-    { pkgs, ... }:
+    { lib, ... }:
     {
       services.sabnzbd = {
         enable = true;
diff --git a/nixos/tests/squid.nix b/nixos/tests/squid.nix
index 7c38b05475c1..77552b237f34 100644
--- a/nixos/tests/squid.nix
+++ b/nixos/tests/squid.nix
@@ -43,9 +43,9 @@ let
 in
 {
   name = "squid";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ cobalt ];
-  };
+  meta.maintainers = with lib.maintainers; [ cobalt ];
+
+  node.pkgsReadOnly = false;
 
   nodes = {
     client =
diff --git a/nixos/tests/systemd-analyze.nix b/nixos/tests/systemd-analyze.nix
index 6ec5697f1cb7..1751f132c8fc 100644
--- a/nixos/tests/systemd-analyze.nix
+++ b/nixos/tests/systemd-analyze.nix
@@ -1,14 +1,14 @@
 {
-  pkgs,
-  latestKernel ? false,
+  latestKernel,
+  lib,
   ...
 }:
 
 {
   name = "systemd-analyze";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ raskin ];
-  };
+  meta.maintainers = with lib.maintainers; [ raskin ];
+
+  _module.args.latestKernel = lib.mkDefault false;
 
   nodes.machine =
     { pkgs, lib, ... }:
diff --git a/nixos/tests/systemd-shutdown.nix b/nixos/tests/systemd-shutdown.nix
index 56f9094c681c..f4685605bb61 100644
--- a/nixos/tests/systemd-shutdown.nix
+++ b/nixos/tests/systemd-shutdown.nix
@@ -1,6 +1,7 @@
 {
+  systemdStage1,
+  lib,
   pkgs,
-  systemdStage1 ? false,
   ...
 }:
 let
@@ -8,9 +9,9 @@ let
 in
 {
   name = "systemd-shutdown";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ das_j ];
-  };
+  meta.maintainers = with lib.maintainers; [ das_j ];
+
+  _module.args.systemdStage1 = lib.mkDefault false;
 
   nodes.machine = {
     imports = [ ../modules/profiles/minimal.nix ];
diff --git a/nixos/tests/web-apps/netbox-upgrade.nix b/nixos/tests/web-apps/netbox-upgrade.nix
index 49fa53daabd9..1a8c9599206d 100644
--- a/nixos/tests/web-apps/netbox-upgrade.nix
+++ b/nixos/tests/web-apps/netbox-upgrade.nix
@@ -10,20 +10,23 @@ let
       (lib.take 2)
       (lib.concatStringsSep ".")
     ];
-  oldApiVersion = apiVersion pkgs."${oldNetbox}".version;
-  newApiVersion = apiVersion pkgs."${newNetbox}".version;
+  oldApiVersion = apiVersion pkgs.${oldNetbox}.version;
+  newApiVersion = apiVersion pkgs.${newNetbox}.version;
 in
 {
   name = "netbox-upgrade";
 
-  meta = with lib.maintainers; {
-    maintainers = [
-      minijackson
-      raitobezarius
-    ];
-  };
+  meta.maintainers = with lib.maintainers; [
+    minijackson
+    raitobezarius
+  ];
+
+  node.pkgsReadOnly = false;
 
   nodes.machine =
+    let
+      pkgs' = pkgs;
+    in
     { config, pkgs, ... }:
     {
       virtualisation.memorySize = 2048;
@@ -31,7 +34,7 @@ in
         enable = true;
         # Pick the NetBox package from this config's "pkgs" argument,
         # so that `nixpkgs.config.permittedInsecurePackages` works
-        package = pkgs."${oldNetbox}";
+        package = pkgs.${oldNetbox};
         secretKeyFile = pkgs.writeText "secret" ''
           abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
         '';
@@ -53,9 +56,9 @@ in
 
       networking.firewall.allowedTCPPorts = [ 80 ];
 
-      nixpkgs.config.permittedInsecurePackages = [ pkgs."${oldNetbox}".name ];
+      nixpkgs.config.permittedInsecurePackages = [ pkgs'.${oldNetbox}.name ];
 
-      specialisation.upgrade.configuration.services.netbox.package = lib.mkForce pkgs."${newNetbox}";
+      specialisation.upgrade.configuration.services.netbox.package = lib.mkForce pkgs.${newNetbox};
     };
 
   testScript =
diff --git a/nixos/tests/without-nix.nix b/nixos/tests/without-nix.nix
index 211b326f9353..9bea24e691a4 100644
--- a/nixos/tests/without-nix.nix
+++ b/nixos/tests/without-nix.nix
@@ -1,30 +1,28 @@
 { lib, ... }:
 {
   name = "without-nix";
-  meta = with lib.maintainers; {
-    maintainers = [ ericson2314 ];
-  };
+  meta.maintainers = with lib.maintainers; [ ericson2314 ];
 
-  nodes.machine =
-    { ... }:
-    {
-      nix.enable = false;
-      nixpkgs.overlays = [
-        (self: super: {
-          nix = throw "don't want to use pkgs.nix";
-          nixVersions = lib.mapAttrs (k: throw "don't want to use pkgs.nixVersions.${k}") super.nixVersions;
-          # aliases, some deprecated
-          nix_2_3 = throw "don't want to use pkgs.nix_2_3";
-          nix_2_4 = throw "don't want to use pkgs.nix_2_4";
-          nix_2_5 = throw "don't want to use pkgs.nix_2_5";
-          nix_2_6 = throw "don't want to use pkgs.nix_2_6";
-          nixFlakes = throw "don't want to use pkgs.nixFlakes";
-          nixStable = throw "don't want to use pkgs.nixStable";
-          nixUnstable = throw "don't want to use pkgs.nixUnstable";
-          nixStatic = throw "don't want to use pkgs.nixStatic";
-        })
-      ];
-    };
+  node.pkgsReadOnly = false;
+
+  nodes.machine = {
+    nix.enable = false;
+    nixpkgs.overlays = [
+      (self: super: {
+        nix = throw "don't want to use pkgs.nix";
+        nixVersions = lib.mapAttrs (k: throw "don't want to use pkgs.nixVersions.${k}") super.nixVersions;
+        # aliases, some deprecated
+        nix_2_3 = throw "don't want to use pkgs.nix_2_3";
+        nix_2_4 = throw "don't want to use pkgs.nix_2_4";
+        nix_2_5 = throw "don't want to use pkgs.nix_2_5";
+        nix_2_6 = throw "don't want to use pkgs.nix_2_6";
+        nixFlakes = throw "don't want to use pkgs.nixFlakes";
+        nixStable = throw "don't want to use pkgs.nixStable";
+        nixUnstable = throw "don't want to use pkgs.nixUnstable";
+        nixStatic = throw "don't want to use pkgs.nixStatic";
+      })
+    ];
+  };
 
   testScript = ''
     start_all()