diff --git a/cluster/clustercfg/clustercfg.py b/cluster/clustercfg/clustercfg.py
index c5f5c6c..0adef40 100644
--- a/cluster/clustercfg/clustercfg.py
+++ b/cluster/clustercfg/clustercfg.py
@@ -207,8 +207,8 @@
         ca_admitomatic.make_cert('admitomatic-webhook', ou='Admitomatic Webhook', hosts=['admitomatic.admitomatic.svc'])
 
     subprocess.check_call(["nix", "run",
-                           "-f", os.path.join(local_root, "cluster/nix/default.nix"),
-                           "provision",
+                           "-f", local_root,
+                           "cluster.nix.provision",
                            "-c", "provision-{}".format(fqdn.split('.')[0])])
 
 
diff --git a/cluster/nix/default.nix b/cluster/nix/default.nix
deleted file mode 100644
index 39d693b..0000000
--- a/cluster/nix/default.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-let
-  # Tracking nixos-unstable as of 2021-01-31.
-  nixpkgsCommit = "44ad80ab1036c5cc83ada4bfa451dac9939f2a10";
-  nixpkgsSrc = fetchTarball {
-    url = "https://github.com/NixOS/nixpkgs/archive/${nixpkgsCommit}.tar.gz";
-    sha256 = "1b61nzvy0d46cspy07szkc0rggacxiqg9v1py27pkqpj7rvawfsk";
-  };
-  pkgs = import nixpkgsSrc;
-  cfg = {
-    overlays = [
-      (import ./provision.nix)
-    ];
-  };
-
-in pkgs cfg
diff --git a/cluster/nix/provision.nix b/cluster/nix/provision.nix
index 20ed0a0..7ab7e71 100644
--- a/cluster/nix/provision.nix
+++ b/cluster/nix/provision.nix
@@ -1,10 +1,12 @@
-self: super:
+{ hscloud, pkgs, ... }:
+
+with builtins;
 
 let 
   machines = (import ./defs-machines.nix);
   configurations = builtins.listToAttrs (map (machine: {
     name = machine.fqdn;
-    value = super.nixos ({ config, pkgs, ... }: {
+    value = pkgs.nixos ({ config, pkgs, ... }: {
       networking.hostName = machine.name;
       imports = [
         ./modules/base.nix
@@ -32,18 +34,16 @@
    fi
   '';
 
-  machineProvisioners = builtins.listToAttrs (map (machine: {
-      name = "provision-${machine.name}";
-      value = super.writeScriptBin "provision-${machine.name}" (scriptForMachine machine);
-    }) machines);
+  provisioners = (map (machine:
+    pkgs.writeScriptBin "provision-${machine.name}" (scriptForMachine machine)
+  ) machines);
+
+  provision = pkgs.writeScriptBin "provision" (
+    ''
+      echo "Available provisioniers:"
+    '' + (concatStringsSep "\n" (map (machine: "echo '  provision-${machine.name}'") machines)));
 in
-{
-  provision = ({
-    provision = super.writeScriptBin "provision"
-      (
-        ''
-          echo "Available provisioniers:"
-        '' + (builtins.concatStringsSep "\n" (map (machine: "echo '  provision-${machine.name}'") machines))
-      );
-  }) // machineProvisioners;
+pkgs.symlinkJoin {
+  name = "provision";
+  paths = [ provision ] ++ provisioners;
 }