diff --git a/nix/home-manager/profiles/common.nix b/nix/home-manager/profiles/common.nix
index 602de04..1c4372e 100644
--- a/nix/home-manager/profiles/common.nix
+++ b/nix/home-manager/profiles/common.nix
@@ -15,6 +15,10 @@ in {
     permittedInsecurePackages = [
       "electron-17.4.1"
     ];
+
+  nix.settings = {
+    experimental-features =
+      [ "nix-command" "flakes" "impure-derivations" "ca-derivations" ];
   };
 
   home.keyboard = {
diff --git a/nix/os/devices/steveej-t14/system.nix b/nix/os/devices/steveej-t14/system.nix
index 9035bbf..20d60ca 100644
--- a/nix/os/devices/steveej-t14/system.nix
+++ b/nix/os/devices/steveej-t14/system.nix
@@ -13,6 +13,8 @@ in {
       "cache.holo.host-1:lNXIXtJgS9Iuw4Cu6X0HINLu9sTfcjEntnrgwMQIMcE="
       "cache.holo.host-2:ZJCkX3AUYZ8soxTLfTb60g+F3MkWD7hkH9y8CgqwhDQ="
     ];
+
+    settings = { extra-experimental-features = [ "impure-derivations" ]; };
   };
 
   # TASK: new device
diff --git a/nix/os/devices/steveej-t14/user.nix b/nix/os/devices/steveej-t14/user.nix
index fd906b1..afb1aa8 100644
--- a/nix/os/devices/steveej-t14/user.nix
+++ b/nix/os/devices/steveej-t14/user.nix
@@ -10,4 +10,6 @@ in {
     uid = 1001;
     openssh.authorizedKeys.keys = keys.users.steveej.openssh;
   };
+
+  nix.settings.trusted-users = [ "steveej" ];
 }