diff --git a/hosts/default.nix b/hosts/default.nix
index 748d6a4..18e0bc7 100644
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -11,66 +11,6 @@
     nixOnDroidHosts.janeway = { };
 
     hosts = {
-      # thinkpad = {
-      #   extraModules = with inputs; [
-      #     nixosHardware.nixosModules.lenovo-thinkpad-x1-7th-gen
-      # 	buildbot-nix.nixosModules.buildbot-master
-      # 	buildbot-nix.nixosModules.buildbot-worker
-      #   ];
-      #   extraHmModules = with inputs; [
-      #     ccrEmacs.hmModules.default
-      #     {
-      #         # TODO: remove after https://github.com/nix-community/home-manager/pull/3811
-      #       imports = let
-      #         hmModules = "${inputs.homeManagerGitWorkspace}/modules";
-      #       in [
-      #         "${hmModules}/services/git-workspace.nix"
-      #       ];
-      #     }
-      #   ];
-      #   overlays = [inputs.nil.overlays.default];
-      #   secrets = {
-      #     "thinkpad-wireguard-private-key" = {};
-      #     "cachix-personal-token".owner = "ccr";
-      #     "autistici-password".owner = "ccr";
-      #     "git-workspace-tokens".owner = "ccr";
-      #     "chatgpt-token".owner = "ccr";
-      #   };
-      # };
-      # rock5b = {
-      #   system = "aarch64-linux";
-      #   extraModules = with inputs; [
-      #     disko.nixosModules.disko
-      #     rock5b.nixosModules.default
-      #   ];
-      #   secrets = {
-      #     "rock5b-wireguard-private-key" = {};
-      #     "hercules-ci-join-token".owner = "hercules-ci-agent";
-      #     "hercules-ci-binary-caches".owner = "hercules-ci-agent";
-      #     "cachix-personal-token".owner = "ccr";
-      #     "home-planimetry".owner = "hass";
-      # 	"cloudflare-dyndns-api-token" = {};
-      #       # "nextcloud-admin-pass".owner = "nextcloud";
-      #       # "aws-credentials" = {};
-      #   };
-      #   colmena.deployment.buildOnTarget = true;
-      # };
-      # pbp = {
-      #   system = "aarch64-linux";
-      #   extraModules = with inputs; [
-      #     nixosHardware.nixosModules.pine64-pinebook-pro
-      #     disko.nixosModules.disko
-      #   ];
-      #   extraHmModules = [
-      #     inputs.ccrEmacs.hmModules.default
-      #   ];
-      #   secrets = {
-      #     "pbp-wireguard-private-key" = {};
-      #     "cachix-personal-token".owner = "ccr";
-      #     "chatgpt-token".owner = "ccr";
-      #   };
-      # };
-
       deltaflyer = {
         nixpkgs =
           let
@@ -106,7 +46,6 @@
           inputs.lix-module.nixosModules.default
         ];
         extraHmModules = [
-          # inputs.ccrEmacs.hmModules.default
           "${inputs.homeManagerGitWorkspace}/modules/services/git-workspace.nix"
         ];
         secrets = {
@@ -128,7 +67,7 @@
           inputs.disko.nixosModules.disko
           inputs.nixThePlanet.nixosModules.macos-ventura
           inputs.lix-module.nixosModules.default
-          # inputs.hercules-ci-agent.nixosModules.agent-service
+          inputs.lanzaboote.nixosModules.lanzaboote
         ];
         extraHmModules = [
           # inputs.ccrEmacs.hmModules.default
@@ -139,13 +78,9 @@
           "picard-wireguard-private-key" = { };
           "chatgpt-token".owner = "ccr";
           "cachix-personal-token".owner = "ccr";
-          "hercules-ci-join-token".owner = "hercules-ci-agent";
-          "hercules-ci-binary-caches".owner = "hercules-ci-agent";
-          "hercules-ci-secrets-json".owner = "hercules-ci-agent";
           "git-workspace-tokens".owner = "ccr";
           "autistici-password".owner = "ccr";
           "restic-hetzner-password" = { };
-          "aws-credentials".owner = "hercules-ci-agent";
           "forgejo-runners-token".owner = "nixuser";
           "forgejo-nix-access-tokens".owner = "nixuser";
         };
@@ -160,26 +95,16 @@
         extraModules = with inputs; [
           disko.nixosModules.disko
           impermanence.nixosModules.impermanence
-          # lix-module.nixosModules.default
-          # inputs.hercules-ci-agent.nixosModules.agent-service;
-          # rock5b.nixosModules.default
         ];
         secrets = {
           "sisko-wireguard-private-key" = { };
-          "hercules-ci-join-token".owner = "hercules-ci-agent";
-          "hercules-ci-binary-caches".owner = "hercules-ci-agent";
-          "hercules-ci-secrets-json".owner = "hercules-ci-agent";
           "cachix-personal-token".owner = "ccr";
           "home-planimetry".owner = "hass";
           "home-assistant-token".owner = "prometheus";
           "grafana-password".owner = "grafana";
           "cloudflare-dyndns-api-token" = { };
           "restic-hetzner-password" = { };
-          # "minio-credentials".owner = "minio";
-          # "aws-credentials".owner = "hercules-ci-agent";
           "hass-ssh-key".owner = "hass";
-          # "matrix-registration-shared-secret".owner = "matrix-synapse";
-          # "matrix-sliding-sync-secret".owner = "matrix-synapse";
           "autistici-password" = {
             # FIXME terrible, should create a third ad-hoc group
             owner = "grafana";
diff --git a/hosts/picard/default.nix b/hosts/picard/default.nix
index 3af3ce5..509a13a 100644
--- a/hosts/picard/default.nix
+++ b/hosts/picard/default.nix
@@ -26,7 +26,6 @@
       "waydroid"
       "virt-manager"
       "ssh-initrd"
-      "hercules-ci"
       "printing"
       "pam"
       "wireguard-client"