diff --git a/default.nix b/default.nix
index d7ef5b72b..2bab1cd29 100644
--- a/default.nix
+++ b/default.nix
@@ -1,5 +1,6 @@
-# This file sets up the top-level package set by merging all local packages into
-# the nixpkgs top-level.
+# This file sets up the top-level package set by traversing the package tree
+# (see read-tree.nix for details) and constructing a matching attribute set
+# tree.
 #
 # This makes packages accessible via the Nixery instance that is configured to
 # use this repository as its nixpkgs source.
@@ -7,14 +8,9 @@
 with builtins;
 
 let
-  # The pinned commit here is identical to the public nixery.dev
-  # version, since popularity data has been generated for that.
-  stableCommit = "80b42e630b23052d9525840a9742100a2ceaaa8f";
-  stableSrc = fetchTarball {
-    url = "https://github.com/NixOS/nixpkgs-channels/archive/${stableCommit}.tar.gz";
-    sha256 = "0243qiivxl3z51biy4f5y5cy81x5bki5dazl9wqwgnmd373gpmxy";
-  };
-  readTree = import ./read-tree.nix;
+  # This definition of fix is identical to <nixpkgs>.lib.fix, but the global
+  # package set is not available here.
+  fix = f: let x = f x; in x;
 
   # Derivations that have `meta.enableCI` set to `true` should be
   # built by the CI system on every commit. This code implements
@@ -25,33 +21,43 @@ let
     ciCondition = _: x: (!isDerivation x) || ((x ? meta.enableCI) && (x.meta.enableCI));
   in collect isDerivation (filterAttrsRecursive ciCondition pkgs);
 
-  repoPkgs = self: super:
-    let config = {
-      pkgs = self;
-      upstream = super;
+  # Global configuration that all packages are called with.
+  config = pkgs: {
+    inherit pkgs;
 
-      kms = {
-        project = "tazjins-infrastructure";
-        region = "europe-north1";
-        keyring = "tazjins-keys";
-        key = "kontemplate-key";
-      };
+    kms = {
+      project = "tazjins-infrastructure";
+      region = "europe-north1";
+      keyring = "tazjins-keys";
+      key = "kontemplate-key";
     };
-    in {
-      services = readTree ./services config;
-      tools = readTree ./tools config;
-      third_party = readTree ./third_party config;
-    }
-    # Load overrides into the top-level:
-    // (readTree ./overrides config)
-    # Collect all projects that should be built by CI
-    // {
-      ciProjects = (filterCI super.lib self.services)
-        ++ (filterCI super.lib self.tools)
-        ++ (filterCI super.lib self.third_party);
-    };
-in { ... } @ args: import stableSrc (args // {
-    overlays = [ repoPkgs ];
-    config.allowUnfree = true;
-    config.allowBroken = true;
-})
+  };
+
+  readTree' = import ./read-tree.nix;
+
+  localPkgs = readTree: {
+    services    = readTree ./services;
+    tools       = readTree ./tools;
+    third_party = readTree ./third_party;
+  };
+in fix(self: {
+  config = config self;
+
+  # Elevate 'lib' from nixpkgs
+  lib = self.third_party.nixpkgs.lib;
+
+  # Collect all projects that should be built by CI
+  ciProjects = (filterCI self.lib self.services)
+    ++ (filterCI super.lib self.tools)
+    ++ (filterCI super.lib self.third_party);
+}
+
+# Add local packages as structured by readTree
+// (localPkgs (readTree' self.config))
+
+# Load overrides into the top-level.
+#
+# This can be used to move things from third_party into the top-level, too (such
+# as `lib`).
+// (readTree' self.config) ./overrides
+)
diff --git a/overrides/buildGo.nix b/overrides/buildGo.nix
index cbccfcec9..8d46321b6 100644
--- a/overrides/buildGo.nix
+++ b/overrides/buildGo.nix
@@ -1,4 +1,6 @@
-import "${builtins.fetchGit {
+{ pkgs, ... }:
+
+(import "${builtins.fetchGit {
   url = "https://github.com/tazjin/buildGo.nix";
   rev = "28e587b348a8aaa7af00a004c05286af9d35ca9a";
-}}/buildGo.nix"
+}}/buildGo.nix") { pkgs = pkgs.third_party.nixpkgs; }
diff --git a/overrides/lispPackages/default.nix b/overrides/lispPackages/default.nix
index da8f3c893..175c807ec 100644
--- a/overrides/lispPackages/default.nix
+++ b/overrides/lispPackages/default.nix
@@ -1,8 +1,8 @@
 # One of Gemma's dependencies is missing in nixpkgs' Quicklisp
 # package set, it is overlaid locally here.
-{ pkgs, upstream, ... }:
+{ pkgs, ... }:
 
 import ./quicklisp.nix {
   inherit (pkgs) lib;
-  inherit (upstream) lispPackages;
+  inherit (pkgs.third_party.nixpkgs) lispPackages;
 }
diff --git a/read-tree.nix b/read-tree.nix
index 72e4d0453..b2f161e88 100644
--- a/read-tree.nix
+++ b/read-tree.nix
@@ -1,4 +1,7 @@
-initPath: { pkgs, ... } @ args:
+# TODO(tazjin): if there's a default.nix, keep traversing but don't import .nix files?
+# TODO(tazjin): avoid {} by only calling functions *after* checking what they are
+
+args: initPath:
 
 let
   inherit (builtins)
diff --git a/services/gemma/default.nix b/services/gemma/default.nix
index ea10a4c7d..5b211422d 100644
--- a/services/gemma/default.nix
+++ b/services/gemma/default.nix
@@ -1,7 +1,8 @@
 { pkgs, ... }:
 
 let
-  inherit (pkgs) stdenv sbcl lispPackages elmPackages makeWrapper openssl;
+  inherit (pkgs) lispPackages;
+  inherit (pkgs.third_party.nixpkgs) stdenv sbcl elmPackages makeWrapper openssl;
 
   frontend = stdenv.mkDerivation {
     name = "gemma-frontend";
diff --git a/services/tazblog/default.nix b/services/tazblog/default.nix
index 4d9608838..41838e760 100644
--- a/services/tazblog/default.nix
+++ b/services/tazblog/default.nix
@@ -5,7 +5,7 @@
 { pkgs, ... }:
 
 let
-  inherit (pkgs) writeShellScriptBin haskell;
+  inherit (pkgs.third_party.nixpkgs) writeShellScriptBin haskell;
   tazblog = haskell.packages.ghc865.callPackage ./tazblog.nix {};
   wrapper =  writeShellScriptBin "tazblog" ''
     export PORT=8000
diff --git a/services/tazblog/shell.nix b/services/tazblog/shell.nix
index 021c3db31..ebb891a87 100644
--- a/services/tazblog/shell.nix
+++ b/services/tazblog/shell.nix
@@ -1,4 +1,4 @@
-{ pkgs ? import ../../default.nix {} }:
+{ pkgs ? (import ../../default.nix {}).third_party.nixpkgs }:
 
 let tazblog = import ./tazblog.nix;
     depNames = with builtins; filter (
diff --git a/third_party/naersk.nix b/third_party/naersk.nix
index c12c1abbb..0e708a578 100644
--- a/third_party/naersk.nix
+++ b/third_party/naersk.nix
@@ -1,6 +1,6 @@
 { pkgs, ... }:
 
-let inherit (pkgs) callPackage fetchFromGitHub;
+let inherit (pkgs.third_party.nixpkgs) callPackage fetchFromGitHub;
 in callPackage (fetchFromGitHub {
   owner = "nmattia";
   repo = "naersk";
diff --git a/tools/blog_cli/default.nix b/tools/blog_cli/default.nix
index 717daec86..76732667f 100644
--- a/tools/blog_cli/default.nix
+++ b/tools/blog_cli/default.nix
@@ -1,6 +1,6 @@
 { pkgs, ... }:
 
-pkgs.buildGoPackage {
+pkgs.third_party.nixpkgs.buildGoPackage {
   name = "blog_cli";
   goPackagePath = "github.com/tazjin/personal/blog_cli";
   src = ./.;
diff --git a/tools/kms_pass.nix b/tools/kms_pass.nix
index 7005697da..82a6a9f1f 100644
--- a/tools/kms_pass.nix
+++ b/tools/kms_pass.nix
@@ -8,7 +8,7 @@
 
 { pkgs, kms, ... }:
 
-let inherit (pkgs) google-cloud-sdk tree writeShellScriptBin;
+let inherit (pkgs.third_party.nixpkgs) google-cloud-sdk tree writeShellScriptBin;
 in (writeShellScriptBin "pass" ''
   set -eo pipefail