diff --git a/docs/dev/README.rst b/docs/dev/README.rst
index af746a3586d2def59050430f756825a87e8c9fcf..29eb38e1f1695084d3276d41d4a063be4a53a015 100644
--- a/docs/dev/README.rst
+++ b/docs/dev/README.rst
@@ -62,7 +62,7 @@ To update the version of packages we import from gitlab, run:
 
 .. code: shell
 
-   nix-shell --command 'tools/update-gitlab nixos/pkgs/<package>/repo.json'
+   nix-shell --command 'update-gitlab-repo nixos/pkgs/<package>/repo.json'
 
 That will update the package to point at the latest version of the project.\
 The command uses branch and repository owner specified in the ``repo.json`` file,
diff --git a/nixos/modules/monitoring/server/grafana-dashboards/meta-monitoring.json b/nixos/modules/monitoring/server/grafana-dashboards/meta-monitoring.json
index 22c65fb3d77736af26c27782abfc3cb39b0f9392..17564492ffc163c2c98a1a5e6ed35bc52d63e6c0 100644
--- a/nixos/modules/monitoring/server/grafana-dashboards/meta-monitoring.json
+++ b/nixos/modules/monitoring/server/grafana-dashboards/meta-monitoring.json
@@ -42,7 +42,7 @@
             },
             "reducer": {
               "params": [],
-              "type": "avg"
+              "type": "count"
             },
             "type": "query"
           }
diff --git a/nixos/pkgs/default.nix b/nixos/pkgs/default.nix
index 619f69e93eedf8d8baa125c9b84df7c9ac0e5822..9e98f253692ed95e4be89c0753542d797db710d1 100644
--- a/nixos/pkgs/default.nix
+++ b/nixos/pkgs/default.nix
@@ -4,23 +4,11 @@
 #
 #    pkgs.callPackage ./nixos/pkgs
 {buildPlatform, hostPlatform, callPackage}:
-let
-  # Our own nixpkgs fork:
-  ourpkgs = import ../../nixpkgs-ps.nix {
-    # Ensure that the fork is configured for the same system
-    # as we were called with.
-    localSystem = buildPlatform;
-    crossSystem = hostPlatform;
-    # Ensure that configuration of the system where this runs
-    # doesn't leak into what we build.
-    # See https://github.com/NixOS/nixpkgs/issues/62513
-    config = {};
-    overlays = [];
-  };
-in
 {
-  inherit (ourpkgs) privatestorage;
   leasereport = callPackage ./leasereport {};
+  # `privatestorage` is a derivation with a good Tahoe+ZKAP environment
+  # that is exposed by ZKAPAuthorizer.
+  privatestorage = callPackage ./privatestorage {};
   zkap-spending-service = callPackage ./zkap-spending-service {};
   zkapissuer = callPackage ./zkapissuer {};
 }
diff --git a/nixos/pkgs/privatestorage/default.nix b/nixos/pkgs/privatestorage/default.nix
new file mode 100644
index 0000000000000000000000000000000000000000..bd487af32941f6db920ea2d43ec89e9eded38201
--- /dev/null
+++ b/nixos/pkgs/privatestorage/default.nix
@@ -0,0 +1,8 @@
+{ fetchFromGitHub, callPackage, lib }:
+let
+  repo-data = lib.importJSON ./repo.json;
+  repo = fetchFromGitHub (builtins.removeAttrs repo-data [ "branch" ]);
+  privatestorage = callPackage repo {};
+in
+  privatestorage.privatestorage
+
diff --git a/nixos/pkgs/privatestorage/repo.json b/nixos/pkgs/privatestorage/repo.json
new file mode 100644
index 0000000000000000000000000000000000000000..669f724bfa7dbb5251c0a1a119dba0b4beffcbda
--- /dev/null
+++ b/nixos/pkgs/privatestorage/repo.json
@@ -0,0 +1,8 @@
+{
+  "owner": "PrivateStorageio",
+  "branch": "main",
+  "repo": "ZKAPAuthorizer",
+  "rev": "5bad3a39ae78cb2483d70709b8a7c1cba96571ab",
+  "outputHashAlgo": "sha512",
+  "outputHash": "1m277qsf8p94px33g7vbc18bjb48w35s8z2hbpnpga8mw21j1x9i0whnk7300byp9nx86vnk860bfmhbih4zdwprqnpflgvaciwdbwh"
+}
diff --git a/nixos/tests/private-storage.nix b/nixos/tests/private-storage.nix
index 6fb85a6713b4668ef4bdfa239480485bfbb52a18..86c6cbdb08e3f305dc5e1a18907d737d1f8c1c1e 100644
--- a/nixos/tests/private-storage.nix
+++ b/nixos/tests/private-storage.nix
@@ -209,8 +209,8 @@ in {
     try:
       ${runOnNode "introducer" [ run-introducer "/tmp/node.pem" (toString introducerPort) introducerFURL ]}
     except:
-      code, log = introducer.execute('cat /tmp/stdout /tmp/stderr')
-      introducer.log(log)
+      code, output = introducer.execute('cat /tmp/stdout /tmp/stderr')
+      introducer.log(output)
       raise
 
     #
@@ -244,8 +244,8 @@ in {
     try:
       api_stripe_com.wait_for_unit("api.stripe.com")
     except:
-      code, log = api_stripe_com.execute('journalctl -u api.stripe.com')
-      api_stripe_com.log(log)
+      code, output = api_stripe_com.execute('journalctl -u api.stripe.com')
+      api_stripe_com.log(output)
       raise
 
     # Get some ZKAPs from the issuer.
@@ -259,20 +259,20 @@ in {
       ]}
     except:
       code, log = client.execute('cat /tmp/stdout /tmp/stderr');
-      client.log(log)
+      client.log(output)
 
       # Dump the fake Stripe API server logs, too, since the error may arise
       # from a PaymentServer/Stripe interaction.
-      code, log = api_stripe_com.execute('journalctl -u api.stripe.com')
-      api_stripe_com.log(log)
+      code, output = api_stripe_com.execute('journalctl -u api.stripe.com')
+      api_stripe_com.log(output)
       raise
 
     # The client should be prepped now.  Make it try to use some storage.
     try:
       ${runOnNode "client" [ exercise-storage "/tmp/client" ]}
     except:
-      code, log = client.execute('cat /tmp/stdout /tmp/stderr')
-      client.log(log)
+      code, output = client.execute('cat /tmp/stdout /tmp/stderr')
+      client.log(output)
       raise
 
     # It should be possible to restart the storage service without the
@@ -285,16 +285,16 @@ in {
       if (before != after):
         raise Exception('fURL changes after storage node restart')
     except:
-      code, log = storage.execute('cat /tmp/stdout /tmp/stderr')
-      storage.log(log)
+      code, output = storage.execute('cat /tmp/stdout /tmp/stderr')
+      storage.log(output)
       raise
 
     # The client should actually still work, too.
     try:
       ${runOnNode "client" [ exercise-storage "/tmp/client" ]}
     except:
-      code, log = client.execute('cat /tmp/stdout /tmp/stderr')
-      client.log(log)
+      code, output = client.execute('cat /tmp/stdout /tmp/stderr')
+      client.log(output)
       raise
 
     # The issuer metrics should be accessible from the monitoring network.
diff --git a/nixpkgs-2105.json b/nixpkgs-2105.json
index 55b7cf2d1617db02e5bdcc6944f32549ee92d695..e71ad621a5357f5734fad7a00b74713239e97c37 100644
--- a/nixpkgs-2105.json
+++ b/nixpkgs-2105.json
@@ -1,5 +1,5 @@
-{
-  "name": "release2105",
-  "url": "https://releases.nixos.org/nixos/21.05/nixos-21.05.3740.ce7a1190a0f/nixexprs.tar.xz",
-  "sha256": "112drvixj81vscj8cncmks311rk2ik5gydpd03d3r0yc939zjskg"
-}
+{
+  "name": "release2105",
+  "url": "https://releases.nixos.org/nixos/21.05/nixos-21.05.3980.f0869b1a2c0/nixexprs.tar.xz",
+  "sha256": "0bcwqc01qmvzf4jllik11cvpl5x8nwk83lwh1ic7bzwr95k1iifm"
+}
diff --git a/nixpkgs-ps.json b/nixpkgs-ps.json
deleted file mode 100644
index 58add30734e8f7b9b2840a9be38693ceb6a4249d..0000000000000000000000000000000000000000
--- a/nixpkgs-ps.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{ "name": "nixpkgs"
-, "url": "https://github.com/PrivateStorageio/nixpkgs/archive/5ebd5af2d5c6caf23735c8c0e6bc27357fa8d2a8.tar.gz"
-, "sha256": "1g2bvs8prqjskzv8s1qmh36k7rmj98jib0syqbrq02xxzw5dpqb4"
-}
diff --git a/nixpkgs-ps.nix b/nixpkgs-ps.nix
deleted file mode 100644
index d98a53843052fda824f4ed7e34db50524df36ce2..0000000000000000000000000000000000000000
--- a/nixpkgs-ps.nix
+++ /dev/null
@@ -1 +0,0 @@
-import (builtins.fetchTarball (builtins.fromJSON (builtins.readFile ./nixpkgs-ps.json)))
diff --git a/tools/update-github-repo b/tools/update-github-repo
old mode 100644
new mode 100755