diff --git a/nixos/modules/overlays.nix b/nixos/modules/overlays.nix
index 6084665f006774b4d816f35471e5a98c5e27033a..00e26dd1ad4f97943d75932f85ae51a79000b00a 100644
--- a/nixos/modules/overlays.nix
+++ b/nixos/modules/overlays.nix
@@ -1,7 +1,7 @@
 let
-  # Define a Python packageOverride that puts our version of Twisted into
-  # python27Packages.
-  pythonTwistedOverride = python-self: python-super: {
+  # Define a Python packageOverride that puts our version of some Python
+  # packages into python27Packages.
+  pythonPackageOverride = python-self: python-super: {
     # Get our Twisted derivation.  Pass in the old one so it can have pieces
     # overridden.  It needs to be passed in explicitly because callPackage is
     # specially crafted to always pull attributes from the fixed-point.  That
@@ -12,6 +12,10 @@ let
     twisted = python-self.callPackage ../pkgs/twisted.nix {
       inherit (python-super) twisted;
     };
+
+    tahoe-lafs = python-self.callPackage ../pkgs/tahoe-lafs.nix { };
+
+    zkapauthorizer = python-self.callPackage ../pkgs/zkapauthorizer.nix { };
   };
 in
 self: super: {
@@ -38,8 +42,8 @@ self: super: {
   python27 = super.python27.override (old: {
     packageOverrides =
       if old ? packageOverrides then
-        super.lib.composeExtensions old.packageOverrides pythonTwistedOverride
+        super.lib.composeExtensions old.packageOverrides pythonPackageOverride
       else
-        pythonTwistedOverride;
+        pythonPackageOverride;
   });
 }
diff --git a/nixos/modules/pspkgs.nix b/nixos/modules/pspkgs.nix
index 11ef89929ef0ad20f3c5f7795554a90085ed66f9..031852c07d19e8c86c9da297656cf15224c0c052 100644
--- a/nixos/modules/pspkgs.nix
+++ b/nixos/modules/pspkgs.nix
@@ -1,19 +1,9 @@
 # Derive a brand new version of pkgs which has our overlays applied.  This
-# includes the ZKAPAuthorizer overlay which defines some Python overrides as
-# well as our own which defines the `privatestorage` derivation.
+# includes our definition of the `privatestorage` derivation, a Python
+# environment with Tahoe-LAFS and ZKAPAuthorizer installed.
 { pkgs }:
 import pkgs.path {
   overlays = [
-    # For some reason the order of these overlays matters.  Maybe it has to do
-    # with our python27 override, I'm not sure.  In the other order, we end up
-    # with two derivations of each of Twisted and treq which conflict with
-    # each other.
     (import ./overlays.nix)
-    # It might be nice to eventually remove this.  ZKAPAuthorizer now
-    # self-applies this overlay without our help.  We only still have it
-    # because it also defines tahoe-lafs which we want to use.  We can't see
-    # tahoe-lafs from the self-applied overlay because that overlay is applied
-    # to ZKAPAuthorizer's nixpkgs, not to the one we're using.
-    (import ./zkap-overlay.nix)
   ];
 }
diff --git a/nixos/pkgs/tahoe-lafs-repo.nix b/nixos/pkgs/tahoe-lafs-repo.nix
new file mode 100644
index 0000000000000000000000000000000000000000..dd5ecbb6b6e91160edd42a659d218c8e8bcdf9f4
--- /dev/null
+++ b/nixos/pkgs/tahoe-lafs-repo.nix
@@ -0,0 +1,9 @@
+let
+  pkgs = import <nixpkgs> {};
+in
+  pkgs.fetchFromGitHub {
+    owner = "tahoe-lafs";
+    repo = "tahoe-lafs";
+    rev = "23e1223c94330741f5b1dda476c3aeb42c3a012f";
+    sha256 = "1zh37rvkiigciwadgrjvnq9519lap1c260v8593g65qrpc1zwjxz";
+  }
\ No newline at end of file
diff --git a/nixos/pkgs/tahoe-lafs.nix b/nixos/pkgs/tahoe-lafs.nix
new file mode 100644
index 0000000000000000000000000000000000000000..3289c5f5761df1ea60b33d3ef3d64d4dd0e3e1cb
--- /dev/null
+++ b/nixos/pkgs/tahoe-lafs.nix
@@ -0,0 +1,5 @@
+{ callPackage }:
+let
+  tahoe-lafs-repo = import ./tahoe-lafs-repo.nix;
+in
+  callPackage "${tahoe-lafs-repo}/nix" { }
diff --git a/nixos/pkgs/zkapauthorizer.nix b/nixos/pkgs/zkapauthorizer.nix
new file mode 100644
index 0000000000000000000000000000000000000000..892987dad0a1417f3cc6597002ba6fe8f9d43fb7
--- /dev/null
+++ b/nixos/pkgs/zkapauthorizer.nix
@@ -0,0 +1,9 @@
+{ callPackage }:
+let
+  repo = import ./zkapauthorizer-repo.nix;
+  typing = callPackage "${repo}/typing.nix" { };
+  challenge-bypass-ristretto = callPackage "${repo}/python-challenge-bypass-ristretto.nix" { };
+in
+(callPackage "${repo}/zkapauthorizer.nix" {
+    inherit challenge-bypass-ristretto;
+    }).overrideAttrs (old: { doCheck = false; doInstallCheck = false; })