diff --git a/README b/README
index 1b34911..c8ade53 100644
--- a/README
+++ b/README
@@ -4,6 +4,5 @@
 * Copy device database to ~/artiq
 * Set timezone and kb layout
 * Comment out openssh.authorizedKeys.keys
-* sudo nixos-rebuild boot
-* sudo nix-collect-garbage -d
+* sudo seal-off
 * history clear
diff --git a/final/configuration.nix b/final/configuration.nix
index 4a130a3..b9e1003 100644
--- a/final/configuration.nix
+++ b/final/configuration.nix
@@ -1,6 +1,14 @@
 { config, pkgs, artiq, ... }:
 
-{
+let
+  sealOff = pkgs.writeShellScriptBin "seal-off"
+  ''
+  set -e
+  nixos-rebuild boot
+  nix-collect-garbage -d
+  '';
+
+in {
   imports =
     [
       ./hardware-configuration.nix
@@ -36,6 +44,7 @@
 
   nixpkgs.config.allowUnfree = true;
   environment.systemPackages = with pkgs; [
+    sealOff
     wget
     vim
     gitAndTools.gitFull