diff --git a/nixops/desktop.nix b/nixops/desktop.nix
index 1c417f3c..c8ef41b3 100644
--- a/nixops/desktop.nix
+++ b/nixops/desktop.nix
@@ -2,7 +2,7 @@
 
 { config, pkgs, ... }:
 let
-  m-labs = import (fetchTarball https://nixbld.m-labs.hk/channel/custom/artiq/full/artiq-full/nixexprs.tar.xz) { inherit pkgs; };
+  artiq = builtins.getFlake git+https://github.com/m-labs/artiq.git;
 in
 {
   deployment.targetHost = host;
@@ -44,7 +44,7 @@ in
     gnome3.gnome-tweaks
     jq sublime3 rink qemu_kvm
     tmux screen gdb minicom picocom tigervnc
-    # TODO m-labs.openocd
+    artiq.packages.x86_64-linux.openocd-bscanspi
     # TODO xc3sprog
     emacs bat ripgrep
     xpra
@@ -152,7 +152,7 @@ in
   users.extraGroups.plugdev = { };
   users.extraUsers = import ./common-users.nix { inherit pkgs; };
   security.sudo.wheelNeedsPassword = false;
-  # TODO services.udev.packages = [ m-labs.openocd ];
+  services.udev.packages = [ artiq.packages.x86_64-linux.openocd-bscanspi ];
   services.udev.extraRules = (import ./extra-udev.nix);
 
   nix.binaryCachePublicKeys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
diff --git a/nixops/light.nix b/nixops/light.nix
index 88611102..c28c0b89 100644
--- a/nixops/light.nix
+++ b/nixops/light.nix
@@ -2,7 +2,7 @@
 
 { config, pkgs, ... }:
 let
-  m-labs = import (fetchTarball https://nixbld.m-labs.hk/channel/custom/artiq/full/artiq-full/nixexprs.tar.xz) { inherit pkgs; };
+  artiq = builtins.getFlake git+https://github.com/m-labs/artiq.git;
 in
 {
   deployment.targetHost = host;
@@ -33,7 +33,7 @@ in
   documentation.enable = false;
   nixpkgs.config.allowUnfree = true;
   environment.systemPackages = with pkgs; [
-    opensc
+    opensc yubikey-manager yubikey-manager-qt yubico-piv-tool
     wget vim git firefox usbutils pciutils file lm_sensors acpi
     gimp imagemagick
     evince
@@ -42,6 +42,7 @@ in
     unzip zip gnupg
     sublime3 rink
     tmux screen tigervnc
+    artiq.packages.x86_64-linux.openocd-bscanspi
     any-nix-shell
   ];
   programs.wireshark.enable = true;
@@ -126,7 +127,7 @@ in
   users.extraUsers = import ./common-users.nix { inherit pkgs; };
   
   security.sudo.wheelNeedsPassword = false;
-  # TODO services.udev.packages = [ m-labs.openocd ];
+  services.udev.packages = [ artiq.packages.x86_64-linux.openocd-bscanspi ];
   services.udev.extraRules = (import ./extra-udev.nix);
 
   nix.binaryCachePublicKeys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
diff --git a/nixops/rpi.nix b/nixops/rpi.nix
index eef2a9fb..e514b49e 100644
--- a/nixops/rpi.nix
+++ b/nixops/rpi.nix
@@ -2,7 +2,7 @@
 
 { config, pkgs, ... }:
 let
-  m-labs = import (fetchTarball https://nixbld.m-labs.hk/channel/custom/artiq/full/artiq-full/nixexprs.tar.xz) { inherit pkgs; };
+  artiq = builtins.getFlake git+https://github.com/m-labs/artiq.git;
 in
 {
   deployment.targetHost = host;
@@ -67,13 +67,15 @@ in
     };
   };
   security.sudo.wheelNeedsPassword = false;
-  services.udev.packages = [ m-labs.openocd ];
+  services.udev.packages = [ artiq.packages.x86_64-linux.openocd-bscanspi ];
   services.udev.extraRules = (import ./extra-udev.nix);
 
   documentation.enable = false;
   environment.systemPackages = with pkgs; [
-    psmisc wget vim git sshfs usbutils uhubctl lm_sensors file mosh tmux m-labs.openocd screen gdb minicom picocom
+    psmisc wget vim git sshfs usbutils uhubctl lm_sensors file mosh tmux
+    artiq.packages.x86_64-linux.openocd-bscanspi
     # TODO xc3sprog
+    screen gdb minicom picocom
   ];
   programs.fish.enable = true;
   programs.wireshark.enable = true;