{
  config,
  lib,
  pkgs,
  inputs,
  ...
}:
{
  nix = {
    daemonCPUSchedPolicy = "idle";
    daemonIOSchedClass = "idle";

    settings = {
      auto-optimise-store = true;
      # Without these, gc sweeps away eval-time-only sources (flake inputs,
      # their build deps) since they're not part of the runtime closure.
      # The next evaluation then cold-refetches everything from GitHub,
      # which is enough on its own to trip GitHub's unauthenticated rate
      # limit for large dependency trees (e.g. hermes-agent's).
      keep-outputs = true;
      keep-derivations = true;
    };

    gc = {
      automatic = true;
      options = "--delete-older-than 30d";
    };

    extraOptions = ''
      experimental-features = nix-command flakes
      warn-dirty = false
    '';

    registry = {
      nixpkgs.flake = inputs.nixpkgs;
      unstable.flake = inputs.nixpkgs-unstable;
    };
  };
  nixpkgs.config.allowUnfree = true;
}