diff --git a/makefu/source.nix b/makefu/source.nix
index 708f0d20c..405740b5c 100644
--- a/makefu/source.nix
+++ b/makefu/source.nix
@@ -1,12 +1,13 @@
 with import <stockholm/lib>;
 host@{ name,
-  override ? {},
-  secure ? false,
-  full ? false,
-  torrent ? false,
-  hw ? false,
-  musnix ? false,
-  python ? false
+  override ? {}
+,  secure ? false
+,  full ? false
+,  torrent ? false
+,  hw ? false
+,  musnix ? false
+,  python ? false
+,  unstable ? false #unstable channel checked out
 }:
 let
   builder = if getEnv "dummy_secrets" == "true"
@@ -14,7 +15,7 @@ let
               else "makefu";
   _file = <stockholm> + "/makefu/1systems/${name}/source.nix";
   # TODO: automate updating of this ref + cherry-picks
-  ref = "51810e0"; # nixos-17.09 @ 2018-02-14
+  ref = "6b6e72b"; # nixos-17.09 @ 2018-03-07
                    # + do_sqlite3 ruby: 55a952be5b5
                    # + signal: 0f19beef3
 
@@ -53,21 +54,30 @@ in
     (mkIf ( hw ) {
       nixos-hardware.git = {
         url = https://github.com/nixos/nixos-hardware.git;
-        ref = "8a05dc9";
+        ref = "30fdd53";
       };
     })
 
     (mkIf ( python ) {
       python.git = {
         url = https://github.com/garbas/nixpkgs-python;
-        ref = "cac319b";
+        ref = "cac319b7";
       };
     })
+
     (mkIf ( torrent ) {
       torrent-secrets.file = getAttr builder {
         buildbot = toString <stockholm/makefu/6tests/data/secrets>;
         makefu = "/home/makefu/secrets/torrent" ;
       };
     })
+
+    (mkIf ( unstable ) {
+      nixpkgs-unstable.git = {
+        url = https://github.com/nixos/nixpkgs-channels;
+        ref = "nixos-unstable";
+      };
+    })
+
     override
   ]