diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index f767d20fe..4e123e723 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -47,7 +47,8 @@ types // rec {
       };
       addrs = mkOption {
         type = listOf addr;
-        apply = _: config.addrs4 ++ config.addrs6;
+        default = config.addrs4 ++ config.addrs6;
+        # TODO only default addrs make sense
       };
       addrs4 = mkOption {
         type = listOf addr4;
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 659b95065..9f412d9b8 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -14,8 +14,8 @@ in
 
   krebs.build.deps = {
     nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "4c01e6d91993b6de128795f4fbdd25f6227fb870";
+      url = https://github.com/4z3/nixpkgs;
+      rev = "03130ec91356cd250b80f144022ee2f4d665ca36"; # 1357692
     };
     secrets = {
       url = "/home/tv/secrets/${config.krebs.build.host.name}";
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 6418cdc5e..028e53539 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -10,8 +10,8 @@ with lib;
 
   krebs.build.deps = {
     nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "9d5508d85c33b8fb22d79dde6176792eac2c2696";
+      url = https://github.com/4z3/nixpkgs;
+      rev = "03130ec91356cd250b80f144022ee2f4d665ca36"; # 1357692
     };
     secrets = {
       url = "/home/tv/secrets/${config.krebs.build.host.name}";
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 20dbca12f..2233b48d1 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -14,8 +14,8 @@ in
 
   krebs.build.deps = {
     nixpkgs = {
-      url = https://github.com/NixOS/nixpkgs;
-      rev = "9d5508d85c33b8fb22d79dde6176792eac2c2696";
+      url = https://github.com/4z3/nixpkgs;
+      rev = "03130ec91356cd250b80f144022ee2f4d665ca36"; # 1357692
     };
     secrets = {
       url = "/home/tv/secrets/${config.krebs.build.host.name}";
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index 8d662494c..264cb4a1c 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -8,14 +8,14 @@ let
       enable = true;
       root-title = "public repositories at ${config.krebs.build.host.name}";
       root-desc = "keep calm and engage";
-      inherit repos rules;
+      repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) repos;
+      rules = rules;
     };
   };
 
-  repos = mapAttrs (_: s: removeAttrs s ["collaborators"]) (
+  repos =
     public-repos //
-    optionalAttrs config.krebs.build.host.secure restricted-repos
-  );
+    optionalAttrs config.krebs.build.host.secure restricted-repos;
 
   rules = concatMap make-rules (attrValues repos);
 
@@ -66,8 +66,8 @@ let
     };
   };
 
-  make-restricted-repo = name: { desc ? null, ... }: {
-    inherit name desc;
+  make-restricted-repo = name: { collaborators ? [], desc ? null, ... }: {
+    inherit name collaborators desc;
     public = false;
   };
 
diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix
index a69b1519c..26e56e09c 100644
--- a/tv/2configs/urlwatch.nix
+++ b/tv/2configs/urlwatch.nix
@@ -11,6 +11,8 @@
       # 2014-07-29 when one of the following urls change
       # then we have to update the package
 
+      http://www.exim.org/
+
       # ref src/nixpkgs/pkgs/tools/admin/sec/default.nix
       https://api.github.com/repos/simple-evcorr/sec/tags