{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

    # secure boot
    lanzaboote = {
      url = "github:nix-community/lanzaboote/v0.4.1";

      # Optional but recommended to limit the size of your system closure.
      inputs.nixpkgs.follows = "nixpkgs";
    };

    # polymc
    polymc.url = "github:PolyMC/PolyMC";
  };

  outputs = { self, nixpkgs, lanzaboote, polymc, ... }: {
    nixosConfigurations = {
      laptop = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";

        modules = [
          ./configuration.nix
          lanzaboote.nixosModules.lanzaboote

          ({ pkgs, lib, ... }: {
            environment.systemPackages = [
              # For debugging and troubleshooting Secure Boot.
              pkgs.sbctl
            ];

            nixpkgs.overlays = [ polymc.overlay ];

            # Lanzaboote currently replaces the systemd-boot module.
            # This setting is usually set to true in configuration.nix
            # generated at installation time. So we force it to false
            # for now.
            boot = {
              initrd.systemd.enable = true;
              loader.systemd-boot.enable = lib.mkForce false;

              lanzaboote = {
                enable = true;
                pkiBundle = "/etc/secureboot";
              };
            };
          })
        ];
      };
    };
  };
}