{inputs, ...}: {
  config.flake.overlays.modifications = _final: prev: {
    helm = prev.helm.overrideAttrs (oldAttrs: {
      patches = oldAttrs.patches or [] ++ [./helm.patch];
    });
  };

  config.flake.overlays.unstable-packages = final: _prev: {
    unstable = import inputs.nixpkgs-unstable {
      system = final.system;
      config.allowUnfree = true;
    };
  };

  # Shared silent presence check for the GPG smartcard (the YubiKey's OpenPGP
  # applet): `gpg --card-status` only queries the reader, never invoking
  # pinentry, so it's safe to poll without ever producing a "please insert
  # card" prompt. Used by both the mail sync timer and the Nextcloud mount
  # service to gate on `pass` being decryptable.
  config.flake.overlayPkgs.azos-card-present = pkgs:
    pkgs.writeShellScriptBin "azos-card-present" ''
      exec ${pkgs.gnupg}/bin/gpg --card-status >/dev/null 2>&1
    '';
}