diff --git a/checks/lints.nu b/checks/lints.nu
index b70766b..ffc2047 100644
--- a/checks/lints.nu
+++ b/checks/lints.nu
@@ -1,8 +1,10 @@
 #!/usr/bin/env nu
 
+let shell_files = ls **/*.sh | get name
 let nix_files = ls **/*.nix | where name !~ "hardware-configuration.nix|_sources" | get name
 
 let linters = [
+  ([shellcheck] ++ $shell_files)
   ([nixfmt --check --strict] ++ $nix_files)
   ([deadnix --fail] ++ $nix_files)
   ([statix check] ++ $nix_files)
diff --git a/flake.nix b/flake.nix
index 76d612f..20cbc36 100644
--- a/flake.nix
+++ b/flake.nix
@@ -37,6 +37,7 @@
     }@inputs:
     let
       system = "x86_64-linux";
+      pkgs = nixpkgs.legacyPackages.${system};
 
       vm = nixpkgs.lib.nixosSystem {
         inherit system;
@@ -96,10 +97,15 @@
       # Garbage collection root #
       ###########################
 
-      packages.${system} = {
-        default = vm.config.system.build.vm;
-      }
-      // import ./pkgs { pkgs = nixpkgs.legacyPackages.${system}; };
+      packages.${system} =
+        let
+          localPkgs = import ./pkgs { inherit pkgs; };
+        in
+        {
+          default = vm.config.system.build.vm;
+          crowdsec-hub = localPkgs.crowdsec.hub;
+          crowdsec-firewall-bouncer = localPkgs.crowdsec.firewall-bouncer;
+        };
 
       ###################
       # Utility scripts #
@@ -110,7 +116,7 @@
         run-vm = {
           type = "app";
           program =
-            (nixpkgs.legacyPackages.${system}.writeShellScript "" ''
+            (pkgs.writeShellScript "" ''
               ${vm.config.system.build.vm.outPath}/bin/run-testvm-vm
             '').outPath;
         };
@@ -125,16 +131,16 @@
             "./keys/hosts/"
             "./keys/users/"
           ];
+          nativeBuildInputs = [ sops-nix.packages.${system}.sops-import-keys-hook ];
 
-          packages = nixpkgs.lib.attrValues {
-            inherit (sops-nix.packages.${system}) sops-import-keys-hook sops-init-gpg-key;
-            inherit (deploy-rs.packages.${system}) default;
-          };
-        };
-
-        minecraft = nixpkgs.legacyPackages.${system}.mkShell {
-          packages = nixpkgs.lib.attrValues { inherit (nixpkgs.legacyPackages.${system}) packwiz; };
+          packages = with pkgs; [
+            sops-nix.packages.${system}.sops-init-gpg-key
+            deploy-rs.packages.${system}.default
+            nixpkgs-fmt
+          ];
         };
       };
+
+      minecraft = nixpkgs.legacyPackages.${system}.mkShell { packages = [ pkgs.packwiz ]; };
     };
 }
diff --git a/pkgs/crowdsec/default.nix b/pkgs/crowdsec/default.nix
new file mode 100644
index 0000000..66faac3
--- /dev/null
+++ b/pkgs/crowdsec/default.nix
@@ -0,0 +1,9 @@
+{ pkgs }:
+let
+  sources = pkgs.callPackage ./_sources/generated.nix { };
+  callPackage = pkgs.lib.callPackageWith (pkgs // { inherit sources; });
+in
+{
+  hub = callPackage ./hub.nix { };
+  firewall-bouncer = callPackage ./firewall-bouncer.nix { };
+}
diff --git a/pkgs/packages/crowdsec-firewall-bouncer.nix b/pkgs/crowdsec/firewall-bouncer.nix
similarity index 100%
rename from pkgs/packages/crowdsec-firewall-bouncer.nix
rename to pkgs/crowdsec/firewall-bouncer.nix
diff --git a/pkgs/packages/crowdsec-hub.nix b/pkgs/crowdsec/hub.nix
similarity index 100%
rename from pkgs/packages/crowdsec-hub.nix
rename to pkgs/crowdsec/hub.nix
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 31335a6..0e5de7a 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -1,5 +1,5 @@
 { pkgs }:
-pkgs.lib.packagesFromDirectoryRecursive {
-  inherit (pkgs) callPackage;
-  directory = ./packages;
+{
+  crowdsec = import ./crowdsec { inherit pkgs; };
+  starbound = pkgs.callPackage ./starbound { };
 }
diff --git a/pkgs/starbound/default.nix b/pkgs/starbound/default.nix
new file mode 100644
index 0000000..26f2184
--- /dev/null
+++ b/pkgs/starbound/default.nix
@@ -0,0 +1,37 @@
+{
+  stdenv,
+  lib,
+  makeWrapper,
+  patchelf,
+  steamPackages,
+  replace-secret,
+}:
+let
+  # Use the directory in which starbound is installed so steamcmd
+  # doesn't have to be reinstalled constantly (we're using DynamicUser
+  # with StateDirectory to persist this).
+  steamcmd = steamPackages.steamcmd.override { steamRoot = "/var/lib/starbound/.steamcmd"; };
+  wrapperPath = lib.makeBinPath [
+    patchelf
+    steamcmd
+    replace-secret
+  ];
+in
+stdenv.mkDerivation {
+  name = "starbound-update-script";
+  nativeBuildInputs = [ makeWrapper ];
+  dontUnpack = true;
+  patchPhase = ''
+    interpreter="$(cat $NIX_CC/nix-support/dynamic-linker)"
+    substitute ${./launch-starbound.sh} launch-starbound --subst-var interpreter
+  '';
+  installPhase = ''
+    mkdir -p $out/bin
+    cp launch-starbound $out/bin/launch-starbound
+    chmod +x $out/bin/launch-starbound
+  '';
+  postFixup = ''
+    wrapProgram $out/bin/launch-starbound \
+        --prefix PATH : "${wrapperPath}"
+  '';
+}
diff --git a/pkgs/starbound/launch-starbound.sh b/pkgs/starbound/launch-starbound.sh
new file mode 100644
index 0000000..24d4db1
--- /dev/null
+++ b/pkgs/starbound/launch-starbound.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+set -eu
+
+if ! [[ -v STATE_DIRECTORY  &&  -v CREDENTIALS_DIRECTORY ]]; then
+    echo "Error: Runtime dir or credential not set"
+    exit 1
+fi
+
+# Update the server to the latest version
+echo "Updating/installing starbound"
+
+mkdir -p "${STATE_DIRECTORY}/.steamcmd"
+steamcmd <<EOF
+force_install_dir $STATE_DIRECTORY
+login tlater $(cat "$CREDENTIALS_DIRECTORY/steam")
+app_update 211820
+quit
+EOF
+
+echo "Updating config"
+if [ -f "$1" ]; then
+    mkdir -p ./storage
+    cp "$1" ./storage/starbound_server.config
+fi
+
+echo "Running starbound server"
+patchelf --set-interpreter '@interpreter@' ./linux/starbound_server
+# Must be run from the directory that the binary is in (why do game
+# devs do this?)
+cd linux
+./starbound_server
diff --git a/pkgs/update.nu b/pkgs/update.nu
deleted file mode 100644
index 0ed1bc1..0000000
--- a/pkgs/update.nu
+++ /dev/null
@@ -1,23 +0,0 @@
-use std/log
-
-let packages_with_updatescript = (
-  nix flake show --json
-  | from json
-  | $in.packages.x86_64-linux
-  | columns
-  | filter {|p| nix eval $'.#($p)' --apply 'builtins.hasAttr "updateScript"' | $in == 'true' }
-)
-
-for $package in $packages_with_updatescript {
-  log info $'Updating ($package)'
-  nix run $'.#($package).updateScript'
-}
-
-log info 'Committing changes'
-
-try {
-  git add pkgs
-  git commit -m 'update(pkgs): Update sources of all downstream packages'
-} catch {
-  log warning 'No changes to commit'
-}