{ flake-utils, hostPkgs, ... }: flake-utils.lib.eachDefaultSystem (system: {
  packages.bootstrap =
    let
      name = "bootstrap";
      buildInputs = with hostPkgs; [ libsecret coreutils nixos-anywhere ];
      script = (hostPkgs.writeScriptBin name (builtins.readFile ./bootstrap.sh)).overrideAttrs (old: {
        buildCommand = "${old.buildCommand}\n patchShebangs $out";
      });
    in
    hostPkgs.symlinkJoin {
      inherit name;
      paths = [ script ] ++ buildInputs;
      buildInputs = [ hostPkgs.makeWrapper ];
      postBuild = "wrapProgram $out/bin/${name} --set PATH $out/bin";
    };
})