diff --git a/flake.lock b/flake.lock
index c2cf259..255527e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -176,6 +176,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1699781429,
+        "narHash": "sha256-UYefjidASiLORAjIvVsUHG6WBtRhM67kTjEY4XfZOFs=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e44462d6021bfe23dfb24b775cc7c390844f773d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nur": {
       "locked": {
         "lastModified": 1699994922,
@@ -234,6 +250,7 @@
         "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
+        "nixpkgs-unstable": "nixpkgs-unstable",
         "nur": "nur",
         "pre-commit-hooks": "pre-commit-hooks",
         "zigpkgs": "zigpkgs"
diff --git a/flake.nix b/flake.nix
index ba5ccc0..6c7c4aa 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,6 +2,8 @@
   description = "motiejus/config";
 
   inputs = {
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05";
     flake-utils.url = "github:numtide/flake-utils";
     flake-compat.url = "github:nix-community/flake-compat";
@@ -48,6 +50,7 @@
   outputs = {
     self,
     nixpkgs,
+    nixpkgs-unstable,
     agenix,
     deploy-rs,
     flake-utils,
@@ -76,6 +79,15 @@
       };
     deployPkgsIA64 = mkDeployPkgs "x86_64-linux";
     deployPkgsArm64 = mkDeployPkgs "aarch64-linux";
+    mkOverlays = system: [
+      nur.overlay
+      zigpkgs.overlays.default
+      (_final: _prev: {
+        pkgs-unstable = import nixpkgs-unstable {
+          inherit system;
+        };
+      })
+    ];
   in
     {
       #nixosConfigurations.vm = nixpkgs.lib.nixosSystem {
@@ -88,9 +100,10 @@
       #  specialArgs = {inherit myData;} // inputs;
       #};
 
-      nixosConfigurations.vno1-oh2 = nixpkgs.lib.nixosSystem {
+      nixosConfigurations.vno1-oh2 = nixpkgs.lib.nixosSystem rec {
         system = "x86_64-linux";
         modules = [
+          {nixpkgs.overlays = mkOverlays system;}
           ./hosts/vno1-oh2/configuration.nix
 
           ./modules
@@ -119,11 +132,10 @@
         specialArgs = {inherit myData;} // inputs;
       };
 
-      nixosConfigurations.fwminex = nixpkgs.lib.nixosSystem {
+      nixosConfigurations.fwminex = nixpkgs.lib.nixosSystem rec {
         system = "x86_64-linux";
         modules = [
-          # TODO make this generic
-          {nixpkgs.overlays = [nur.overlay zigpkgs.overlays.default];}
+          {nixpkgs.overlays = mkOverlays system;}
           ./hosts/fwminex/configuration.nix
 
           ./modules
@@ -145,8 +157,10 @@
         specialArgs = {inherit myData;} // inputs;
       };
 
-      nixosConfigurations.vno3-rp3b = nixpkgs.lib.nixosSystem {
+      nixosConfigurations.vno3-rp3b = nixpkgs.lib.nixosSystem rec {
+        system = "aarch64-linux";
         modules = [
+          {nixpkgs.overlays = mkOverlays system;}
           ./hosts/vno3-rp3b/configuration.nix
 
           ./modules
@@ -166,8 +180,10 @@
         specialArgs = {inherit myData;} // inputs;
       };
 
-      nixosConfigurations.fra1-a = nixpkgs.lib.nixosSystem {
+      nixosConfigurations.fra1-a = nixpkgs.lib.nixosSystem rec {
+        system = "aarch64-linux";
         modules = [
+          {nixpkgs.overlays = mkOverlays system;}
           ./hosts/fra1-a/configuration.nix
 
           ./modules
diff --git a/modules/services/tailscale/default.nix b/modules/services/tailscale/default.nix
index 48a9f13..3ed497d 100644
--- a/modules/services/tailscale/default.nix
+++ b/modules/services/tailscale/default.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   myData,
+  pkgs,
   ...
 }: let
   cfg = config.mj.services.tailscale;
@@ -19,6 +20,7 @@ in {
   config = mkIf cfg.enable (mkMerge [
     {
       services.tailscale.enable = true;
+      services.tailscale.package = pkgs.pkgs-unstable.tailscale;
       networking.firewall.checkReversePath = "loose";
       networking.firewall.allowedUDPPorts = [myData.ports.tailscale];
     }