diff --git a/hosts/web-2/bubblesort.nix b/hosts/web-2/bubblesort.nix
index 5247378..2303285 100644
--- a/hosts/web-2/bubblesort.nix
+++ b/hosts/web-2/bubblesort.nix
@@ -1,13 +1,13 @@
-{ ... }:
+{ pkgs, ... }:
 {
   services.nginx.virtualHosts = {
     "bubblesort.clerie.de" = {
       enableACME = true;
       forceSSL = true;
-      root = fetchGit {
+      root = pkgs.fetchgit {
         url = "https://git.clerie.de/clerie/bubblesort_js.git";
-        ref = "main";
         rev = "39d54701a11f4fb48d7e023e384a848e6bde5640";
+        sha256 = "sha256-au/sbTVLDER0BbXD6cKJIpq0GcS/saiRQw46mZQWsO0=";
       };
     };
   };
diff --git a/hosts/web-2/clerie.nix b/hosts/web-2/clerie.nix
index 1d3e0ac..9b0ac76 100644
--- a/hosts/web-2/clerie.nix
+++ b/hosts/web-2/clerie.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ pkgs, ... }:
 
 {
   services.nginx.virtualHosts = {
@@ -13,10 +13,10 @@
     "clerie.de" = {
       enableACME = true;
       forceSSL = true;
-      root = fetchGit {
+      root = pkgs.fetchgit {
         url = "https://git.clerie.de/clerie/clerie.de.git";
-        ref = "main";
         rev = "67738c06cff85e2cefbea87d45c277bd01a3778a";
+        sha256 = "sha256-CfoCNurVaE2f6C43UA7IW1dihPb3Xx7nWVnsaAGb/Ew=";
       };
       locations."~ ^/.well-known/openpgpkey/hu/[a-z0-9]+/?$" = {
         extraConfig = ''
diff --git a/hosts/web-2/milchinsel.nix b/hosts/web-2/milchinsel.nix
index 322d911..bb2355a 100644
--- a/hosts/web-2/milchinsel.nix
+++ b/hosts/web-2/milchinsel.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ pkgs, ... }:
 
 {
   services.nginx.virtualHosts = {
@@ -13,10 +13,10 @@
     "milchinsel.de" = {
       enableACME = true;
       forceSSL = true;
-      root = fetchGit {
+      root = pkgs.fetchgit {
         url = "https://git.clerie.de/clerie/milchinsel.de.git";
-        ref = "master";
         rev = "8ca6727902fb5a2581b56c4b3ab8d01585f3acb0";
+        sha256 = "sha256-JYdEZDLLojsgWwfJYR1riBUhs73/mdlVSOeLUgnqNhg=";
       };
     };
   };
diff --git a/hosts/web-2/ping.nix b/hosts/web-2/ping.nix
index c386e8a..70e5d13 100644
--- a/hosts/web-2/ping.nix
+++ b/hosts/web-2/ping.nix
@@ -1,14 +1,14 @@
-{ ... }:
+{ pkgs, ... }:
 
 {
   services.nginx.virtualHosts = {
     "ping.clerie.de" = {
       enableACME = true;
       addSSL = true;
-      root = fetchGit {
+      root = pkgs.fetchgit {
         url = "https://git.clerie.de/clerie/ping.clerie.de.git";
-        ref = "main";
         rev = "c9c0849e1f63fd2e3aeeba8ce19ec44065a5d563";
+        sha256 = "sha256-w6YG8qtuAVR7ET9pI/j8UMhF3JLDywLbD6DbM/Huyzw=";
       };
       /*
       locations."= /" = {
diff --git a/hosts/web-2/prediger.nix b/hosts/web-2/prediger.nix
index ff24da4..af22070 100644
--- a/hosts/web-2/prediger.nix
+++ b/hosts/web-2/prediger.nix
@@ -1,20 +1,20 @@
-{ ... }:
+{ pkgs, ... }:
 
 {
   services.nginx.virtualHosts = {
     "prediger.riese.space" = {
       enableACME = true;
       forceSSL = true;
-      root = fetchGit {
+      root = pkgs.fetchgit {
         url = "https://git.clerie.de/clerie/prediger.riese.space.git";
-        ref = "main";
         rev = "7f51e884ccf8a258838adb1d825bc51eeef2f475";
+        sha256 = "sha256-tL+k9l0fX4dc971y4EWGM++BvjfnvRAtU/LvS2QYANU=";
       };
       locations."/map/" = {
-        alias = fetchGit {
+        alias = pkgs.fetchgit {
           url = "https://git.clerie.de/quiribi/Prediger-workadventure.git";
-          ref = "master";
           rev = "304850367aad275c3410005580313dac7fe24788";
+          sha256 = "sha256-t6C7k5p6ZKfQedumTqxEmGYQqgaE3OiK5q41dDWnz/Y=";
         } + "/";
         extraConfig = ''
           add_header Access-Control-Allow-Origin *;
diff --git a/hosts/web-2/reichartstrasse.nix b/hosts/web-2/reichartstrasse.nix
index 8814083..e2ae1e1 100644
--- a/hosts/web-2/reichartstrasse.nix
+++ b/hosts/web-2/reichartstrasse.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ pkgs, ... }:
 
 {
   services.nginx.virtualHosts = {
@@ -13,10 +13,10 @@
     "reichartstrasse.de" = {
       enableACME = true;
       forceSSL = true;
-      root = fetchGit {
+      root = pkgs.fetchgit {
         url = "https://git.clerie.de/clerie/reichartstrasse.de.git";
-        ref = "master";
         rev = "377e27d8a8d4b701fa7da072d3f3e68925c5f274";
+        sha256 = "sha256-eOljD7TsSmE8LpNd/3kKAPBLvNVpED7FN9++srOALOU=";
       };
     };
   };
diff --git a/pkgs/iot-data/default.nix b/pkgs/iot-data/default.nix
index 22b1852..8fa9898 100644
--- a/pkgs/iot-data/default.nix
+++ b/pkgs/iot-data/default.nix
@@ -1,14 +1,15 @@
 {
+  pkgs,
   buildPythonPackage,
   flask,
   python3,
 }:
 
 let
-  src = fetchGit {
+  src = pkgs.fetchgit {
     url = "https://git.clerie.de/clerie/iot-data.git";
-    ref = "main";
     rev = "f60e3a3f89549b4ce88df20888c08a01062d086a";
+    sha256 = "sha256-D8wusJfYbOkL/Nq6yfYBvhnkBmRcDktORicUpDsIrUE=";
   };
   pname = "iot-data";
   version = "0.0.1";
diff --git a/pkgs/uptimestatus/default.nix b/pkgs/uptimestatus/default.nix
index 81a25ed..74a127a 100644
--- a/pkgs/uptimestatus/default.nix
+++ b/pkgs/uptimestatus/default.nix
@@ -1,4 +1,5 @@
 {
+  pkgs,
   buildPythonPackage,
   flask,
   requests,
@@ -6,10 +7,10 @@
 }:
 
 let
-  src = fetchGit {
+  src = pkgs.fetchgit {
     url = "https://git.clerie.de/clerie/uptime-status.git";
-    ref = "main";
     rev = "caacaced97617838bbd9b7b91a4e3d06e411139b";
+    sha256 = "sha256-qVvUZ+j2JnG26Fl/UcfpjY30RQjAPqCCwbxtz/+r/dU=";
   };
   pname = "uptimestatus";
   version = "0.0.1";
diff --git a/pkgs/wetter/default.nix b/pkgs/wetter/default.nix
index 4cfc165..658be06 100644
--- a/pkgs/wetter/default.nix
+++ b/pkgs/wetter/default.nix
@@ -1,4 +1,5 @@
 {
+  pkgs,
   buildPythonPackage,
   flask,
   flask_sqlalchemy,
@@ -7,7 +8,6 @@
   yarn2nix-moretea,
   nodejs,
   pkg-config,
-  pkgs,
   psycopg2,
   python3,
   stdenv,
@@ -16,10 +16,10 @@
 }:
 
 let
-  src = fetchGit {
+  src = pkgs.fetchgit {
     url = "https://git.clerie.de/clerie/wetter.git";
-    ref = "master";
     rev = "3193c6d507af5d6f5d62c23046b7fbf0c638ddb4";
+    sha256 = "sha256-ouUmmw020jKg/SRlYhGBFRw/atxW+atQ1JSTFQNi5iw=";
   };
   pname = "wetter";
   version = "0.0.1";