diff --git a/hosts/common/default.nix b/hosts/common/default.nix
index 36a5f420..a3caefd7 100644
--- a/hosts/common/default.nix
+++ b/hosts/common/default.nix
@@ -64,21 +64,13 @@
     users."${username}" = import ./home.nix;
   };
 
-  nixpkgs = {
-    config = {
-      allowUnfree = true;
+  nixpkgs.overlays = [
+    inputs.nur.overlays.default
 
-      permittedInsecurePackages = [ "electron-27.3.11" ];
-    };
-
-    overlays = [
-      inputs.nur.overlays.default
-
-      outputs.overlays.additions
-      outputs.overlays.modifications
-      outputs.overlays.stable-packages
-    ];
-  };
+    outputs.overlays.additions
+    outputs.overlays.modifications
+    outputs.overlays.stable-packages
+  ];
 
   nix.extraOptions = ''
     trusted-users = root ${username}
diff --git a/hosts/common/home.nix b/hosts/common/home.nix
index 23426d12..1f67d1e1 100644
--- a/hosts/common/home.nix
+++ b/hosts/common/home.nix
@@ -9,8 +9,6 @@ let
   pkgs = import inputs.nixpkgs {
     inherit system;
 
-    config.allowUnfree = true;
-
     overlays = [
       outputs.overlays.additions
       outputs.overlays.stable-packages
diff --git a/hosts/t480/configuration.nix b/hosts/t480/configuration.nix
index 90f3f4ea..6fcb1142 100644
--- a/hosts/t480/configuration.nix
+++ b/hosts/t480/configuration.nix
@@ -89,7 +89,6 @@
     peek
     pmutils
     shotwell
-    slack
     stable.gscan2pdf
     sxiv
     tailscale
@@ -97,6 +96,5 @@
     xcape
     xsel
     yt-dlp
-    zoom-us
   ];
 }
diff --git a/modules2/browsers/librewolf/extensions.nix b/modules2/browsers/librewolf/extensions.nix
index 3e7f7600..43e0fb83 100644
--- a/modules2/browsers/librewolf/extensions.nix
+++ b/modules2/browsers/librewolf/extensions.nix
@@ -7,7 +7,6 @@
           awesome-rss
           bitwarden
           darkreader
-          onetab
           tree-style-tab
           ublock-origin
           videospeed
diff --git a/modules2/games/steam.nix b/modules2/games/steam.nix
index 2fe1e902..b87865eb 100644
--- a/modules2/games/steam.nix
+++ b/modules2/games/steam.nix
@@ -1,3 +1,8 @@
 {
+  nixpkgs.allowedUnfreePackages = [
+    "steam"
+    "steam-unwrapped"
+  ];
+
   flake.modules.nixos.pc.programs.steam.enable = true;
 }
diff --git a/modules2/hosts/t480/open-webui.nix b/modules2/hosts/t480/open-webui.nix
index f0bbfd77..3da64e9e 100644
--- a/modules2/hosts/t480/open-webui.nix
+++ b/modules2/hosts/t480/open-webui.nix
@@ -1,3 +1,5 @@
 {
+  nixpkgs.allowedUnfreePackages = [ "open-webui" ];
+
   flake.modules.nixos.pc.services.open-webui.enable = true;
 }
diff --git a/modules2/hosts/t480/slack.nix b/modules2/hosts/t480/slack.nix
new file mode 100644
index 00000000..97286f66
--- /dev/null
+++ b/modules2/hosts/t480/slack.nix
@@ -0,0 +1,11 @@
+{ config, ... }:
+
+{
+  nixpkgs.allowedUnfreePackages = [ "slack" ];
+
+  flake.modules.nixos."nixosConfigurations/t480" =
+    { pkgs, ... }:
+    {
+      users.users."${config.flake.meta.owner.username}".packages = [ pkgs.slack ];
+    };
+}
diff --git a/modules2/hosts/t480/zoom.nix b/modules2/hosts/t480/zoom.nix
new file mode 100644
index 00000000..6e8251c2
--- /dev/null
+++ b/modules2/hosts/t480/zoom.nix
@@ -0,0 +1,11 @@
+{ config, ... }:
+
+{
+  nixpkgs.allowedUnfreePackages = [ "zoom" ];
+
+  flake.modules.nixos."nixosConfigurations/t480" =
+    { pkgs, ... }:
+    {
+      users.users."${config.flake.meta.owner.username}".packages = [ pkgs.zoom-us ];
+    };
+}
diff --git a/modules2/makemkv.nix b/modules2/makemkv.nix
index 9e6912a8..1eb53a2d 100644
--- a/modules2/makemkv.nix
+++ b/modules2/makemkv.nix
@@ -1,6 +1,8 @@
 { config, ... }:
 
 {
+  nixpkgs.allowedUnfreePackages = [ "makemkv" ];
+
   flake.modules.nixos.pc =
     { pkgs, ... }:
     {
diff --git a/modules2/meta-output.nix b/modules2/meta-output.nix
new file mode 100644
index 00000000..dbf69e5d
--- /dev/null
+++ b/modules2/meta-output.nix
@@ -0,0 +1,7 @@
+{ lib, ... }:
+
+{
+  options.flake.meta = lib.mkOption {
+    type = lib.types.anything;
+  };
+}
diff --git a/modules2/unfree-packages.nix b/modules2/unfree-packages.nix
new file mode 100644
index 00000000..e634aa93
--- /dev/null
+++ b/modules2/unfree-packages.nix
@@ -0,0 +1,26 @@
+{ config, lib, ... }:
+
+{
+  options.nixpkgs.allowedUnfreePackages = lib.mkOption {
+    type = lib.types.listOf lib.types.str;
+    default = [ ];
+  };
+
+  config.flake = {
+    modules =
+      let
+        predicate = pkg: builtins.elem (lib.getName pkg) config.nixpkgs.allowedUnfreePackages;
+      in
+      {
+        nixos.workstation.nixpkgs.config.allowUnfreePredicate = predicate;
+
+        homeManager.base = args: {
+          nixpkgs.config = lib.mkIf (!(args.hasGlobalPkgs or false)) {
+            allowUnfreePredicate = predicate;
+          };
+        };
+      };
+
+    meta.nixpkgs.allowedUnfreePackages = config.nixpkgs.allowedUnfreePackages;
+  };
+}
diff --git a/modules2/zsh/abbreviations/abbreviations.nix b/modules2/zsh/abbreviations/abbreviations.nix
index 84610472..ed1fba0c 100644
--- a/modules2/zsh/abbreviations/abbreviations.nix
+++ b/modules2/zsh/abbreviations/abbreviations.nix
@@ -1,4 +1,8 @@
 {
+  nixpkgs.allowedUnfreePackages = [
+    "zsh-abbr"
+  ];
+
   flake.modules.homeManager.base.programs.zsh.zsh-abbr.abbreviations = {
     cl = "clear";
     cs = "create-script";