{
  description = "oleks's personal Flake hub – a place to publish custom packages and overlays";

  inputs = {
    fleet-pins.url = "git+https://git.oleks.space/oleks/fleet-pins?ref=main";
    nixpkgs.follows = "fleet-pins/nixpkgs-projects";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs =
    {
      self,
      nixpkgs,
      fleet-pins,
      flake-utils,
      ...
    }:
    let
      # Systems that have native builders
      buildSystems = [
        "x86_64-linux"
        "aarch64-linux"
      ];

      # Cross-compilation targets from x86_64-linux
      crossTargets = {
        "s390x-linux" = "s390x-linux";
      };

      mkPackages = pkgs: {
        hello-world = pkgs.callPackage ./packages/hello-world.nix { };
        geesefs = pkgs.callPackage ./packages/geesefs.nix { };
        xonsh = pkgs.callPackage ./packages/xonsh.nix {
          xonsh-unwrapped = import ./packages/xonsh-unwrapped.nix {
            inherit (pkgs) lib python3Packages fetchFromGitHub;
          };
        };
      };

      # Overlays needed for s390x cross-compilation of attic-client
      s390xOverlays = [
        # OpenSSL s390x assembly uses z10 instructions (cijne) that the
        # nix-bootstrapped assembler doesn't recognize
        (final: prev: {
          openssl = prev.openssl.overrideAttrs (old: {
            configureFlags = (old.configureFlags or [ ]) ++ [ "no-asm" ];
          });
        })
        # musl doesn't support s390x long double (IBM double-double format:
        # LDBL_MANT_DIG=106, sizeof=16). Make musl appear unavailable so
        # busybox-sandbox-shell uses glibc static instead.
        (final: prev: {
          busybox-sandbox-shell = prev.busybox-sandbox-shell.override {
            musl = prev.musl // {
              meta = prev.musl.meta // {
                platforms = [ ];
              };
            };
          };
        })
        # libarchive tests fail in k8s pod sandboxes
        (final: prev: {
          libarchive = prev.libarchive.overrideAttrs (_: {
            doCheck = false;
          });
        })
        # nix 2.28 is a direct dependency of attic-client — disable tests
        # and fix missing RPATH for boost/zstd/libarchive
        (final: prev: {
          nixVersions = prev.nixVersions // {
            nix_2_28 = prev.nixVersions.nix_2_28.overrideAttrs (old: {
              doCheck = false;
              doInstallCheck = false;
              nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ final.patchelf ];
              postFixup = (old.postFixup or "") + ''
                for rpath in ${final.boost}/lib ${final.zstd.out}/lib ${final.libarchive.out}/lib; do
                  patchelf --add-rpath "$rpath" $out/bin/nix
                  for lib in $out/lib/lib*.so; do
                    [ -f "$lib" ] && patchelf --add-rpath "$rpath" "$lib"
                  done
                done
              '';
            });
          };
        })
        # LLVM test failures in CI pod environment — override libllvm
        # (not llvm) so it propagates through rustc bootstrap chain
        (final: prev: {
          llvmPackages = prev.llvmPackages // {
            libllvm = prev.llvmPackages.libllvm.overrideAttrs (old: {
              doCheck = false;
              doInstallCheck = false;
              nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ prev.gitMinimal ];
            });
          };
        })
      ];

      # Native builds
      native = flake-utils.lib.eachSystem buildSystems (
        system:
        let
          pkgs = import nixpkgs { inherit system; };
          packages = mkPackages pkgs;
        in
        {
          packages = packages // {
            default = packages.hello-world;
          };

          overlays.default = final: prev: mkPackages final;

          devShells.default = pkgs.mkShell {
            name = "oleks-hub-shell";
            buildInputs = [ self.packages.${system}.default ];
            nativeBuildInputs = with pkgs; [
              nix
              fmt
            ];
            shellHook = ''
              echo "Welcome to the oleks Flake hub development shell."
            '';
          };
        }
      );

      # Cross-compiled builds (built from x86_64-linux)
      cross = builtins.listToAttrs (
        builtins.map (
          target:
          let
            targetOverlays =
              {
                "s390x-linux" = s390xOverlays;
              }
              .${target} or [ ];
            pkgs = import nixpkgs {
              system = "x86_64-linux";
              crossSystem.config =
                nixpkgs.lib.systems.examples.${
                  {
                    "s390x-linux" = "s390x";
                  }
                  .${target}
                }.config;
              overlays = targetOverlays;
            };
            packages = mkPackages pkgs;
            crossOnlyPackages =
              {
                "s390x-linux" = {
                  inherit (pkgs) attic-client;
                };
              }
              .${target} or { };
          in
          {
            name = target;
            value =
              packages
              // crossOnlyPackages
              // {
                default = packages.hello-world;
              };
          }
        ) (builtins.attrNames crossTargets)
      );
    in
    native
    // {
      packages = (native.packages or { }) // cross;
    };
}