diff --git a/src/dotfiles/default.nix b/src/dotfiles/default.nix
index 5b765e4..245364c 100644
--- a/src/dotfiles/default.nix
+++ b/src/dotfiles/default.nix
@@ -5,19 +5,6 @@
   root,
 }:
 let
-  util = import ./util.nix { inherit lib; };
-
-  registry = import ./registry.nix {
-    inherit lib;
-    hosts = self.nixosConfigurations;
-    root = root + "/registry";
-  };
-
-  modules = import ./modules.nix {
-    inherit util;
-    root = root + "/modules";
-  };
-
   specialArgs = {
     inherit
       inputs
@@ -27,6 +14,14 @@ let
     registry = registry.collected;
   };
 
+  util = import ./util.nix { inherit lib; };
+
+  registry = import ./registry.nix {
+    inherit lib;
+    hosts = self.nixosConfigurations;
+    root = root + "/registry";
+  };
+
   guestModules = import ./guests.nix {
     inherit
       inputs
@@ -38,6 +33,11 @@ let
     repositoryModules = modules;
     root = root + "/guests";
   };
+  modules = import ./modules.nix {
+    inherit util;
+    root = root + "/modules";
+  };
+
 in
 {
   nixosConfigurations = import ./hosts.nix {
diff --git a/src/dotfiles/registry.nix b/src/dotfiles/registry.nix
index 4a9314b..8d6c2e0 100644
--- a/src/dotfiles/registry.nix
+++ b/src/dotfiles/registry.nix
@@ -4,21 +4,39 @@
   root,
 }:
 let
-  checkType = lib.types.submodule {
-    options = {
-      assertion = lib.mkOption {
-        type = lib.types.functionTo lib.types.bool;
-        description = ''
-          Predicate run against this registry's flattened collected entries.
-        '';
-      };
+  definitions =
+    lib.mapAttrs'
+      (
+        name: _type:
+        let
+          path = root + "/${name}";
+        in
+        lib.nameValuePair (registryName name) (mkRegistry path)
+      )
+      (
+        lib.filterAttrs (name: type: type == "regular" && lib.hasSuffix ".nix" name) (builtins.readDir root)
+      );
 
-      message = lib.mkOption {
-        type = lib.types.str;
-        description = ''
-          Error message shown when this registry validation check fails.
-        '';
+  registryName = fileName: lib.removeSuffix ".nix" fileName;
+
+  mkRegistry =
+    path:
+    let
+      evaluated = lib.evalModules {
+        specialArgs.lib = registryLib;
+        modules = [
+          registryDefinitionModule
+          path
+        ];
       };
+    in
+    {
+      inherit (evaluated.config) type replicate checks;
+    };
+
+  registryLib = lib // {
+    registry = (lib.registry or { }) // {
+      inherit predicates;
     };
   };
 
@@ -27,12 +45,6 @@ let
       value: entries: builtins.length (lib.unique (map value entries)) == builtins.length entries;
   };
 
-  registryLib = lib // {
-    registry = (lib.registry or { }) // {
-      inherit predicates;
-    };
-  };
-
   registryDefinitionModule = {
     options = {
       type = lib.mkOption {
@@ -60,7 +72,23 @@ let
     };
   };
 
-  registryName = fileName: lib.removeSuffix ".nix" fileName;
+  checkType = lib.types.submodule {
+    options = {
+      assertion = lib.mkOption {
+        type = lib.types.functionTo lib.types.bool;
+        description = ''
+          Predicate run against this registry's flattened collected entries.
+        '';
+      };
+
+      message = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Error message shown when this registry validation check fails.
+        '';
+      };
+    };
+  };
 
   registryOption =
     registry:
@@ -71,50 +99,40 @@ let
         Lazily collected fleet-visible registry entries, nested by host and entry name.
       '';
     };
-
-  mkRegistry =
-    path:
-    let
-      evaluated = lib.evalModules {
-        specialArgs.lib = registryLib;
-        modules = [
-          registryDefinitionModule
-          path
-        ];
-      };
-    in
-    {
-      inherit (evaluated.config) type replicate checks;
+  withOperations =
+    registry:
+    registry
+    // {
+      join = host: entry: join registry host entry;
     };
-
-  definitions =
-    lib.mapAttrs'
-      (
-        name: _type:
-        let
-          path = root + "/${name}";
-        in
-        lib.nameValuePair (registryName name) (mkRegistry path)
-      )
-      (
-        lib.filterAttrs (name: type: type == "regular" && lib.hasSuffix ".nix" name) (builtins.readDir root)
-      );
-
-  flattenRegistryEntries =
-    registryName: data:
-    lib.concatLists (
-      lib.mapAttrsToList (
-        host: entries:
-        lib.mapAttrsToList (entry: value: {
-          path = "registry.${registryName}.${host}.${entry}";
-          inherit host entry value;
-        }) entries
-      ) data
+  join =
+    registry: host: entry:
+    lib.filterAttrs (_name: value: value != null) (
+      lib.mapAttrs (
+        registryName: _registry: (registry.${registryName}.${host} or { }).${entry} or null
+      ) definitions
     );
 
-  rawDeclarations =
-    registryName: hosts:
-    lib.mapAttrs (_hostName: host: host.config.registry.${registryName} or { }) hosts;
+  collectData =
+    { hosts }:
+    let
+      data = lib.mapAttrs (
+        registryName: registry:
+        if registry.replicate or false then
+          replicatedData registryName hosts raw.${registryName}
+        else
+          lib.mapAttrs (hostName: host: host.config.registry.${registryName}.${hostName} or { }) hosts
+      ) definitions;
+      raw = lib.mapAttrs (registryName: _registry: rawDeclarations registryName hosts) definitions;
+    in
+    assertValid data;
+
+  replicatedData =
+    registryName: hosts: raw:
+    let
+      entries = lib.mapAttrs (_entryName: entry: entry.value) (replicatedEntries registryName raw);
+    in
+    lib.mapAttrs (_hostName: _host: entries) hosts;
 
   replicatedEntries =
     registryName: raw:
@@ -148,12 +166,20 @@ let
         }
     ) { } entries;
 
-  replicatedData =
-    registryName: hosts: raw:
+  rawDeclarations =
+    registryName: hosts:
+    lib.mapAttrs (_hostName: host: host.config.registry.${registryName} or { }) hosts;
+
+  assertValid =
+    data:
     let
-      entries = lib.mapAttrs (_entryName: entry: entry.value) (replicatedEntries registryName raw);
+      assertions = validationAssertions data;
+      failures = lib.filter (assertion: !assertion.assertion) assertions;
     in
-    lib.mapAttrs (_hostName: _host: entries) hosts;
+    assert lib.assertMsg (lib.all (assertion: assertion.assertion) assertions) (
+      lib.concatMapStringsSep "\n" (assertion: assertion.message) failures
+    );
+    data;
 
   validationAssertions =
     data:
@@ -170,45 +196,18 @@ let
       ) definitions
     );
 
-  assertValid =
-    data:
-    let
-      assertions = validationAssertions data;
-      failures = lib.filter (assertion: !assertion.assertion) assertions;
-    in
-    assert lib.assertMsg (lib.all (assertion: assertion.assertion) assertions) (
-      lib.concatMapStringsSep "\n" (assertion: assertion.message) failures
-    );
-    data;
-
-  join =
-    registry: host: entry:
-    lib.filterAttrs (_name: value: value != null) (
-      lib.mapAttrs (
-        registryName: _registry: (registry.${registryName}.${host} or { }).${entry} or null
-      ) definitions
+  flattenRegistryEntries =
+    registryName: data:
+    lib.concatLists (
+      lib.mapAttrsToList (
+        host: entries:
+        lib.mapAttrsToList (entry: value: {
+          path = "registry.${registryName}.${host}.${entry}";
+          inherit host entry value;
+        }) entries
+      ) data
     );
 
-  collectData =
-    { hosts }:
-    let
-      raw = lib.mapAttrs (registryName: _registry: rawDeclarations registryName hosts) definitions;
-      data = lib.mapAttrs (
-        registryName: registry:
-        if registry.replicate or false then
-          replicatedData registryName hosts raw.${registryName}
-        else
-          lib.mapAttrs (hostName: host: host.config.registry.${registryName}.${hostName} or { }) hosts
-      ) definitions;
-    in
-    assertValid data;
-
-  withOperations =
-    registry:
-    registry
-    // {
-      join = host: entry: join registry host entry;
-    };
 in
 {
   types = lib.mapAttrs (_name: definition: definition.type) definitions;
diff --git a/src/dotfiles/util.nix b/src/dotfiles/util.nix
index 99e1ac2..df0b3a5 100644
--- a/src/dotfiles/util.nix
+++ b/src/dotfiles/util.nix
@@ -25,8 +25,8 @@ in
   deriveMac =
     name:
     let
-      hash = builtins.hashString "sha256" name;
       octet = i: builtins.substring (i * 2) 2 hash;
+      hash = builtins.hashString "sha256" name;
     in
     lib.concatStringsSep ":" (
       [ "02" ]