diff --git a/configs/nixos/registry/address.nix b/configs/nixos/registry/address.nix
index 3f4eb65..a338dee 100644
--- a/configs/nixos/registry/address.nix
+++ b/configs/nixos/registry/address.nix
@@ -1,10 +1,10 @@
-{ lib, ... }:
+{ lib, util, ... }:
 {
   type = lib.types.str;
 
   checks = [
     {
-      assertion = lib.registry.predicates.uniqueValue (entry: entry.value);
+      assertion = util.registry.predicates.uniqueValue (entry: entry.value);
       message = "Address registry values must be unique.";
     }
   ];
diff --git a/configs/nixos/registry/route.nix b/configs/nixos/registry/route.nix
index 65e7857..fc69b87 100644
--- a/configs/nixos/registry/route.nix
+++ b/configs/nixos/registry/route.nix
@@ -1,14 +1,14 @@
-{ lib, ... }:
+{ lib, util, ... }:
 {
   checks = [
     {
-      assertion = lib.registry.predicates.uniqueValue (entry: entry.value.domain);
+      assertion = util.registry.predicates.uniqueValue (entry: entry.value.domain);
       message = "Route domains must be unique.";
     }
     {
       assertion =
         entries:
-        lib.registry.predicates.uniqueValue (entry: entry.value) (
+        util.registry.predicates.uniqueValue (entry: entry.value) (
           lib.concatMap (entry: map (port: entry // { value = port; }) entry.value.udp.ports) entries
         );
       message = "Route UDP ports must be unique.";
diff --git a/src/dotfiles/registry.nix b/src/dotfiles/registry.nix
index c1ac884..d0ce789 100644
--- a/src/dotfiles/registry.nix
+++ b/src/dotfiles/registry.nix
@@ -13,9 +13,9 @@ let
     path:
     let
       evaluated = lib.evalModules {
-        specialArgs.lib = registryLib;
+        specialArgs = { inherit util; };
         modules = [
-          registryDefinitionModule
+          (import ./registry/schema.nix { inherit lib; })
           path
         ];
       };
@@ -24,62 +24,6 @@ let
       inherit (evaluated.config) type replicate checks;
     };
 
-  registryLib = lib // {
-    registry = (lib.registry or { }) // {
-      inherit predicates;
-    };
-  };
-
-  predicates = {
-    uniqueValue =
-      value: entries: builtins.length (lib.unique (map value entries)) == builtins.length entries;
-  };
-
-  registryDefinitionModule = {
-    options = {
-      type = lib.mkOption {
-        type = lib.types.raw;
-        description = ''
-          NixOS option type for one registry entry.
-        '';
-      };
-
-      replicate = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          Whether collected entries are merged and published under every host key.
-        '';
-      };
-
-      checks = lib.mkOption {
-        type = lib.types.listOf checkType;
-        default = [ ];
-        description = ''
-          Validation checks for this registry's flattened collected entries.
-        '';
-      };
-    };
-  };
-
-  checkType = lib.types.submodule {
-    options = {
-      assertion = lib.mkOption {
-        type = lib.types.functionTo lib.types.bool;
-        description = ''
-          Predicate run against this registry's flattened collected entries.
-        '';
-      };
-
-      message = lib.mkOption {
-        type = lib.types.str;
-        description = ''
-          Error message shown when this registry validation check fails.
-        '';
-      };
-    };
-  };
-
   registryOption =
     registry:
     lib.mkOption {
diff --git a/src/dotfiles/registry/schema.nix b/src/dotfiles/registry/schema.nix
new file mode 100644
index 0000000..fdd9a0a
--- /dev/null
+++ b/src/dotfiles/registry/schema.nix
@@ -0,0 +1,46 @@
+{ lib }:
+let
+  checkType = lib.types.submodule {
+    options = {
+      assertion = lib.mkOption {
+        type = lib.types.functionTo lib.types.bool;
+        description = ''
+          Predicate run against this registry's flattened collected entries.
+        '';
+      };
+
+      message = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Error message shown when this registry validation check fails.
+        '';
+      };
+    };
+  };
+in
+{
+  options = {
+    type = lib.mkOption {
+      type = lib.types.raw;
+      description = ''
+        NixOS option type for one registry entry.
+      '';
+    };
+
+    replicate = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether collected entries are merged and published under every host key.
+      '';
+    };
+
+    checks = lib.mkOption {
+      type = lib.types.listOf checkType;
+      default = [ ];
+      description = ''
+        Validation checks for this registry's flattened collected entries.
+      '';
+    };
+  };
+}
diff --git a/src/dotfiles/util.nix b/src/dotfiles/util.nix
index 56c5e99..a38ca34 100644
--- a/src/dotfiles/util.nix
+++ b/src/dotfiles/util.nix
@@ -22,6 +22,9 @@ in
 
   removeNixSuffix = path: lib.removeSuffix ".nix" (builtins.baseNameOf path);
 
+  registry.predicates.uniqueValue =
+    value: entries: builtins.length (lib.unique (map value entries)) == builtins.length entries;
+
   bridgeName = id: "br-vlan${toString id}";
 
   deriveMac =