diff --git a/docs/dictionary.md b/docs/dictionary.md
index 14e12b9..679a1be 100644
--- a/docs/dictionary.md
+++ b/docs/dictionary.md
@@ -51,9 +51,9 @@ Use the simplest accurate word when a term is not listed.
 | forge | Git | A web service that hosts Git repositories, pull requests, issues, and code review comments. Use when the exact provider does not matter. |
 | flake | Nix | A Nix project with pinned inputs and declared outputs. Use for the repository-level build unit defined by `flake.nix`. |
 | assembly file | Nix | A Nix file under `flake/` that constructs flake outputs or arguments passed to NixOS modules. |
-| assembly function | Nix | A project function exposed under `dotfiles` because it creates modules, systems, or assembly values. |
+| assembly function | Nix | A project function exposed under `flake` because it creates modules, systems, or assembly values. |
 | library file | Nix | A Nix file that defines reusable project functions instead of a NixOS module or flake output. |
-| library function | Nix | A pure project function exposed under `dotfiles.lib`. |
+| library function | Nix | A pure project function exposed under `flake.lib`. |
 | NixOS module | Nix | A Nix file evaluated by `nixosSystem` for a NixOS configuration. |
 | overlay | Nix | A function that modifies a Nix package set by adding or replacing packages. |
 | workspace | Window management | A named or numbered group of windows in a graphical session. Some desktop environments call this a virtual desktop. |
diff --git a/docs/nix.md b/docs/nix.md
index a2f6149..e826e0a 100644
--- a/docs/nix.md
+++ b/docs/nix.md
@@ -10,14 +10,14 @@ Read this document with `docs/dictionary.md`.
 
 Use `lib` only for the base `nixpkgs.lib` value.
 Do not use `lib` for project functions.
-Use `dotfiles.lib` for library functions passed through module arguments.
-Use `dotfiles.mk<Name>` for assembly functions passed through module arguments.
+Use `flake.lib` for library functions passed through module arguments.
+Use `flake.mk<Name>` for assembly functions passed through module arguments.
 
 Avoid:
 
 ```nix
 {
-  lib = dotfilesFunctions;
+  lib = projectFunctions;
 }
 ```
 
@@ -26,26 +26,26 @@ Use:
 ```nix
 {
   lib = nixpkgs.lib;
-  dotfiles.lib = dotfilesFunctions;
+  flake.lib = projectFunctions;
 }
 ```
 
 ### Name project function namespaces by role
 
-Put pure project functions under `dotfiles.lib`.
-Put functions that create modules, systems, or assembly values under `dotfiles`.
+Put pure project functions under `flake.lib`.
+Put functions that create modules, systems, or assembly values under `flake`.
 This keeps data-only functions separate from functions that carry flake context.
 
 Avoid:
 
 ```nix
-dotfiles.lib.mkGuest { name = "sample"; }
+flake.lib.mkGuest { name = "sample"; }
 ```
 
 Use:
 
 ```nix
-dotfiles.mkGuest { name = "sample"; }
+flake.mkGuest { name = "sample"; }
 ```
 
 ## File Placement
diff --git a/flake/default.nix b/flake/default.nix
index e742025..57839bc 100644
--- a/flake/default.nix
+++ b/flake/default.nix
@@ -6,7 +6,7 @@
 let
   registryAssembly = import ./registry.nix { inherit lib self; };
   modules = import ./modules.nix { inherit lib; };
-  dotfilesLib = import ../lib { inherit lib; };
+  flakeLib = import ../lib { inherit lib; };
 
   moduleFiles = modules.mkModules (self + "/modules");
   guestFiles = modules.mkModules (self + "/guests");
@@ -15,17 +15,18 @@ let
 
   specialArgs = {
     inherit
-      dotfiles
+      flake
       inputs
       self
       ;
     registry = collectedRegistry;
   };
 
-  dotfiles = {
+  flake = {
+    inherit (hosts) mkHosts;
     inherit (guests) mkGuest;
 
-    lib = dotfilesLib;
+    lib = flakeLib;
   };
 
   guests = import ./guests.nix {
@@ -36,7 +37,7 @@ let
       specialArgs
       moduleFiles
       registryAssembly
-      dotfilesLib
+      flakeLib
       ;
   };
 
@@ -52,6 +53,4 @@ let
       ;
   };
 in
-{
-  inherit (hosts) mkHosts;
-}
+flake
diff --git a/flake/guests.nix b/flake/guests.nix
index e3df47b..0df16f3 100644
--- a/flake/guests.nix
+++ b/flake/guests.nix
@@ -5,7 +5,7 @@
   specialArgs,
   moduleFiles,
   registryAssembly,
-  dotfilesLib,
+  flakeLib,
 }:
 let
   mkGuest =
@@ -103,7 +103,7 @@ let
         };
         mac = lib.mkOption {
           type = lib.types.str;
-          default = dotfilesLib.deriveMac name;
+          default = flakeLib.deriveMac name;
           defaultText = lib.literalMD "a stable address derived from the guest's namespace path";
           example = "bc:24:11:00:00:01";
           description = ''
@@ -306,7 +306,7 @@ let
             }
             (lib.mkIf networked (
               let
-                bridgeDevice = "sys-subsystem-net-devices-${lib.replaceStrings [ "-" ] [ "\\x2d" ] (dotfilesLib.bridgeName cfg.vlan)}.device";
+                bridgeDevice = "sys-subsystem-net-devices-${lib.replaceStrings [ "-" ] [ "\\x2d" ] (flakeLib.bridgeName cfg.vlan)}.device";
               in
               {
                 after = [ bridgeDevice ];
@@ -319,7 +319,7 @@ let
         containers.${machineName} = lib.mkIf (cfg.backend == "container") {
           autoStart = cfg.autoStart;
           privateNetwork = lib.mkDefault true;
-          hostBridge = lib.mkIf networked (dotfilesLib.bridgeName cfg.vlan);
+          hostBridge = lib.mkIf networked (flakeLib.bridgeName cfg.vlan);
           privateUsers = lib.mkDefault "no";
           additionalCapabilities = lib.optionals cfg.nesting [ "CAP_NET_ADMIN" ];
           allowedDevices = lib.optionals cfg.nesting [
diff --git a/guests/actualbudget.nix b/guests/actualbudget.nix
index 037eee6..fbfb352 100644
--- a/guests/actualbudget.nix
+++ b/guests/actualbudget.nix
@@ -1,7 +1,7 @@
 {
   config,
   lib,
-  dotfiles,
+  flake,
   ...
 }:
 let
@@ -10,7 +10,7 @@ let
 in
 {
   imports = [
-    (dotfiles.mkGuest {
+    (flake.mkGuest {
       name = "actualbudget";
       interior = {
         modules.services.actualbudget = {
diff --git a/guests/copyparty.nix b/guests/copyparty.nix
index 03523cc..5f73fd9 100644
--- a/guests/copyparty.nix
+++ b/guests/copyparty.nix
@@ -1,7 +1,7 @@
 {
   config,
   lib,
-  dotfiles,
+  flake,
   ...
 }:
 let
@@ -35,7 +35,7 @@ let
 in
 {
   imports = [
-    (dotfiles.mkGuest {
+    (flake.mkGuest {
       name = "copyparty";
       interior = {
         modules.services.copyparty = {
diff --git a/guests/nesting-sample.nix b/guests/nesting-sample.nix
index 302bd0d..5ecd5c5 100644
--- a/guests/nesting-sample.nix
+++ b/guests/nesting-sample.nix
@@ -1,7 +1,7 @@
-args@{ dotfiles, ... }:
+args@{ flake, ... }:
 # A sample guest whose interior runs an OCI container on Podman.
 # The image is pulled at runtime, so the guest builds with no build-time fetch.
-dotfiles.mkGuest {
+flake.mkGuest {
   name = "nesting-sample";
   interior = {
     virtualisation.oci-containers.containers.hello = {
diff --git a/guests/reverse-proxy.nix b/guests/reverse-proxy.nix
index 98200b1..b71d316 100644
--- a/guests/reverse-proxy.nix
+++ b/guests/reverse-proxy.nix
@@ -1,7 +1,7 @@
 {
   config,
   lib,
-  dotfiles,
+  flake,
   ...
 }:
 let
@@ -9,7 +9,7 @@ let
 in
 {
   imports = [
-    (dotfiles.mkGuest {
+    (flake.mkGuest {
       name = "reverse-proxy";
       interior = {
         modules.services.reverse-proxy.enable = true;
diff --git a/guests/sample.nix b/guests/sample.nix
index a4a761d..7651aa2 100644
--- a/guests/sample.nix
+++ b/guests/sample.nix
@@ -1,5 +1,5 @@
-args@{ dotfiles, ... }:
+args@{ flake, ... }:
 # The tracer-bullet guest: the thinnest complete path from discovery to a
 # running nested container. Its interior is just the guest-base — the baseline
 # toolset and SSH access — so it proves the concept without carrying a service.
-dotfiles.mkGuest { name = "sample"; } args
+flake.mkGuest { name = "sample"; } args
diff --git a/modules/default.nix b/modules/default.nix
index e4cba84..ca7f6bc 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -1,7 +1,7 @@
 {
   config,
   lib,
-  dotfiles,
+  flake,
   pkgs,
   inputs,
   ...
@@ -64,7 +64,7 @@ in
       useGlobalPkgs = true;
       useUserPackages = true;
       extraSpecialArgs = {
-        inherit dotfiles inputs;
+        inherit flake inputs;
       };
       users.${user.name} = {
         home.username = user.name;
diff --git a/modules/network/vlans.nix b/modules/network/vlans.nix
index dd2fb9a..311851d 100644
--- a/modules/network/vlans.nix
+++ b/modules/network/vlans.nix
@@ -1,14 +1,14 @@
 {
   config,
   lib,
-  dotfiles,
+  flake,
   ...
 }:
 # The host networking foundation: per-VLAN bridges over a tagged trunk.
 let
   cfg = config.modules.network.vlans;
 
-  inherit (dotfiles.lib) bridgeName;
+  inherit (flake.lib) bridgeName;
 
   vlanName = id: "${cfg.trunk}.${toString id}";
 in