diff --git a/flake.lock b/flake.lock
index 6b9ae22..2d93ec0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -87,16 +87,16 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1779560665,
-        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "lastModified": 1782233679,
+        "narHash": "sha256-QyuGP5+QOtmXpy4i2X4DhBVBaySBdDKQEhqKcphcp34=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+        "rev": "667d5cf1c59585031d743c78b394b0a647537c35",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -122,7 +122,8 @@
         "flake-parts": "flake-parts",
         "nixpkgs": "nixpkgs_2",
         "process-compose-flake": "process-compose-flake",
-        "services-flake": "services-flake"
+        "services-flake": "services-flake",
+        "sops-nix": "sops-nix"
       }
     },
     "services-flake": {
@@ -140,6 +141,26 @@
         "type": "github"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782165805,
+        "narHash": "sha256-478kKQBvK6SYTOdN2h9jhKJv94nbXRbFMfuL1WshErg=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "56b24064fdcaedca53553b1a6d607fd23b613a24",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
diff --git a/flake.nix b/flake.nix
index 27979c4..f96ef32 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,7 +2,7 @@
   description = "Gebos — IoT telemetry stack on bare-metal NixOS";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     flake-parts.url = "github:hercules-ci/flake-parts";
     deploy-rs.url = "github:serokell/deploy-rs";
     process-compose-flake.url = "github:Platonic-Systems/process-compose-flake";
diff --git a/nix/hosts/common.nix b/nix/hosts/common.nix
index ab38f30..51486ba 100644
--- a/nix/hosts/common.nix
+++ b/nix/hosts/common.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 {
-  system.stateVersion = "25.05";
+  system.stateVersion = "26.05";
 
   nix.settings = {
     experimental-features = [ "nix-command" "flakes" ];
diff --git a/nix/hosts/default.nix b/nix/hosts/default.nix
index e5bf946..73296a2 100644
--- a/nix/hosts/default.nix
+++ b/nix/hosts/default.nix
@@ -9,6 +9,7 @@ let
       specialArgs = { inherit inputs; };
       modules = [
         ./common.nix
+        ./placeholder-hardware.nix
         inputs.sops-nix.nixosModules.sops
         modules.gebos-secrets
         modules.gebos-postgres
diff --git a/nix/hosts/placeholder-hardware.nix b/nix/hosts/placeholder-hardware.nix
new file mode 100644
index 0000000..ed19402
--- /dev/null
+++ b/nix/hosts/placeholder-hardware.nix
@@ -0,0 +1,24 @@
+{ lib, ... }:
+
+# SKELETON PLACEHOLDER — not a real machine description.
+#
+# The three hosts don't have actual boxes yet, but `nix flake check` evaluates
+# `system.build.toplevel` for every nixosConfiguration, which asserts a root
+# filesystem and a boot device exist. This stub satisfies those assertions so
+# the structure type-checks in CI.
+#
+# When a real machine is provisioned, generate its hardware-configuration.nix
+# (`nixos-generate-config`) and import that from the host file instead of this
+# placeholder (see the commented import in db-host.nix). Do NOT deploy a host
+# that still relies on this file — the device paths below are fictional.
+{
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+
+  boot.loader.grub = {
+    enable = true;
+    devices = [ "/dev/sda" ];
+  };
+}
diff --git a/nix/modules/gebos-postgres.nix b/nix/modules/gebos-postgres.nix
index e36eba4..b8d0dac 100644
--- a/nix/modules/gebos-postgres.nix
+++ b/nix/modules/gebos-postgres.nix
@@ -13,12 +13,20 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    # TimescaleDB ships under the non-OSI "Timescale License" (TSL), which
+    # nixpkgs flags as unfree. Allow just this package rather than opening the
+    # whole config to unfree.
+    nixpkgs.config.allowUnfreePredicate = pkg:
+      lib.elem (lib.getName pkg) [ "timescaledb" ];
+
     services.postgresql = {
       enable = true;
       package = pkgs.postgresql_17;
-      enableTCPIP = true;
+      # listen_addresses is managed explicitly below. The upstream postgresql
+      # module also defines it (via its own default / enableTCPIP), so mkForce
+      # makes this module the single source of truth and avoids the collision.
       settings = {
-        listen_addresses = lib.concatStringsSep "," cfg.listenAddresses;
+        listen_addresses = lib.mkForce (lib.concatStringsSep "," cfg.listenAddresses);
         shared_preload_libraries = "timescaledb,pg_stat_statements";
       };
       extensions = ps: with ps; [