diff --git a/.envrc b/.envrc
index 1019489..d7340b3 100644
--- a/.envrc
+++ b/.envrc
@@ -1,6 +1,11 @@
 #!/usr/bin/env bash
-git config --local core.hooksPath "$PWD"/.githooks
+# https://direnv.net/man/direnv-stdlib.1.html
 
+# TODO:
+# git config --local core.hooksPath "$PWD"/.githooks
+
+# ensure (dirty) updated flake lock
+# TODO: cache this on gitea? Run in background?
 test -d .direnv || mkdir -p .direnv
 now="$(date +%Y-%m-%d)"
 if ! test -s .direnv/pull-date || test "$now" != "$(cat .direnv/pull-date)"; then
@@ -8,11 +13,15 @@ if ! test -s .direnv/pull-date || test "$now" != "$(cat .direnv/pull-date)"; the
   git restore flake.lock
   git pull --rebase --autostash
   grep -q "^=======" flake.lock && { git reset flake.lock; rm flake.lock; }
-  nix flake update
+  # nix flake update
+  nix eval --file flake.nix --apply 'x: builtins.attrNames x.inputs' --json \
+    | jq .[] -r \
+    | grep -v '^nixpkgs-expensive$' \
+    |  nix flake update
   echo "$now" > .direnv/pull-date
 fi
 
-
+# source env
 if ! test -f .remote.toml; then
   use flake .#envrc-local
 else
diff --git a/flake.nix b/flake.nix
index fc7f1e8..b082752 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,6 +18,9 @@
     nixpkgs-1909.url = "github:NixOS/nixpkgs/nixos-19.09"; # for old docs
     nixpkgs-1909.flake = false; # Earlier versions are not flake-pure
 
+    # expensive to bump
+    # nixpkgs-expensive.url = "github:NixOS/nixpkgs/nixos-unstable";
+
     # https://github.com/nix-community/home-manager
     home-manager-edge.url = "github:nix-community/home-manager/master";
     home-manager-edge.inputs.nixpkgs.follows = "nixpkgs-edge";