diff --git a/profiles/auto-upgrade.nix b/profiles/auto-upgrade.nix
index 662b20e..375a25d 100644
--- a/profiles/auto-upgrade.nix
+++ b/profiles/auto-upgrade.nix
@@ -2,6 +2,7 @@
 
 let
   inherit (config.virtualisation) isVmVariant;
+  inputUrls = lib.mapAttrs (input: value: value.url) (import (inputs.self + "/flake.nix")).inputs;
 in
 
 # TODO: make /etc/nixos a symlink to the in-store flake? - bad idea, horrible error recovery
@@ -26,6 +27,43 @@ in
       )
     );
 
+  environment.etc."current-system-flake-inputs-overrides.sh".enable = !isVmVariant;
+  environment.etc."current-system-flake-inputs-overrides.sh".source = pkgs.writeShellScript "with-input-overrides.sh" ''
+    if [[ $# -eq 0 ]]; then
+      echo >&2 "Example usage: $0 nix flake update --output-lock-file flake.lock"
+      exit 1
+    fi
+    set -euo pipefail
+    declare -a cmd_args=()
+    readarray -td $'\0' cmd_args < <(
+      ${lib.getExe pkgs.jq} --raw-output0 \
+        </etc/current-system-flake-inputs.json \
+        --argjson inputUrls "$(
+          nix eval --file /etc/current-system-flake/flake.nix \
+            --apply 'x: builtins.mapAttrs (input: value: value.url) x.inputs' --json
+        )" '
+          to_entries[] |
+          select(.key == "self" | not) |
+          select(.value.rev) |
+          select($inputUrls[.key]) |
+          [
+            "--override-input",
+            .key,
+            (
+              if .value.rev
+              then (if $inputUrls[.key] | startswith("github:")
+                then ($inputUrls[.key] | split("/") | .[:2] | join("/")) + "/\(.value.rev)"
+                else $inputUrls[.key] + "?rev=\(.value.rev | @uri)"
+                end)
+              else .value["store-path"]
+              end
+            )
+          ][]
+        '
+    )
+    exec "$@" "''${cmd_args[@]}"
+  '';
+
   #system.autoUpgrade.flake = inputs.self.outPath; # a nix store path
   #system.autoUpgrade.flake = "github:pbsds/nix-config"; # TODO: use this instead?
   #system.autoUpgrade.flake = "git+https://gitea.noximilien.pbsds.net/pbsds/config.git";
@@ -34,20 +72,24 @@ in
   system.autoUpgrade.flags = [
     "-L" # print build logs
     "--no-write-lock-file" # no write new flakelock, as the in-store flake is read-only
-    "--option" "access-tokens" "" # don't risk an expired github token blocking the upgrade
+    "--option" "access-tokens" "" # don't risk expired github tokens blocking upgrade
     # fetch new inputs
     #"--recreate-lock-file" # update all
-    #"--override-input" "nixpkgs-edge" # deprecated in nix 2.22, removed in lix 2.90
     "--refresh"
-    "--override-input" "nixpkgs-edge" "github:NixOS/nixpkgs/nixos-unstable"
-    "--override-input" "nixpkgs-2405" "github:NixOS/nixpkgs/nixos-24.05"
-    "--override-input" "nixpkgs-2311" "github:NixOS/nixpkgs/nixos-23.11"
-    "--override-input" "home-manager-edge" "github:nix-community/home-manager/master"
-    "--override-input" "home-manager-2405" "github:nix-community/home-manager/release-24.05"
-    "--override-input" "home-manager-2311" "github:nix-community/home-manager/release-23.11"
-    "--override-input" "nix-index-database" "github:Mic92/nix-index-database"
-    "--override-input" "nixos-hardware" "github:NixOS/nixos-hardware"
-  ];
+    #"--update-input" "nixpkgs-edge" # deprecated in nix 2.22, removed in lix 2.90
+    # "--override-input" "nixpkgs-edge" "github:NixOS/nixpkgs/nixos-unstable"
+  ] ++ (lib.pipe inputUrls [
+    (lib.filterAttrs (key: _: builtins.elem key [
+      "nixpkgs-edge"
+      "nixpkgs-2411"
+      "home-manager-edge"
+      "home-manager-2411"
+      "nix-index-database"
+      "nixos-hardware"
+    ]))
+    (lib.mapAttrsToList (input: url: ["--override-input" input url]))
+    lib.concatLists
+  ]);
 
   # lots of "empty" updates
   boot.loader.grub.configurationLimit = 15;