diff --git a/.envrc b/.envrc
index db880d2..12f77e3 100644
--- a/.envrc
+++ b/.envrc
@@ -27,22 +27,7 @@ elif command -v find >/dev/null; then
   find .direnv/tmp/ -mindepth 1 -maxdepth 1 -type d -and ! -newermt "4 hours ago" -exec rm -rf {} \;
 fi
 if [[ ! -s .direnv/pull-date || "$now" != "$(cat .direnv/pull-date)" ]]; then
-  tmp=$(mktemp -p .direnv/tmp -d)
-  if ! git diff --exit-code --quiet HEAD -- flake.lock >&/dev/null; then
-    cp flake.lock "$tmp"/dirty-flake.lock
-    git reset -- flake.lock
-    git restore -- flake.lock
-    cp flake.lock "$tmp"/clean-flake.lock # we could instead preserve the current git rev
-  fi
-  git pull --rebase --autostash
-  if grep -q "^=======" flake.lock; then
-    # Can this happen anymore? Yes, if i forgot to push
-    git reset -- flake.lock
-    rm flake.lock # git restore?
-    git checkout -- flake.lock
-  elif [[ -s "$tmp"/clean-flake.lock ]] && ! diff -q "$tmp"/clean-flake.lock flake.lock >&/dev/null; then
-    cp "$tmp"/flake-dirty.lock flake.lock
-  fi
+  just pull
   direnv allow # :3
 
   # nix flake update
@@ -79,9 +64,9 @@ fi
 # source env
 use flake "$flake_shell"
 
-printf "\n"
+echo
 just motd
-printf "\n"
+echo
 
 unset -f git
 
diff --git a/justfile b/justfile
index 6f98f35..a8b31ca 100644
--- a/justfile
+++ b/justfile
@@ -32,14 +32,48 @@ report hostname=`just _a_host`:
 reports:
   nix eval .#nixosReports --json --show-trace | yq . --yaml-output --width=999999 | bat --language yaml --style plain --paging never
 
-# --option access-tokens ""
-update *_:
-  git reset flake.lock
-  git restore flake.lock
+pull: # used in .envrc, cannot be interative
+  #!/usr/bin/env -S bash -euo pipefail
+  tmp=$(mktemp -p .direnv/tmp -d)
+  if ! git diff --exit-code --quiet HEAD -- flake.lock >&/dev/null; then
+    cp flake.lock "$tmp"/dirty-flake.lock
+    git reset -- flake.lock
+    git restore -- flake.lock
+    cp flake.lock "$tmp"/clean-flake.lock # we could instead preserve the current git rev
+  fi
   git pull --rebase --autostash
-  nix flake update --commit-lock-file "$@"
-  @mkdir -p .direnv/
-  @printf "%s\n" "$(date +%Y-%m-%d)" > .direnv/pull-date
+  if grep -q "^=======" flake.lock; then
+    git reset -- flake.lock
+    rm flake.lock # git restore?
+    git checkout -- flake.lock
+  elif [[ -s "$tmp"/clean-flake.lock ]] && ! diff -q "$tmp"/clean-flake.lock flake.lock >&/dev/null; then
+    cp "$tmp"/flake-dirty.lock flake.lock
+  fi
+
+# --option access-tokens ""
+update *args: # interactive
+  #!/usr/bin/env -S bash -euo pipefail
+  args=("$@")
+  verbose() ( set -x; "$@"; )
+  if gum confirm "Pull first?" --default=yes; then
+    just pull
+  fi
+  if gum confirm "add --option access-tokens ''?" --default=no; then
+    args+=( --option access-tokens "" )
+  fi
+  if gum confirm "use --commit-lock-file?" --default=yes; then
+    verbose git reset flake.lock
+    verbose git restore flake.lock
+    # verbose git pull --rebase --autostash
+    verbose nix flake update --commit-lock-file "${args[@]}"
+  else
+    verbose nix flake update "${args[@]}"
+  fi
+  if gum confirm "prefetch inputs?" --default=yes; then
+    nix flake prefetch-inputs "${args[@]}"
+  fi
+  # mkdir -p .direnv/
+  # printf "%s\n" "$(date +%Y-%m-%d)" > .direnv/pull-date
 
 @update-select:
   git reset flake.lock
diff --git a/users/pbsds/home/profiles/minimal/nix.nix b/users/pbsds/home/profiles/minimal/nix.nix
index a148b0d..ba6cce5 100644
--- a/users/pbsds/home/profiles/minimal/nix.nix
+++ b/users/pbsds/home/profiles/minimal/nix.nix
@@ -22,8 +22,8 @@ in
     rnix  = mkArgsAlias ''nix "$@" --system riscv64-linux -j0'';
     fnom  = mkArgsAlias ''nom "$@" --system x86_64-freebsd -j0'';
     fnix  = mkArgsAlias ''nix "$@" --system x86_64-freebsd -j0'';
-    fanom  = mkArgsAlias ''nom "$@" --system aarch64-freebsd -j0'';
-    fanix  = mkArgsAlias ''nix "$@" --system aarch64-freebsd -j0'';
+    fanom = mkArgsAlias ''nom "$@" --system aarch64-freebsd -j0'';
+    fanix = mkArgsAlias ''nix "$@" --system aarch64-freebsd -j0'';
     xnom  = mkArgsAlias ''nom "$@" --system x86_64-linux -j0'';
     xnix  = mkArgsAlias ''nix "$@" --system x86_64-linux -j0'';
     anom  = mkArgsAlias ''nom "$@" --system aarch64-linux -j0'';
@@ -39,8 +39,8 @@ in
     rnix-build  = "nix-build --system riscv64-linux -j0";
     fnom-build  = "nom-build --system x86_64-freebsd -j0";
     fnix-build  = "nix-build --system x86_64-freebsd -j0";
-    fanom-build  = "nom-build --system aarch64-freebsd -j0";
-    fanix-build  = "nix-build --system aarch64-freebsd -j0";
+    fanom-build = "nom-build --system aarch64-freebsd -j0";
+    fanix-build = "nix-build --system aarch64-freebsd -j0";
     xnom-build  = "nom-build --system x86_64-linux -j0";
     xnix-build  = "nix-build --system x86_64-linux -j0";
     anom-build  = "nom-build --system aarch64-linux -j0";