diff --git a/ci/flake-cron.nix b/ci/flake-cron.nix
index a41fc03c..de774988 100644
--- a/ci/flake-cron.nix
+++ b/ci/flake-cron.nix
@@ -7,18 +7,6 @@
 }:
 with lib; let
   inherit (channels.std) string list set;
-  enabledNixosSystems = filterAttrs (_: system: system.config.ci.enable && system.config.type == "NixOS") channels.nixfiles.systems;
-  exportsSystems = let
-    warnSystems = set.filter (_: system: system.config.ci.allowFailure) enabledNixosSystems;
-    toSystems = systems: string.concatMapSep " " string.escapeShellArg (set.keys systems);
-  in ''
-    NF_NIX_SYSTEMS=(${toSystems enabledNixosSystems})
-    NF_NIX_SYSTEMS_WARN=(${toSystems warnSystems})
-  '';
-  buildAllSystems = pkgs.writeShellScriptBin "build-systems" ''
-      ${exportsSystems}
-      nix run .#nf-actions-test
-  '';
 in {
   imports = [./common.nix];
   config = {
diff --git a/outputs.nix b/outputs.nix
index 881ad99f..bde5cd5e 100644
--- a/outputs.nix
+++ b/outputs.nix
@@ -7,13 +7,14 @@
   shells = import ./shells {inherit inputs tree lib std pkgs;};
   inherit (import ./pkgs.nix {inherit inputs tree overlay;}) pkgs;
   formatter = import ./formatter.nix {inherit inputs pkgs;};
+  wrappers = import ./wrappers {inherit inputs;};
   inherit (std) set;
   checks = set.map (_: deployLib: deployLib.deployChecks inputs.self.deploy) inputs.deploy-rs.lib;
 in
   {
     inherit inputs tree std pkgs formatter lib checks;
     legacyPackages = pkgs;
-    packages = pkgs;
+    packages = pkgs // wrappers;
   }
   // systems
   // shells
diff --git a/packages/default.nix b/packages/default.nix
index 7894374b..c73b2597 100644
--- a/packages/default.nix
+++ b/packages/default.nix
@@ -6,4 +6,4 @@
   # formerly final: prev:, but deadnix
   inherit (inputs.std.lib) set;
 in
-  set.map (_: package: prev.callPackage package {}) (removeAttrs tree.packages ["default"])
+  (set.map (_: package: prev.callPackage package {}) (removeAttrs tree.packages ["default"]))
\ No newline at end of file
diff --git a/packages/nf-actions-test/default.nix b/packages/nf-actions-test/default.nix
deleted file mode 100644
index 028ca975..00000000
--- a/packages/nf-actions-test/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  wrapShellScriptBin,
-  pkgs,
-}:
-wrapShellScriptBin "nf-actions-test" ./actions-test.sh {
-  depsRuntimePath = with pkgs; [
-    git
-    cachix
-    jq
-    nix
-    curl
-  ];
-}
diff --git a/packages/nf-update/default.nix b/packages/nf-update/default.nix
index 9cd0c0f5..e3988259 100644
--- a/packages/nf-update/default.nix
+++ b/packages/nf-update/default.nix
@@ -8,6 +8,5 @@ wrapShellScriptBin "nf-update" ./update.sh {
     cachix
     jq
     curl
-    nf-actions-test
   ];
 }
diff --git a/packages/nf-update/update.sh b/packages/nf-update/update.sh
index 11743623..addf2c42 100644
--- a/packages/nf-update/update.sh
+++ b/packages/nf-update/update.sh
@@ -32,7 +32,7 @@ echo "checking that nodes still build..." >&2
 if [[ -n ${NF_UPDATE_CACHIX_PUSH-} ]]; then
 	export NF_ACTIONS_TEST_OUTLINK=${NF_ACTIONS_TEST_OUTLINK-result}
 fi
-nf-actions-test -L
+nix run .#nf-actions-test -- -L
 
 if [[ -n ${NF_UPDATE_CACHIX_PUSH-} ]]; then
   send_discord_message "Cachix pushing"
diff --git a/packages/nf-actions-test/actions-test.sh b/wrappers/actions-test.sh
similarity index 100%
rename from packages/nf-actions-test/actions-test.sh
rename to wrappers/actions-test.sh
diff --git a/wrappers/default.nix b/wrappers/default.nix
new file mode 100644
index 00000000..d2088ae2
--- /dev/null
+++ b/wrappers/default.nix
@@ -0,0 +1,9 @@
+{
+  inputs,
+  ...
+}@args: let
+in
+  inputs.utils.lib.eachDefaultSystem (system: {
+        nf-actions-test = import ./nf-actions-test.nix args;
+        nf-generate = import ./nf-generate.nix args;
+    })
\ No newline at end of file
diff --git a/wrappers/exports.nix b/wrappers/exports.nix
new file mode 100644
index 00000000..07c6bd62
--- /dev/null
+++ b/wrappers/exports.nix
@@ -0,0 +1,20 @@
+{
+  system,
+  inputs,
+  ...
+}: let
+  inherit (inputs.std.lib) string list set;
+  systems = inputs.self.systems;
+  enabledNixosSystems = set.filter (_: system: system.config.ci.enable && system.config.type == "NixOS") systems;
+in {
+  exports = ''
+    export NF_CONFIG_ROOT=''${NF_CONFIG_ROOT-${toString ../../.}}
+  '';
+  exportsSystems = let
+    warnSystems = set.filter (_: system: system.config.ci.allowFailure) enabledNixosSystems;
+    toSystems = systems: string.concatMapSep " " string.escapeShellArg (set.keys systems);
+  in ''
+    NF_NIX_SYSTEMS=(${toSystems enabledNixosSystems})
+    NF_NIX_SYSTEMS_WARN=(${toSystems warnSystems})
+  '';
+}
\ No newline at end of file
diff --git a/wrappers/generate.sh b/wrappers/generate.sh
new file mode 100644
index 00000000..4ac31d7b
--- /dev/null
+++ b/wrappers/generate.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -eu
+
+for ciconfig in "${NF_CONFIG_FILES[@]}"; do
+	echo "processing ${ciconfig}..." >&2
+	nix run --argstr config "$NF_CONFIG_ROOT/ci/$ciconfig" -f "$NF_INPUT_CI" run.gh-actions-generate
+done
diff --git a/wrappers/nf-actions-test.nix b/wrappers/nf-actions-test.nix
new file mode 100644
index 00000000..d6b8ff90
--- /dev/null
+++ b/wrappers/nf-actions-test.nix
@@ -0,0 +1,17 @@
+{
+  system,
+  inputs,
+  ...
+}@args: let
+  lib = inputs.nixpkgs.lib;
+  exportFile = import ./exports.nix args;
+  inherit (exportFile) exports exportsSystems;
+  inherit (inputs.std.lib) string list set;
+  packages = inputs.self.packages.${system};
+  inherit (inputs.self.legacyPackages.${system}) pkgs;
+  nf-actions-test = pkgs.writeShellScriptBin "nf-actions-test" ''
+      ${exports}
+      ${exportsSystems}
+      source ${./actions-test.sh}
+  '';
+in nf-actions-test
diff --git a/wrappers/nf-generate.nix b/wrappers/nf-generate.nix
new file mode 100644
index 00000000..f8ea2846
--- /dev/null
+++ b/wrappers/nf-generate.nix
@@ -0,0 +1,20 @@
+{
+  system,
+  inputs,
+  ...
+}@args: let
+  lib = inputs.nixpkgs.lib;
+  exportFile = import ./exports.nix args;
+  inherit (exportFile) exports exportsSystems;
+  inherit (lib.strings) makeBinPath;
+  inherit (inputs.std.lib) string list set;
+  packages = inputs.self.packages.${system};
+  inherit (inputs.self.legacyPackages.${system}) pkgs;
+    nf-generate = pkgs.writeShellScriptBin "nf-generate" ''
+      ${exports}
+      export PATH="$PATH:${makeBinPath [pkgs.jq]}"
+      NF_INPUT_CI=${string.escapeShellArg inputs.ci}
+      NF_CONFIG_FILES=(${string.concatMapSep " " string.escapeShellArg ci.workflowConfigs})
+      source ${../ci/generate.sh}
+    '';
+in nf-generate
\ No newline at end of file