diff --git a/npins/default.nix b/npins/default.nix
index 850b02ae..884fc8cc 100644
--- a/npins/default.nix
+++ b/npins/default.nix
@@ -9,8 +9,15 @@
 */
 # Generated by npins. Do not modify; will be overwritten regularly
 let
-  data = builtins.fromJSON (builtins.readFile ./sources.json);
-  version = data.version;
+  # Backwards-compatibly make something that previously didn't take any arguments take some
+  # The function must return an attrset, and will unfortunately be eagerly evaluated
+  # Same thing, but it catches eval errors on the default argument so that one may still call it with other arguments
+  mkFunctor =
+    fn:
+    let
+      e = builtins.tryEval (fn { });
+    in
+    (if e.success then e.value else { error = fn { }; }) // { __functor = _self: fn; };
 
   # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
   range =
@@ -21,7 +28,6 @@ let
 
   # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
   stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
-  concatMapStrings = f: list: concatStrings (map f list);
   concatStrings = builtins.concatStringsSep "";
 
   # If the environment variable NPINS_OVERRIDE_${name} is set, then use
@@ -48,52 +54,87 @@ let
 
   mkSource =
     name: spec:
+    {
+      pkgs ? null,
+    }:
     assert spec ? type;
     let
+      # Unify across builtin and pkgs fetchers.
+      # `fetchGit` requires a wrapper because of slight API differences.
+      fetchers =
+        if pkgs == null then
+          {
+            inherit (builtins) fetchTarball fetchurl;
+            # For some fucking reason, fetchGit has a different signature than the other builtin fetchers …
+            fetchGit = args: (builtins.fetchGit args).outPath;
+          }
+        else
+          {
+            fetchTarball =
+              {
+                url,
+                sha256,
+              }:
+              pkgs.fetchzip {
+                inherit url sha256;
+                extension = "tar";
+              };
+            inherit (pkgs) fetchurl;
+            fetchGit =
+              {
+                url,
+                submodules,
+                rev,
+                name,
+                narHash,
+              }:
+              pkgs.fetchgit {
+                inherit url rev name;
+                fetchSubmodules = submodules;
+                hash = narHash;
+              };
+          };
+
+      # Dispatch to the correct code path based on the type
       path =
         if spec.type == "Git" then
-          mkGitSource spec
+          mkGitSource fetchers spec
         else if spec.type == "GitRelease" then
-          mkGitSource spec
+          mkGitSource fetchers spec
         else if spec.type == "PyPi" then
-          mkPyPiSource spec
+          mkPyPiSource fetchers spec
         else if spec.type == "Channel" then
-          mkChannelSource spec
+          mkChannelSource fetchers spec
         else if spec.type == "Tarball" then
-          mkTarballSource spec
+          mkTarballSource fetchers spec
+        else if spec.type == "Container" then
+          mkContainerSource pkgs spec
         else
           builtins.throw "Unknown source type ${spec.type}";
     in
-    spec
-    // rec {
-      outPath = mayOverride name path;
-
-      # Waiting for discussion upstream
-      # https://github.com/andir/npins/issues/159
-      asFlake =
-        if sources ? flake-compat then
-          (import sources.flake-compat { src = outPath; }).outputs
-        else
-          throw ".asFlake needs flake-compat as a source";
-    };
+    spec // { outPath = mayOverride name path; };
 
   mkGitSource =
+    {
+      fetchTarball,
+      fetchGit,
+      ...
+    }:
     {
       repository,
       revision,
       url ? null,
       submodules,
       hash,
-      branch ? null,
       ...
     }:
     assert repository ? type;
     # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
     # In the latter case, there we will always be an url to the tarball
     if url != null && !submodules then
-      builtins.fetchTarball {
+      fetchTarball {
         inherit url;
-        sha256 = hash; # FIXME: check nix version & use SRI hashes
+        sha256 = hash;
       }
     else
       let
@@ -104,6 +145,8 @@ let
             "https://github.com/${repository.owner}/${repository.repo}.git"
           else if repository.type == "GitLab" then
             "${repository.server}/${repository.repo_path}.git"
+          else if repository.type == "Forgejo" then
+            "${repository.server}/${repository.owner}/${repository.repo}.git"
           else
             throw "Unrecognized repository type ${repository.type}";
         urlToName =
@@ -118,51 +161,89 @@ let
           "${if matched == null then "source" else builtins.head matched}${appendShort}";
         name = urlToName url revision;
       in
-      builtins.fetchGit {
+      fetchGit {
         rev = revision;
-        inherit name;
-        # hash = hash;
-        inherit url submodules;
+        narHash = hash;
+
+        inherit name submodules url;
       };
 
   mkPyPiSource =
+    { fetchurl, ... }:
     {
       url,
       hash,
       ...
     }:
-    builtins.fetchurl {
+    fetchurl {
       inherit url;
       sha256 = hash;
     };
 
   mkChannelSource =
+    { fetchTarball, ... }:
     {
       url,
       hash,
       ...
     }:
-    builtins.fetchTarball {
+    fetchTarball {
       inherit url;
       sha256 = hash;
     };
 
   mkTarballSource =
+    { fetchTarball, ... }:
     {
       url,
       locked_url ? url,
       hash,
       ...
     }:
-    builtins.fetchTarball {
+    fetchTarball {
       url = locked_url;
       sha256 = hash;
     };
 
-  sources =
-    if version == 5 then
-      builtins.mapAttrs mkSource data.pins
+  mkContainerSource =
+    pkgs:
+    {
+      image_name,
+      image_tag,
+      image_digest,
+      ...
+    }:
+    if pkgs == null then
+      builtins.throw "container sources require passing in a Nixpkgs value: https://github.com/andir/npins/blob/master/README.md#using-the-nixpkgs-fetchers"
     else
-      throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`";
+      pkgs.dockerTools.pullImage {
+        imageName = image_name;
+        imageDigest = image_digest;
+        finalImageTag = image_tag;
+      };
 in
-sources
+mkFunctor (
+  {
+    input ? ./sources.json,
+  }:
+  let
+    data =
+      if builtins.isPath input then
+        # while `readFile` will throw an error anyways if the path doesn't exist,
+        # we still need to check beforehand because *our* error can be caught but not the one from the builtin
+        # *piegames sighs*
+        if builtins.pathExists input then
+          builtins.fromJSON (builtins.readFile input)
+        else
+          throw "Input path ${toString input} does not exist"
+      else if builtins.isAttrs input then
+        input
+      else
+        throw "Unsupported input type ${builtins.typeOf input}, must be a path or an attrset";
+    version = data.version;
+  in
+  if version == 7 then
+    builtins.mapAttrs (name: spec: mkFunctor (mkSource name spec)) data.pins
+  else
+    throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
+)
diff --git a/npins/sources.json b/npins/sources.json
index d61b2550..1708e121 100644
--- a/npins/sources.json
+++ b/npins/sources.json
@@ -14,7 +14,7 @@
       "version": "0.15.0",
       "revision": "564595d0ad4be7277e07fa63b5a991b3c645655d",
       "url": "https://api.github.com/repos/ryantm/agenix/tarball/0.15.0",
-      "hash": "01dhrghwa7zw93cybvx4gnrskqk97b004nfxgsys0736823956la"
+      "hash": "sha256-ipqShkBmHKC9ft1ZAsA6aeKps32k7+XZSPwfxeHLsAU="
     },
     "disko": {
       "type": "GitRelease",
@@ -30,7 +30,7 @@
       "version": "v1.11.0",
       "revision": "cdf8deded8813edfa6e65544f69fdd3a59fa2bb4",
       "url": "https://api.github.com/repos/nix-community/disko/tarball/v1.11.0",
-      "hash": "13brimg7z7k9y36n4jc1pssqyw94nd8qvgfjv53z66lv4xkhin92"
+      "hash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0="
     },
     "fcitx5-table-extra": {
       "type": "Git",
@@ -43,7 +43,7 @@
       "submodules": true,
       "revision": "cba16e03fd43b1ee8a15d20e14ecf0fb1c6762fa",
       "url": null,
-      "hash": "0ryb3cng4py2zrm95p5ial9w13p7w4ws0bl0lddrij1sq42kzg8l",
+      "hash": "sha256-FL0/BcE6yJhbo4AuoDnh547AE1Wx3JJq/sJf8iwby2c=",
       "frozen": true
     },
     "flake-compat": {
@@ -58,7 +58,7 @@
       "submodules": false,
       "revision": "549f2762aebeff29a2e5ece7a7dc0f955281a1d1",
       "url": "https://git.lix.systems/lix-project/flake-compat/archive/549f2762aebeff29a2e5ece7a7dc0f955281a1d1.tar.gz",
-      "hash": "0g4izwn5k7qpavlk3w41a92rhnp4plr928vmrhc75041vzm3vb1l",
+      "hash": "sha256-NKw96t+BgHIYzHUjkTK95FqYRVKB8DHpVhefWSz/kTw=",
       "frozen": true
     },
     "ghostty-dev": {
@@ -72,7 +72,7 @@
       "submodules": false,
       "revision": "17da13840dc71ba36b0deb2c0e85097840630ad5",
       "url": "https://github.com/ghostty-org/ghostty/archive/17da13840dc71ba36b0deb2c0e85097840630ad5.tar.gz",
-      "hash": "1ifa8fiqgc4pc7dyzh31d5g0wrawxvrpnz7lcf2qxjfjv5jq0k63"
+      "hash": "sha256-w0yAZdnSyY6FY/R8e/PuXGUOXmlhwO/bYZewh6NDysU="
     },
     "hategroup-dnsbl": {
       "type": "Git",
@@ -85,7 +85,7 @@
       "submodules": false,
       "revision": "cc19c050997d5f54014bb20c764b131e003dfb17",
       "url": "https://github.com/chigh/hategroup-dnsbl/archive/cc19c050997d5f54014bb20c764b131e003dfb17.tar.gz",
-      "hash": "1x1nhy0717bav35z6aid0224izmcsrg3knys64xszhslh266p429",
+      "hash": "sha256-SZBrjIBUw687MdrbOV7WrP5IhAAtKvPL2GqdcICHNvQ=",
       "frozen": true
     },
     "home-manager": {
@@ -99,7 +99,7 @@
       "submodules": false,
       "revision": "82fb7dedaad83e5e279127a38ef410bcfac6d77c",
       "url": "https://github.com/nix-community/home-manager/archive/82fb7dedaad83e5e279127a38ef410bcfac6d77c.tar.gz",
-      "hash": "1rj0cazl5kjcfn4433fj31293yx421wbawryp5q3bq3fsmhkkr9h"
+      "hash": "sha256-MOU5YdVu4DVwuT5ztXgQpPuRRBjSjUGIdUzOQr9iQOY="
     },
     "infuse": {
       "type": "GitRelease",
@@ -116,7 +116,7 @@
       "version": "v2.4",
       "revision": "c7da66119bb3502a59402cd2d1688a3f0a02577a",
       "url": "https://codeberg.org/api/v1/repos/amjoseph/infuse.nix/archive/v2.4.tar.gz",
-      "hash": "1s3d1v27jxsw5050qi0bq6agpf5gpw6jmcyigzpdgwfm9d6w6wz1"
+      "hash": "sha256-4XPDTUvV8dfuf9GzKg2/r7j7lMELRAwKKFx3ecQObeg="
     },
     "nil": {
       "type": "Git",
@@ -129,7 +129,7 @@
       "submodules": false,
       "revision": "504599f7e555a249d6754698473124018b80d121",
       "url": "https://github.com/oxalica/nil/archive/504599f7e555a249d6754698473124018b80d121.tar.gz",
-      "hash": "1mzx60999jciq2ax1l5ajmks6fb3cmjavn7fsyh4aysvcdgzrj6p"
+      "hash": "sha256-18j8X2Nbe0Wg1+7YrWRlYzmjZ5Wq0NCVwJHJlBIw/dc="
     },
     "nix-monitored": {
       "type": "Git",
@@ -142,7 +142,7 @@
       "submodules": false,
       "revision": "60f3baa4701d58eab86c2d1d9c3d7e820074d461",
       "url": "https://github.com/ners/nix-monitored/archive/60f3baa4701d58eab86c2d1d9c3d7e820074d461.tar.gz",
-      "hash": "1rdyjmxkvyqd5blbzbwfv2b99krx6rkpdzi1ckyby8i676gf9hv7",
+      "hash": "sha256-Z8PknjkmIr/8ZCH+dmc2Pc+UltiOr7/oKg37PXuVvuU=",
       "frozen": true
     },
     "nixos-hardware": {
@@ -156,7 +156,7 @@
       "submodules": false,
       "revision": "40b1a28dce561bea34858287fbb23052c3ee63fe",
       "url": "https://github.com/NixOS/nixos-hardware/archive/40b1a28dce561bea34858287fbb23052c3ee63fe.tar.gz",
-      "hash": "197v6xxdq5j4w8kil6q21ij9x6ng8z6j72brkwwjim23798c2c4n"
+      "hash": "sha256-ljDBUDpD1Cg5n3mJI81Hz5qeZAwCGxon4kQW3Ho3+6Q="
     },
     "nixpkgs": {
       "type": "Git",
@@ -169,7 +169,7 @@
       "submodules": false,
       "revision": "ff8a91eb93e8abfceed1957330b54e54e99c747a",
       "url": "https://github.com/nixos/nixpkgs/archive/ff8a91eb93e8abfceed1957330b54e54e99c747a.tar.gz",
-      "hash": "0j0410wjpkxix1sxfr3fpd60iqvjrkgydiis7rqr4g44y042dfns"
+      "hash": "sha256-2romCPCEPJJxPjrG5t/McuMITLtuZNd16LHPKzkIBEg="
     },
     "npins": {
       "type": "GitRelease",
@@ -185,7 +185,7 @@
       "version": "0.4.0",
       "revision": "52904b878c2db61e062b63beb07784d41f98c765",
       "url": "https://api.github.com/repos/andir/npins/tarball/0.4.0",
-      "hash": "07n256q07k1f0nm92nqgihm71xyrg9293w6ib3r92vmqpf5rghwj"
+      "hash": "sha256-ksOXi7u4bpHyWNHwkUR62fdwKowPW5GqBS7MA7Apwh4="
     },
     "nur": {
       "type": "Git",
@@ -198,7 +198,7 @@
       "submodules": false,
       "revision": "9aa5514ef92b980580f90029447ecc732851e2a9",
       "url": "https://github.com/nix-community/nur/archive/9aa5514ef92b980580f90029447ecc732851e2a9.tar.gz",
-      "hash": "1dx6r4nz2dmv6lq34aig2pcgb74m00kq7ma60fm34jih67ldpcs0"
+      "hash": "sha256-QLPb6DEwSjKqA0bVgycAlZz12BUvKjIwNbs28S3Jprc="
     },
     "pin-emacs28": {
       "type": "Git",
@@ -211,7 +211,7 @@
       "submodules": false,
       "revision": "93c121f6888986f9148a33afd39d714f4b2ca98c",
       "url": "https://github.com/NixOS/nixpkgs/archive/93c121f6888986f9148a33afd39d714f4b2ca98c.tar.gz",
-      "hash": "198p4lv3zqw3s6j3yflgic0jxig4y0vsb1k8433jv227ks89kqdg",
+      "hash": "sha256-r+GZkJ5HiC3HIGiGpTfw5MUuAYuPOj+k0YPjPzYlF6U=",
       "frozen": true
     },
     "pin-florashell": {
@@ -225,7 +225,7 @@
       "submodules": false,
       "revision": "7282cb574e0607e65224d33be8241eae7cfe0979",
       "url": "https://github.com/NixOS/nixpkgs/archive/7282cb574e0607e65224d33be8241eae7cfe0979.tar.gz",
-      "hash": "0klkpy7ah033y3cwj51a0l96lwmkqqvwgfv3kid4z9x5g2rqr0l5",
+      "hash": "sha256-hYKMs3ilp09anGO7xzfGs3JqEgUqFMnZ8GMAqI6/k04=",
       "frozen": true
     },
     "pin-fourmolu": {
@@ -239,7 +239,7 @@
       "submodules": false,
       "revision": "f6cf0e77542dd938f002652dd54391b973f792de",
       "url": "https://github.com/NixOS/nixpkgs/archive/f6cf0e77542dd938f002652dd54391b973f792de.tar.gz",
-      "hash": "1a8kcw1biyzmf5k8qjrji5fvgr8bbmi7fvf8pvfgjmf1df8rrcz1",
+      "hash": "sha256-4bOckWvBVfncvshtd2JdC+W3XYkyS4xmcfX7uAJnE6k=",
       "frozen": true
     },
     "pin-isabelle": {
@@ -253,7 +253,7 @@
       "submodules": false,
       "revision": "805a384895c696f802a9bf5bf4720f37385df547",
       "url": "https://github.com/NixOS/nixpkgs/archive/805a384895c696f802a9bf5bf4720f37385df547.tar.gz",
-      "hash": "1q7y5ygr805l5axcjhn0rn3wj8zrwbrr0c6a8xd981zh8iccmx0p",
+      "hash": "sha256-F/TKWETwB5RaR8owkPPi+SPJh83AQsm6KrQAlJ8v/uA=",
       "frozen": true
     },
     "pin-masna3shell": {
@@ -267,7 +267,7 @@
       "submodules": false,
       "revision": "641d909c4a7538f1539da9240dedb1755c907e40",
       "url": "https://github.com/NixOS/nixpkgs/archive/641d909c4a7538f1539da9240dedb1755c907e40.tar.gz",
-      "hash": "10hpb1aw884k3zzcy1mhf47dqvfagiyx7kr6hg0p5xcwg04mkx8x",
+      "hash": "sha256-HfVZCXic9XLBgybP0318ym3cDnGwBs/+H5MgxFVYF4I=",
       "frozen": true
     },
     "pin-necro-man-nixpkgs": {
@@ -281,7 +281,7 @@
       "submodules": false,
       "revision": "c58ed2fc0f592ebc280bfba077ea418ce10213d1",
       "url": "https://github.com/NixOS/nixpkgs/archive/c58ed2fc0f592ebc280bfba077ea418ce10213d1.tar.gz",
-      "hash": "1y5is3cjwsy9n5cqs8i7qc9kf8cny9yxzirzzspkqbrm51axv53i",
+      "hash": "sha256-cZTdVSg1Lzyv/j/H333yliE3E8MnIo1ZsclrLtnQsfg=",
       "frozen": true
     },
     "pin-vim-tw": {
@@ -295,7 +295,7 @@
       "submodules": false,
       "revision": "c93c1b3413bd7e235fc22b469bc0d2feec332cf5",
       "url": "https://github.com/NixOS/nixpkgs/archive/c93c1b3413bd7e235fc22b469bc0d2feec332cf5.tar.gz",
-      "hash": "115sdkhyp0pm5rmag4gq0myg2rs20irisgnpf26zjfm92pw8isq4",
+      "hash": "sha256-BOuI+BWpOvmNcNc+HXMEQmfxfAX4kadqLvWC6+FsuoQ=",
       "frozen": true
     },
     "pin-wireshark": {
@@ -309,7 +309,7 @@
       "submodules": false,
       "revision": "9d3ae807ebd2981d593cddd0080856873139aa40",
       "url": "https://github.com/NixOS/nixpkgs/archive/9d3ae807ebd2981d593cddd0080856873139aa40.tar.gz",
-      "hash": "0bjqgsprq9fgl5yh58dk59xmchi4dajq3sf5i447q02dbiasjsil",
+      "hash": "sha256-NGqpVVxNAHwIicXpgaVqJEJWeyqzoQJ9oc8lnK9+WC4=",
       "frozen": true
     },
     "url-eater": {
@@ -323,7 +323,7 @@
       "submodules": false,
       "revision": "d617007eba79f9760db084aefda6c02c80ad7971",
       "url": "https://github.com/AgathaSorceress/url-eater/archive/d617007eba79f9760db084aefda6c02c80ad7971.tar.gz",
-      "hash": "0dir077j5gy6yzbhsr85z7kbiwi135ns59gwrycbpvihzzp4qbwm"
+      "hash": "sha256-lS9M7v8w7ruYz/ylom0ZIfK45vkFZQ3X98a/Is8BOTY="
     },
     "wallpapers": {
       "type": "Git",
@@ -337,7 +337,7 @@
       "submodules": false,
       "revision": "861a5942932820291eba572cbe251866895e3655",
       "url": "https://git.confusedcompiler.org/leana8959/wallpapers/archive/861a5942932820291eba572cbe251866895e3655.tar.gz",
-      "hash": "0p0q8v510zracsmymws88iv9qgxqyhiwlfcmln5p6yc8a7ra6p8y"
+      "hash": "sha256-Hl2j8lGIeXOLpZU5yiP0uD+cdkRI8+qrZip/EMpGGFw="
     },
     "wired-notify": {
       "type": "Git",
@@ -350,7 +350,7 @@
       "submodules": false,
       "revision": "491197a6a5ef9c65a85c3eb1531786f32ffff5b3",
       "url": "https://github.com/Toqozz/wired-notify/archive/491197a6a5ef9c65a85c3eb1531786f32ffff5b3.tar.gz",
-      "hash": "07gaizslvsiihvfrrbcdz0b2c04llsfqaji03ls55p1zbm41w6f3"
+      "hash": "sha256-wxkeSF0/3FI0HSBKhZ2mlAAmFviNrZzdhjHqTfWP6h0="
     },
     "zen-browser": {
       "type": "Git",
@@ -363,8 +363,8 @@
       "submodules": false,
       "revision": "5c9624f3d0176727284678aebf677770dd1375b2",
       "url": "https://github.com/0xc000022070/zen-browser-flake/archive/5c9624f3d0176727284678aebf677770dd1375b2.tar.gz",
-      "hash": "1highzr36j8crd77y6331ggfm66n78075vj1rqhbbbxfq6aazkz8"
+      "hash": "sha256-6M+vlMGur7UgzkHucgA61pjq3gtjGH9OywxJM/KHL8I="
     }
   },
-  "version": 5
+  "version": 7
 }