diff --git a/.gitea/workflows/deploy-cloud-pc.yml b/.gitea/workflows/deploy-cloud-pc.yml
new file mode 100644
index 0000000..3eaad8b
--- /dev/null
+++ b/.gitea/workflows/deploy-cloud-pc.yml
@@ -0,0 +1,27 @@
+name: Deploy cloud-pc
+
+on:
+  workflow_dispatch:
+    inputs:
+      stack:
+        description: "Stack to deploy (leave empty to reconcile all)"
+        required: false
+  push:
+    paths:
+      - ".gitea/workflows/deploy-cloud-pc.yml"
+      - "cloud-pc/**"
+      - "scripts/deploy.sh"
+  schedule:
+    - cron: "0 4 * * *"
+
+jobs:
+  deploy:
+    runs-on: cloud-pc
+    steps:
+      - name: Sync repo
+        run: |
+          git config --global --replace-all safe.directory /opt/services
+          git -C /opt/services pull --ff-only
+
+      - name: Deploy stacks
+        run: /opt/services/scripts/deploy.sh cloud-pc "${{ inputs.stack }}"
diff --git a/.gitea/workflows/deploy-mini-pc.yml b/.gitea/workflows/deploy-mini-pc.yml
new file mode 100644
index 0000000..0d576f0
--- /dev/null
+++ b/.gitea/workflows/deploy-mini-pc.yml
@@ -0,0 +1,27 @@
+name: Deploy mini-pc
+
+on:
+  workflow_dispatch:
+    inputs:
+      stack:
+        description: "Stack to deploy (leave empty to reconcile all)"
+        required: false
+  push:
+    paths:
+      - ".gitea/workflows/deploy-mini-pc.yml"
+      - "mini-pc/**"
+      - "scripts/deploy.sh"
+  schedule:
+    - cron: "0 4 * * *"
+
+jobs:
+  deploy:
+    runs-on: mini-pc
+    steps:
+      - name: Sync repo
+        run: |
+          git config --global --replace-all safe.directory /opt/services
+          git -C /opt/services pull --ff-only
+
+      - name: Deploy stacks
+        run: /opt/services/scripts/deploy.sh mini-pc "${{ inputs.stack }}"
diff --git a/.gitea/workflows/nixos-switch-cloud-pc.yml b/.gitea/workflows/nixos-switch-cloud-pc.yml
new file mode 100644
index 0000000..a41349a
--- /dev/null
+++ b/.gitea/workflows/nixos-switch-cloud-pc.yml
@@ -0,0 +1,20 @@
+name: NixOS switch cloud-pc
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - ".gitea/workflows/nixos-switch-cloud-pc.yml"
+      - "nixos/**"
+
+jobs:
+  switch:
+    runs-on: cloud-pc-nixos
+    steps:
+      - name: Sync repo
+        run: |
+          git config --global --replace-all safe.directory /opt/services
+          git -C /opt/services pull --ff-only
+
+      - name: Switch NixOS generation
+        run: sudo /run/current-system/sw/bin/nixos-rebuild switch --flake /opt/services/nixos#cloud-pc
diff --git a/.gitea/workflows/nixos-switch-mini-pc.yml b/.gitea/workflows/nixos-switch-mini-pc.yml
new file mode 100644
index 0000000..daa710a
--- /dev/null
+++ b/.gitea/workflows/nixos-switch-mini-pc.yml
@@ -0,0 +1,20 @@
+name: NixOS switch mini-pc
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - ".gitea/workflows/nixos-switch-mini-pc.yml"
+      - "nixos/**"
+
+jobs:
+  switch:
+    runs-on: mini-pc-nixos
+    steps:
+      - name: Sync repo
+        run: |
+          git config --global --replace-all safe.directory /opt/services
+          git -C /opt/services pull --ff-only
+
+      - name: Switch NixOS generation
+        run: sudo /run/current-system/sw/bin/nixos-rebuild switch --flake /opt/services/nixos#mini-pc
diff --git a/nixos/hosts/mini-pc.nix b/nixos/hosts/mini-pc.nix
index 53d5de0..bdf7cd0 100644
--- a/nixos/hosts/mini-pc.nix
+++ b/nixos/hosts/mini-pc.nix
@@ -33,6 +33,8 @@
     };
   };
 
+  services.resolved.enable = false;
+
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
diff --git a/nixos/modules/base.nix b/nixos/modules/base.nix
index fb231f6..57c9689 100644
--- a/nixos/modules/base.nix
+++ b/nixos/modules/base.nix
@@ -37,6 +37,18 @@
     };
   };
 
+  security.sudo.extraRules = [
+    {
+      users = [ "ada" ];
+      commands = [
+        {
+          command = "/run/current-system/sw/bin/nixos-rebuild";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+
   environment.systemPackages = with pkgs; [
     git
     restic
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 73f2b74..ad96290 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -47,6 +47,11 @@ for dir in $dirs; do
     continue
   fi
 
+  if { [ "$HOST" = "cloud-pc" ] || [ "$HOST" = "mini-pc" ]; } && [ "$dir" = "zerotier" ]; then
+    echo "Skipping zerotier (managed by NixOS service)"
+    continue
+  fi
+
   stack_dir="$BASE/$HOST/$dir"
   cd "$stack_dir"