diff --git a/.gitignore b/.gitignore
index c5d12a6..2585751 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,10 @@
 .claude
 docs/
+
+# secret guardrails — keep credentials out of the repo
+secrets/
+*.age
+*.key
+*.pem
+.env
+.env.*
diff --git a/configuration.nix b/configuration.nix
deleted file mode 100644
index 82b3dc3..0000000
--- a/configuration.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./system/boot.nix
-    ./system/networking.nix
-    ./system/locale.nix
-    ./system/xserver.nix
-    ./system/picom.nix
-    ./system/display-manager.nix
-    ./system/fonts.nix
-    ./system/users.nix
-    ./system/programs.nix
-    ./system/packages.nix
-    ./system/ssh.nix
-    ./system/nix.nix
-  ];
-
-  system.stateVersion = "26.05";
-}
diff --git a/flake.nix b/flake.nix
index 16de6df..6dbb501 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,20 +9,27 @@
 		};
 	};
 
-	outputs = { self, nixpkgs, home-manager, ... }: {
-		nixosConfigurations.hivebrain = nixpkgs.lib.nixosSystem {
+	outputs = { self, nixpkgs, home-manager, ... }:
+	let
+		mkHost = { hostPath, username, homePath }: nixpkgs.lib.nixosSystem {
 			system = "x86_64-linux";
 			modules = [
-				./configuration.nix
+				hostPath
 				home-manager.nixosModules.home-manager {
 					home-manager = {
 						useGlobalPkgs = true;
 						useUserPackages = true;
-						users.marvin = import ./home.nix;
+						users.${username} = import homePath;
 						backupFileExtension = "backup";
 					};
 				}
 			];
 		};
+	in {
+		nixosConfigurations.hivebrain = mkHost {
+			hostPath = ./hosts/hivebrain;
+			username = "marvin";
+			homePath = ./hosts/hivebrain/home.nix;
+		};
 	};
 }
diff --git a/home.nix b/home.nix
deleted file mode 100644
index 2e3c9b7..0000000
--- a/home.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ ... }:
-
-{
-  imports = [
-    ./home/zsh.nix
-    ./home/git.nix
-    ./home/rofi.nix
-    ./home/yazi.nix
-    ./home/packages.nix
-    ./home/symlinks.nix
-    ./home/fonts.nix
-  ];
-
-  home.username = "marvin";
-  home.homeDirectory = "/home/marvin";
-  home.stateVersion = "26.05";
-}
diff --git a/home/git.nix b/home/git.nix
deleted file mode 100644
index 2b8436f..0000000
--- a/home/git.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ ... }:
-
-{
-  programs.git = {
-    enable = true;
-    settings.user = {
-      name = "MDietermann";
-      email = "marvin.dietermann@hive-brain.de";
-    };
-  };
-}
diff --git a/home/packages-base.nix b/home/packages-base.nix
new file mode 100644
index 0000000..030f910
--- /dev/null
+++ b/home/packages-base.nix
@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+
+{
+  home.packages = with pkgs; [
+    neovim
+    nerd-fonts.jetbrains-mono
+    ripgrep
+    unzip
+  ];
+}
diff --git a/home/packages.nix b/home/packages-marvin.nix
similarity index 77%
rename from home/packages.nix
rename to home/packages-marvin.nix
index ca89fd3..23784b8 100644
--- a/home/packages.nix
+++ b/home/packages-marvin.nix
@@ -6,17 +6,13 @@
     claude-code
     gcc
     lua-language-server
-    neovim
-    nerd-fonts.jetbrains-mono
     nil
     nixpkgs-fmt
     nodejs
     obsidian
     pkg-config
-    ripgrep
     rustup
     steam
-    unzip
     xwallpaper
   ];
 }
diff --git a/home/zsh.nix b/home/zsh.nix
index 3f16f48..35cb742 100644
--- a/home/zsh.nix
+++ b/home/zsh.nix
@@ -19,7 +19,7 @@
 
     shellAliases = {
       btw = "echo I use NixOS";
-      reload-nixos = "sudo nixos-rebuild switch --flake ~/nixos-dotfiles#hivebrain";
+      reload-nixos = "sudo nixos-rebuild switch --flake ~/nixos-dotfiles";
     };
   };
 }
diff --git a/hosts/hivebrain/default.nix b/hosts/hivebrain/default.nix
new file mode 100644
index 0000000..20be13a
--- /dev/null
+++ b/hosts/hivebrain/default.nix
@@ -0,0 +1,26 @@
+{ ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+
+    # shared
+    ../../system/boot.nix
+    ../../system/networking.nix
+    ../../system/locale.nix
+    ../../system/fonts.nix
+    ../../system/nix.nix
+    ../../system/ssh.nix
+    ../../system/programs.nix
+    ../../system/packages.nix
+
+    # marvin-only
+    ../../system/xserver.nix
+    ../../system/picom.nix
+    ../../system/display-managers/ly.nix
+    ../../system/users/marvin.nix
+  ];
+
+  networking.hostName = "hivebrain";
+  system.stateVersion = "26.05";
+}
diff --git a/hardware-configuration.nix b/hosts/hivebrain/hardware-configuration.nix
similarity index 100%
rename from hardware-configuration.nix
rename to hosts/hivebrain/hardware-configuration.nix
diff --git a/hosts/hivebrain/home.nix b/hosts/hivebrain/home.nix
new file mode 100644
index 0000000..467be87
--- /dev/null
+++ b/hosts/hivebrain/home.nix
@@ -0,0 +1,25 @@
+{ ... }:
+
+{
+  imports = [
+    ../../home/zsh.nix
+    ../../home/fonts.nix
+    ../../home/rofi.nix
+    ../../home/yazi.nix
+    ../../home/symlinks.nix
+    ../../home/packages-base.nix
+    ../../home/packages-marvin.nix
+  ];
+
+  home.username = "marvin";
+  home.homeDirectory = "/home/marvin";
+  home.stateVersion = "26.05";
+
+  programs.git = {
+    enable = true;
+    settings.user = {
+      name = "MDietermann";
+      email = "marvin.dietermann@hive-brain.de";
+    };
+  };
+}
diff --git a/system/display-manager.nix b/system/display-managers/ly.nix
similarity index 100%
rename from system/display-manager.nix
rename to system/display-managers/ly.nix
diff --git a/system/networking.nix b/system/networking.nix
index 85fe14c..6e2a390 100644
--- a/system/networking.nix
+++ b/system/networking.nix
@@ -1,6 +1,5 @@
 { ... }:
 
 {
-  networking.hostName = "hivebrain";
   networking.networkmanager.enable = true;
 }
diff --git a/system/users.nix b/system/users/marvin.nix
similarity index 100%
rename from system/users.nix
rename to system/users/marvin.nix