diff --git a/flake.lock b/flake.lock
index c2836ec..348ca23 100644
--- a/flake.lock
+++ b/flake.lock
@@ -3,6 +3,7 @@
     "authentik-nix": {
       "inputs": {
         "authentik-src": "authentik-src",
+        "client-ts-generator-src": "client-ts-generator-src",
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",
         "flake-utils": "flake-utils",
@@ -13,11 +14,11 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1785159467,
-        "narHash": "sha256-1LwjkVJK5pst6Atm3uOiZW3eBMY3gs0ICO14eFGlpGw=",
+        "lastModified": 1785761909,
+        "narHash": "sha256-M8FNG0aca0/JsETvpYSJgwIrgJ4kpgxo9i7SDS0LfHs=",
         "owner": "nix-community",
         "repo": "authentik-nix",
-        "rev": "a492deb563cf54cb8fe134e94a7ba3b01820ca5e",
+        "rev": "db4a267f345338659a290a76e5b28da31e9923df",
         "type": "github"
       },
       "original": {
@@ -43,6 +44,22 @@
         "type": "github"
       }
     },
+    "client-ts-generator-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1784638510,
+        "narHash": "sha256-NfwEWQ/SRjgeUz+F/7uoWAMwk7OqdF2+686krhvJn2M=",
+        "owner": "goauthentik",
+        "repo": "client-ts",
+        "rev": "5850af5867bef6fd4291731797d21b704c7f189d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "goauthentik",
+        "repo": "client-ts",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -146,11 +163,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785267577,
-        "narHash": "sha256-PoNXV5H5BbncwyO0C6Dar6C49GSf3UGDRRMpuArX8y4=",
+        "lastModified": 1785852009,
+        "narHash": "sha256-EgIk8Enyhiqa5J326BDNgujeU+lEbYxZzo59rXKWr4Q=",
         "ref": "refs/heads/develop",
-        "rev": "73ce9ddbdf27d21c87322bcd638c1efe08be6827",
-        "revCount": 4,
+        "rev": "dcec9d205e4f8fbe18f71260a0614dd0187f4204",
+        "revCount": 33,
         "type": "git",
         "url": "https://git.mgaction.town/darman/hypr-chrome.git"
       },
@@ -253,11 +270,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1784704708,
-        "narHash": "sha256-xuzg2Xfalr1X5ah5IPgqB8Vyif+2je1qkCtGxCB+rm0=",
+        "lastModified": 1785356851,
+        "narHash": "sha256-UYKTcayxYPE3yIruCv525WMbcYDLlkv79bRfkOuFNLs=",
         "owner": "nix-community",
         "repo": "nixos-anywhere",
-        "rev": "91fc9b70fc295258c366cce8627efb6f185fd9fb",
+        "rev": "5887f1c72fbf0e88000716237194de414d2299ee",
         "type": "github"
       },
       "original": {
@@ -274,11 +291,11 @@
         "nixos-unstable": "nixos-unstable"
       },
       "locked": {
-        "lastModified": 1784802994,
-        "narHash": "sha256-4PcD0Ibzdkh85G+70w5dLlR9YgQ2bmNIjiPPMSzO57w=",
+        "lastModified": 1785407732,
+        "narHash": "sha256-iv6OYbZgMqvudEFB4LvhpZDHyNqD+lx0WubIk6BdAVg=",
         "owner": "nix-community",
         "repo": "nixos-images",
-        "rev": "6ece16b0c97986fe085122e796044add4cc3ff64",
+        "rev": "e2a34c0ce9dcbb5169f2a233b49211f5f30b7d69",
         "type": "github"
       },
       "original": {
@@ -306,11 +323,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1785090369,
-        "narHash": "sha256-m0pDuRJG7EDo9ri+4Ksu83VsI+PlxNC9lNBfydejce4=",
+        "lastModified": 1785692966,
+        "narHash": "sha256-vUfIeBEfpbAfZ5zjgIkYk7eHBeVfCYVjLbWnMkseYnk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "624af665418d3c65d544145b4d34ad696439570e",
+        "rev": "643809054d65fdd466a63e3155b8c498cb483c04",
         "type": "github"
       },
       "original": {
@@ -337,11 +354,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1785141334,
-        "narHash": "sha256-kh35kIx7el4Jk8Ki3BH9/Pn1eZYSYLJ6LMALos0zOy0=",
+        "lastModified": 1785747939,
+        "narHash": "sha256-D740uKsMbgsfK2oaDenJLLPIZfq7W0/g4KN/Fls8eKs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "38a4887411571457d700c51c64a6e49ead2ed5ab",
+        "rev": "104240a772428cc2e20d8fd86c9ddbb886bbaff2",
         "type": "github"
       },
       "original": {
@@ -353,11 +370,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1785133411,
-        "narHash": "sha256-Yjv0WEg39KRYS0rBdTbu6Fc/or/ihAKk13W9sQ6VWd0=",
+        "lastModified": 1785734586,
+        "narHash": "sha256-ODZkEK9Gy50yg6h98u7KkitZ3oc/uuTFK00bh1CRdNA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2f5a153c270b70cb0f8c11f46d96d6d3bc39f4e3",
+        "rev": "531670d871c0e29724a02f3cbcac170adc65b58c",
         "type": "github"
       },
       "original": {
@@ -383,11 +400,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782093830,
-        "narHash": "sha256-6gmEVe69+KlRkZD4PEEV5xAlB9CB0Y9TiuEgQjDrKTQ=",
+        "lastModified": 1785115949,
+        "narHash": "sha256-8AM37BfyGaL2v/SZyg4PupRxJ01Y4htvM+WrTjWrPpo=",
         "owner": "pyproject-nix",
         "repo": "build-system-pkgs",
-        "rev": "430680a19bc85a3bda55f12e4cc1a1aadcf2e478",
+        "rev": "62c0d86027edb1c4f39a5facc09876348144f7c9",
         "type": "github"
       },
       "original": {
@@ -479,7 +496,8 @@
         "nixos-images": "nixos-images",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
-        "sops-nix": "sops-nix"
+        "sops-nix": "sops-nix",
+        "tome": "tome"
       }
     },
     "sops-nix": {
@@ -517,6 +535,22 @@
         "type": "github"
       }
     },
+    "tome": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785431655,
+        "narHash": "sha256-EoM4HmJb7MZArMoP4y1b7DZcvM8iANYjMiE5gGUx070=",
+        "ref": "refs/heads/master",
+        "rev": "4f3ca447cdc967371adaf71b26cf283952e54212",
+        "revCount": 51,
+        "type": "git",
+        "url": "ssh://gitea@git.mgaction.town:2222/darman/TOME.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@git.mgaction.town:2222/darman/TOME.git"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
@@ -550,11 +584,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785147819,
-        "narHash": "sha256-udwe836AZe8BYU+YqVc51QLuOeWKoGEmPIMF0ImUfTQ=",
+        "lastModified": 1785277507,
+        "narHash": "sha256-9Tq3UDX2hD/aveW/HvkBlAmEwJTOlY5HQXJM+L5BGmE=",
         "owner": "pyproject-nix",
         "repo": "uv2nix",
-        "rev": "0983f54345137c2dd528ce2c28cb56c2cbdceb2a",
+        "rev": "5a836d395cbf5fc22670eb98dd4aa4fc4d406977",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 8fcd9ef..12e71fb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -43,10 +43,19 @@
       url = "git+https://git.mgaction.town/darman/hypr-chrome.git";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    # NOTE: the `tome` input (private repo git+ssh://gitea@git.mgaction.town) was
-    # removed temporarily — the credential-less installer-iso can't fetch it, so
-    # `install terra localhost` failed at nixos-install (post-disko). Re-add it
-    # (input + packages.tome + desktop-apps.nix) once the installer can auth.
+    # Tome (formerly AudibleLibrary) — darman's own .NET/Photino desktop app.
+    # Private repo on our own gitea; fetched over ssh with darman's ambient key,
+    # same as any other git flake input. `flake = false`: it's a plain source
+    # tree, not itself a flake. See pkgs/tome.nix.
+    #
+    # NOTE: the credential-less installer-iso can't fetch this (git+ssh needs
+    # darman's key), so `./scripts/deploy install terra localhost` will fail
+    # at nixos-install (post-disko) while this input is present. Known
+    # tradeoff — re-removed this once before (4f79ec7) for the same reason.
+    tome = {
+      url = "git+ssh://gitea@git.mgaction.town:2222/darman/TOME.git";
+      flake = false;
+    };
   };
 
   outputs = { self, nixpkgs, disko, nixos-anywhere, sops-nix, nixos-images, home-manager, mediamanager-nix, authentik-nix, ... }@inputs: