diff --git a/hosts/nom/fs.nix b/hosts/nom/fs.nix
index 66e2de1..efc547e 100644
--- a/hosts/nom/fs.nix
+++ b/hosts/nom/fs.nix
@@ -1,18 +1,55 @@
 {
-  fileSystems = {
-    "/" = {
-      device = "rpool/root/nixos";
-      fsType = "zfs";
-      options = ["zfsutil" "X-mount.mkdir"];
+  config,
+  lib,
+  extraLib,
+  pkgs,
+  ...
+}: {
+  disko.devices = {
+    disk = {
+      m2-ssd = {
+        type = "disk";
+        device = "/dev/disk/by-id/${config.repo.secrets.local.disk.m2-ssd}";
+        content = with extraLib.disko.gpt; {
+          type = "table";
+          format = "gpt";
+          partitions = [
+            (partLuksZfs "rpool" "0%" "100%")
+          ];
+        };
+      };
+      boot-ssd = {
+        type = "disk";
+        device = "/dev/disk/by-id/${config.repo.secrets.local.disk.boot-ssd}";
+        content = with extraLib.disko.gpt; {
+          type = "table";
+          format = "gpt";
+          partitions = [
+            (partEfi "efi" "0%" "8GiB")
+            (partSwap "swap" "8GiB" "100%")
+          ];
+        };
+      };
     };
-
-    "/boot" = {
-      device = "/dev/disk/by-uuid/91ED-0E13";
-      fsType = "vfat";
+    zpool = with extraLib.disko.zfs; {
+      rpool = defaultZpoolOptions // {datasets = defaultZfsDatasets;};
     };
   };
 
-  swapDevices = [
-    {device = "/dev/disk/by-uuid/1122527a-71d3-4ec7-8d41-65d0c8494b04";}
-  ];
+  # TODO remove once this is upstreamed
+  boot.initrd.systemd.services."zfs-import-rpool".after = ["cryptsetup.target"];
+  fileSystems."/state".neededForBoot = true;
+  fileSystems."/persist".neededForBoot = true;
+
+  # After importing the rpool, rollback the root system to be empty.
+  boot.initrd.systemd.services.impermanence-root = {
+    wantedBy = ["initrd.target"];
+    after = ["zfs-import-rpool.service"];
+    before = ["sysroot.mount"];
+    unitConfig.DefaultDependencies = "no";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.zfs}/bin/zfs rollback -r rpool/local/root@blank";
+    };
+  };
 }
diff --git a/hosts/sentinel/fs.nix b/hosts/sentinel/fs.nix
index 86b0e3d..3e76eb1 100644
--- a/hosts/sentinel/fs.nix
+++ b/hosts/sentinel/fs.nix
@@ -21,22 +21,7 @@
       };
     };
     zpool = with extraLib.disko.zfs; {
-      rpool =
-        defaultZpoolOptions
-        // {
-          datasets = {
-            "local" = unmountable;
-            "local/root" =
-              filesystem "/"
-              // {
-                postCreateHook = "zfs snapshot rpool/local/root@blank";
-              };
-            "local/nix" = filesystem "/nix";
-            "local/state" = filesystem "/state";
-            "safe" = unmountable;
-            "safe/persist" = filesystem "/persist";
-          };
-        };
+      rpool = defaultZpoolOptions // {datasets = defaultZfsDatasets;};
     };
   };
 
diff --git a/hosts/ward/fs.nix b/hosts/ward/fs.nix
index 83c2c16..45135dc 100644
--- a/hosts/ward/fs.nix
+++ b/hosts/ward/fs.nix
@@ -25,19 +25,11 @@
       rpool =
         defaultZpoolOptions
         // {
-          datasets = {
-            "local" = unmountable;
-            "local/root" =
-              filesystem "/"
-              // {
-                postCreateHook = "zfs snapshot rpool/local/root@blank";
-              };
-            "local/nix" = filesystem "/nix";
-            "local/state" = filesystem "/state";
-            "safe" = unmountable;
-            "safe/persist" = filesystem "/persist";
-            "safe/vms" = unmountable;
-          };
+          datasets =
+            defaultZfsDatasets
+            // {
+              "safe/vms" = unmountable;
+            };
         };
     };
   };
diff --git a/nix/lib.nix b/nix/lib.nix
index dfdbe99..1191f9d 100644
--- a/nix/lib.nix
+++ b/nix/lib.nix
@@ -166,7 +166,7 @@ in rec {
         };
       };
     };
-    zfs = {
+    zfs = rec {
       defaultZpoolOptions = {
         type = "zpool";
         mountRoot = "/mnt";
@@ -183,6 +183,19 @@ in rec {
         options.ashift = "12";
       };
 
+      defaultZfsDatasets = {
+        "local" = unmountable;
+        "local/root" =
+          filesystem "/"
+          // {
+            postCreateHook = "zfs snapshot rpool/local/root@blank";
+          };
+        "local/nix" = filesystem "/nix";
+        "local/state" = filesystem "/state";
+        "safe" = unmountable;
+        "safe/persist" = filesystem "/persist";
+      };
+
       unmountable = {type = "zfs_fs";};
       filesystem = mountpoint: {
         type = "zfs_fs";