diff --git a/flake.lock b/flake.lock
index f7fc1e7..c9f3362 100644
--- a/flake.lock
+++ b/flake.lock
@@ -28,11 +28,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1722339003,
-        "narHash": "sha256-ZeS51uJI30ehNkcZ4uKqT4ZDARPyqrHADSKAwv5vVCU=",
+        "lastModified": 1720546205,
+        "narHash": "sha256-boCXsjYVxDviyzoEyAk624600f3ZBo/DKtUdvMTpbGY=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "3f1dae074a12feb7327b4bf43cbac0d124488bb7",
+        "rev": "de96bd907d5fbc3b14fc33ad37d1b9a3cb15edc6",
         "type": "github"
       },
       "original": {
@@ -176,11 +176,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723080788,
-        "narHash": "sha256-C5LbM5VMdcolt9zHeLQ0bYMRjUL+N+AL5pK7/tVTdes=",
+        "lastModified": 1721735625,
+        "narHash": "sha256-4T0FK0b3Q7Dd7oj79M7GhA9+YqKxxGT0iN+h8yqdP7s=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ffc1f95f6c28e1c6d1e587b51a2147027a3e45ed",
+        "rev": "4698b1ef375e9c904037e0b2049aa73d39ac1b2d",
         "type": "github"
       },
       "original": {
@@ -480,11 +480,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722740924,
-        "narHash": "sha256-UQPgA5d8azLZuDHZMPmvDszhuKF1Ek89SrTRtqsQ4Ss=",
+        "lastModified": 1721531260,
+        "narHash": "sha256-O72uxk4gYFQDwNkoBioyrR3GK9EReZmexCStBaORMW8=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "97ca0a0fca0391de835f57e44f369a283e37890f",
+        "rev": "b6db9fd8dc59bb2ccb403f76d16ba8bbc1d5263d",
         "type": "github"
       },
       "original": {
@@ -592,11 +592,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1722869614,
-        "narHash": "sha256-7ojM1KSk3mzutD7SkrdSflHXEujPvW1u7QuqWoTLXQU=",
+        "lastModified": 1721548954,
+        "narHash": "sha256-7cCC8+Tdq1+3OPyc3+gVo9dzUNkNIQfwSDJ2HSi2u3o=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "883180e6550c1723395a3a342f830bfc5c371f6b",
+        "rev": "63d37ccd2d178d54e7fb691d7ec76000740ea24a",
         "type": "github"
       },
       "original": {
diff --git a/system/configuration.nix b/system/configuration.nix
index 6661e40..516a3ff 100644
--- a/system/configuration.nix
+++ b/system/configuration.nix
@@ -22,6 +22,7 @@
     ./users.nix
     ./containers.nix
     ./network.nix
+    ./keyboard.nix
     ../settings
   ];
 
diff --git a/system/gitlab-runner.nix b/system/gitlab-runner.nix
index c50e1b9..fa426e2 100644
--- a/system/gitlab-runner.nix
+++ b/system/gitlab-runner.nix
@@ -47,5 +47,6 @@
         PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
         NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
       };
+      tagList = [ "nix" ];
     };
 }
diff --git a/system/keyboard.nix b/system/keyboard.nix
new file mode 100644
index 0000000..bdb9f24
--- /dev/null
+++ b/system/keyboard.nix
@@ -0,0 +1,25 @@
+{ pkgs, lib, ... }:
+{
+  services.keyd = {
+    enable = true;
+    keyboards.default = {
+      ids = [ "*" ];
+      settings = {
+        "main" = {
+          # Some programs don't respect colemaks capslock bind, so we force it here
+          "capslock" = "backspace";
+
+          # keyd has incorrect defaults :/
+          "leftshift" = "leftshift";
+          "rightshift" = "rightshift";
+          "leftalt" = "leftalt";
+          "rightalt" = "rightalt";
+          "leftcontrol" = "leftcontrol";
+          "rightcontrol" = "rightcontrol";
+          "leftmeta" = "leftmeta";
+          "rightmeta" = "rightmeta";
+        };
+      };
+    };
+  };
+}
diff --git a/system/monolith-gitlab-runner.nix b/system/monolith-gitlab-runner.nix
index f17fbe3..8e419d1 100644
--- a/system/monolith-gitlab-runner.nix
+++ b/system/monolith-gitlab-runner.nix
@@ -14,6 +14,18 @@ in
     enable = true;
     settings.concurrent = 4;
     services = {
+      # ci_test = {
+      #   registrationConfigFile = "/srv/gitlab-runner/env/ci_test";
+      #   dockerImage = "debian";
+      #   dockerPrivileged = true;
+      # };
+      thoreb_builder = {
+        registrationConfigFile =
+          config.age.secrets.monolith-gitlab-runner-thoreb-itinerario-registrationConfigFile.path;
+        dockerImage = "debian";
+        dockerPrivileged = true;
+      };
+
       # runner for building in docker via host's nix-daemon
       # nix store will be readable in runner, might be insecure
       thoreb-telemetria-nix = mkNixRunner config.age.secrets.gitlab-runner-thoreb-telemetria-registrationConfigFile.path;