diff --git a/flake.nix b/flake.nix
index c9315dab..b0a44bc6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,19 +5,14 @@
 
   outputs = { self, nixpkgs, ... }:
 let
+  forAllSystems = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" "armv6l-linux" "armv7l-linux" "i686-linux" "riscv64-linux" ];
+
   mkConf = name: nixpkgs.lib.nixosSystem {
     system = "x86_64-linux";
     specialArgs = { inherit nixpkgs; theFlake = self; };
     modules = [ "${self.outPath}/m/${name}/configuration.nix" ];
   };
-  # For now we only support x86
-  system = "x86_64-linux";
-  pkgs = import nixpkgs {
-    inherit system;
-    overlays = [ self.overlays.default ];
-    config.allowUnfree = true;
-  };
-in
+  in
   {
     nixosConfigurations = {
       hut     = mkConf "hut";
@@ -38,9 +33,15 @@ in
     overlays.default = self.bscOverlay;
 
     # full nixpkgs with our overlay applied
-    legacyPackages.${system} = pkgs;
+    legacyPackages = forAllSystems (system:
+      import nixpkgs {
+        inherit system;
+        overlays = [ self.overlays.default ];
+        config.allowUnfree = true;
+      }
+    );
 
-    hydraJobs = self.legacyPackages.${system}.bsc.hydraJobs;
+    hydraJobs = self.legacyPackages.x86_64-linux.bsc.hydraJobs;
 
     # propagate nixpkgs lib, so we can do bscpkgs.lib
     lib = nixpkgs.lib // {
diff --git a/overlay.nix b/overlay.nix
index 1e2f350a..0e00a99e 100644
--- a/overlay.nix
+++ b/overlay.nix
@@ -61,6 +61,16 @@ let
     tagaspi = callPackage ./pkgs/tagaspi/default.nix { };
     tampi = callPackage ./pkgs/tampi/default.nix { };
     upc-qaire-exporter = prev.callPackage ./pkgs/upc-qaire-exporter/default.nix { };
+    upx = prev.upx.overrideAttrs {
+      version = "5.1.0";
+      src = final.fetchFromGitHub {
+        owner = "upx";
+        repo = "upx";
+        tag = "v5.1.0";
+        fetchSubmodules = true;
+        hash = "sha256-FQtDHsbZ/JrgRLwc2Wd2F5ZcBdqrU0YIT9hGQ0k0D+w=";
+      };
+    };
     wxparaver = callPackage ./pkgs/paraver/default.nix { };
   };
 
diff --git a/pkgs/nix-portable/default.nix b/pkgs/nix-portable/default.nix
index dbe42415..5fdd7f7d 100644
--- a/pkgs/nix-portable/default.nix
+++ b/pkgs/nix-portable/default.nix
@@ -19,6 +19,16 @@ with builtins;
   compression ? "zstd -19 -T0",
   lib ? pkgs.lib,
   pkgs ? import <nixpkgs> {},
+
+  # pkgs set from the host system (just for eval in installDynamic)
+  pkgsHost ?
+    if stdenv.hostPlatform == stdenv.buildPlatform then
+      pkgs
+    else
+      import pkgs.path {
+        system = pkgs.stdenv.hostPlatform.system;
+      },
+
   # hardcode executable to run. Useful when creating a bundle.
   bundledPackage ? null,
 
@@ -49,7 +59,7 @@ let
     in
     stdenv.mkDerivation {
       name = "nix-portable-store-tarball";
-      nativeBuildInputs = [ perl zstd ];
+      nativeBuildInputs = [ perl pkgs.zstd ];
       exportReferencesGraph = map (x: [("closure-" + baseNameOf x) x]) targets;
       buildCommand = ''
         storePaths=$(cat ${closureInfo}/store-paths)
@@ -86,9 +96,9 @@ let
   '';
 
   installDynamic = pkgname: let
-    out = pkgs.${pkgname}.out;
+    out = builtins.unsafeDiscardStringContext pkgsHost.${pkgname}.out.outPath;
   in ''
-    if [ ! -e \$store${lib.removePrefix "/nix/store" pkgs.${pkgname}.out} ] ; then
+    if [ ! -e \$store${lib.removePrefix "/nix/store" out} ] ; then
       debug "Installing ${pkgname}"
       \$run \$store${lib.removePrefix "/nix/store" nix}/bin/nix build --impure --no-link --expr "
         (import ${nixpkgsSrc} {}).${pkgname}.out
@@ -100,7 +110,9 @@ let
     export PATH="${out}/bin:\$PATH"
   '';
 
-  caBundleZstd = pkgs.runCommand "cacerts" {} "cat ${cacert}/etc/ssl/certs/ca-bundle.crt | ${zstd}/bin/zstd -19 > $out";
+  caBundleZstd = pkgs.runCommand "cacerts" {
+    nativeBuildInputs = [ pkgs.zstd ];
+  } "cat ${cacert}/etc/ssl/certs/ca-bundle.crt | zstd -19 > $out";
 
   bwrap = packStaticBin "${bwrapStatic}/bin/bwrap";
   nixStatic = packStaticBin "${inp.nixStatic}/bin/nix";
@@ -252,7 +264,7 @@ let
     fi
 
     # Override $SHELL with nix bashInteractive
-    export SHELL="${pkgs.bashInteractive.out}/bin/bash"
+    export SHELL="${builtins.unsafeDiscardStringContext pkgsHost.bashInteractive.out.outPath}/bin/bash"
     export PS1="\n\[\033[1;32m\][\[\e]0;\u@\h: \w\a\]\u@\h:\w]\$\[\033[0m\] "
 
     # unset bash function aliases
@@ -297,7 +309,7 @@ let
 
 
     collectBinds(){
-      pathsTopLevel="/boot /run /sys \$PWD /gpfs /tmp /scratch"
+      pathsTopLevel="/boot /run /sys \$PWD /gpfs /tmp /scratch /home"
 
       toBind=""
       for p in \$pathsTopLevel; do
@@ -591,7 +603,7 @@ let
   runtimeScriptEscaped = replaceStrings ["\""] ["\\\""] runtimeScript;
 
   nixPortable = pkgs.runCommand pname {
-    nativeBuildInputs = [unixtools.xxd unzip];
+    nativeBuildInputs = [unixtools.xxd unzip pkgs.zip];
 
     meta = {
       homepage = "https://github.com/DavHau/nix-portable";
@@ -619,7 +631,7 @@ let
 
     unzip -vl $out/bin/nix-portable.zip
 
-    zip="${zip}/bin/zip -0"
+    zip="zip -0"
     $zip $out/bin/nix-portable.zip ${bwrap}/bin/bwrap
     $zip $out/bin/nix-portable.zip ${nixStatic}/bin/nix
     $zip $out/bin/nix-portable.zip ${zstd}/bin/zstd
@@ -630,7 +642,7 @@ let
     fp=$(sha256sum $out/bin/nix-portable.zip | cut -d " "  -f 1)
     sed -i "s/_FINGERPRINT_PLACEHOLDER_/$fp/g" $out/bin/nix-portable.zip
     # fix broken zip header due to manual modification
-    ${zip}/bin/zip -F $out/bin/nix-portable.zip --out $out/bin/nix-portable-fixed.zip
+    zip -F $out/bin/nix-portable.zip --out $out/bin/nix-portable-fixed.zip
 
     rm $out/bin/nix-portable.zip
     executable=${if bundledPackage == null then "" else bundledExe}