diff --git a/ci.nix b/ci.nix
new file mode 100644
index 0000000..851307e
--- /dev/null
+++ b/ci.nix
@@ -0,0 +1,77 @@
+{ inputs, system, name }:
+let
+  inherit (inputs) nixpkgs;
+  pkgs = nixpkgs.legacyPackages.${system};
+  ensureFiles = paths: pkgs.runCommand "directory" {} ''
+    set -efu
+    mkdir $out
+    cd $out
+    ${nixpkgs.lib.concatMapStringsSep "\n" (path: ''
+      mkdir -p "$(dirname ${nixpkgs.lib.escapeShellArg path})"
+      echo foo > ${nixpkgs.lib.escapeShellArg path}
+    '') paths}
+  '';
+  nixPathFor = nixpkgs.lib.concatStringsSep ":" [
+    "nixos-config=${toString ./.}/systems/${name}/configuration.nix"
+    "niveum=${toString ./.}"
+    "nixpkgs=${inputs.nixpkgs}"
+    "nixpkgs-unstable=${inputs.nixpkgs-unstable}"
+    "stockholm=${inputs.stockholm}"
+    "home-manager=${inputs.home-manager}"
+    "nix-writers=${inputs.nix-writers}"
+    "retiolum=${inputs.retiolum}"
+    "menstruation-backend=${inputs.menstruation-backend}"
+    "menstruation-telegram=${inputs.menstruation-telegram}"
+    "system-secrets=${systemSecrets}"
+    "secrets=${sharedSecrets}"
+  ];
+  # cd ~/.password-store/shared && find * -type f | sed 's/.gpg$//'
+  sharedSecrets = ensureFiles [
+    "di.fm/key"
+    "eduroam/identity"
+    "eduroam/password"
+    "fritznas.smb"
+    "mail/cock"
+    "mail/fastmail"
+    "mail/gmail/amroplay"
+    "mail/gmail/kieran.meinhardt"
+    "mail/meinhaki"
+    "mail/meinhaki.cert"
+    "mail/posteo"
+    "nextcloud-fysi/password"
+    "nextcloud/password"
+    "openweathermap.key"
+    "posteo/password"
+    "spotify/password"
+    "spotify/username"
+    "traadfri.key"
+    "wifi/Aether.psk"
+  ];
+  systemSecrets = let basic = [ "retiolum.ed25519" "retiolum.key" "syncthing/cert.pem" "syncthing/key.pem"]; in {
+    zaatar = ensureFiles ([ "moodle.token" "telegram/moodle-dl.token" ] ++ basic);
+    kabsa = ensureFiles basic;
+    manakish = ensureFiles basic;
+    makanek = ensureFiles ([
+      "irc/retiolum"
+      "irc/hackint"
+      "irc/libera"
+      "irc/oftc"
+      "matrix/nibbana"
+      "maxmind/license.key"
+      "moodle-dl/faye.token"
+      "nextcloud/admin"
+      "nextcloud/database"
+      "telegram/nachtischsatan.token"
+      "telegram/reverse.token"
+      "telegram/odyssey.token"
+      "telegram/betacode.token"
+      "telegram/moodle-dl.token"
+      "telegram/proverb.token"
+      "telegram/menstruation.token"
+      "telegram/cool_village.token"
+      "telegram/kmein.token"
+      "telegram/prometheus.token"
+      "weechat/relay"
+    ] ++ basic);
+  }.${name};
+in toString (pkgs.writers.writeDash "build" "NIX_PATH=${nixPathFor name} nix-build '<nixpkgs/nixos>' -A system --dry-run")
diff --git a/configs/stardict.nix b/configs/stardict.nix
index 6ba5b52..22537b8 100644
--- a/configs/stardict.nix
+++ b/configs/stardict.nix
@@ -23,10 +23,6 @@ let
       url = "https://github.com/latin-dict/Frisk1960/releases/download/v1.1/Frisk1960-stardict.zip";
       sha256 = "1rk5a3n3fpfdcmg4bc5945m88s6ldxql8cjn4jqs33rgklh7n046";
     };
-    Georges-Lat-De = builtins.fetchTarball {
-      url = "http://download.huzheng.org/de/stardict-georges_lat-de-2.4.2.tar.bz2";
-      sha256 = "0n9jkr17q8amldw7ndy3ji6nnadjfmxl4v8clqqicbdfd1w44yj2";
-    };
     Georges-De-Lat = builtins.fetchTarball {
       url = "http://download.huzheng.org/de/stardict-georges_de-lat-2.4.2.tar.bz2";
       sha256 = "023n55fcbx0jm92198am600h9pv4n3iymkz2ixqn2ka4fj6dhw9g";
@@ -138,7 +134,12 @@ in
   # http://download.huzheng.org/bigdict/stardict-Concise_Oxford_Thesaurus_2nd_Ed-2.4.2.tar.bz2
   # http://download.huzheng.org/bigdict/stardict-Urban_Dictionary_P1-2.4.2.tar.bz2
   # http://download.huzheng.org/bigdict/stardict-Urban_Dictionary_P2-2.4.2.tar.bz2
-  environment.etc.stardict.source = toString (makeStardictDataDir (classicsDictionaries // sanskritDictionaries // englishGermanDictionaries));
+  environment.etc.stardict.source = toString (makeStardictDataDir (classicsDictionaries // {
+    Georges-Lat-De = builtins.fetchTarball { # TODO find out why this does not work with sdcv
+      url = "http://download.huzheng.org/de/stardict-georges_lat-de-2.4.2.tar.bz2";
+      sha256 = "0n9jkr17q8amldw7ndy3ji6nnadjfmxl4v8clqqicbdfd1w44yj2";
+    };
+  } // sanskritDictionaries // englishGermanDictionaries));
 
   environment.variables = {
     SDCV_PAGER = "${pkgs.w3m}/bin/w3m -T text/html -dump";