diff --git a/flake.lock b/flake.lock
index 204c0f9..096229e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -174,11 +174,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1698053470,
-        "narHash": "sha256-sP8D/41UiwC2qn0X40oi+DfuVzNHMROqIWdSdCI/AYA=",
+        "lastModified": 1697748412,
+        "narHash": "sha256-5VSB63UE/O191cuZiGHbCJ9ipc7cGKB8cHp0cfusuyo=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "80d98a7d55c6e27954a166cb583a41325e9512d7",
+        "rev": "72d53d51704295f1645d20384cd13aecc182f624",
         "type": "github"
       },
       "original": {
@@ -190,11 +190,11 @@
     },
     "nixos-unstable": {
       "locked": {
-        "lastModified": 1698134075,
-        "narHash": "sha256-foCD+nuKzfh49bIoiCBur4+Fx1nozo+4C/6k8BYk4sg=",
+        "lastModified": 1697456312,
+        "narHash": "sha256-roiSnrqb5r+ehnKCauPLugoU8S36KgmWraHgRqVYndo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8efd5d1e283604f75a808a20e6cde0ef313d07d4",
+        "rev": "ca012a02bf8327be9e488546faecae5e05d7d749",
         "type": "github"
       },
       "original": {
@@ -238,11 +238,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1698288402,
-        "narHash": "sha256-jIIjApPdm+4yt8PglX8pUOexAdEiAax/DXW3S/Mb21E=",
+        "lastModified": 1697655685,
+        "narHash": "sha256-79Kuv+QdgsVc+rkibuAgWHnh8IXrLBTOKg5nM0Qvux0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "60b9db998f71ea49e1a9c41824d09aa274be1344",
+        "rev": "80c1aab725151632ddc2a20caeb914e76dd0673c",
         "type": "github"
       },
       "original": {
@@ -254,11 +254,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1698349907,
-        "narHash": "sha256-osw0ai9NkafXjqXIEB0j2TZqs28Yq0ZTSp1yXYv60nc=",
+        "lastModified": 1697826327,
+        "narHash": "sha256-ZIn8FPKcCVQNgEDeIldXcbPUH5G4Mn8cQfD2/P8lDXE=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "284459b884135bdff18e8142b7644c40ee21ec05",
+        "rev": "ec75f6875198259bfbb7ef78c178481c0e057ea3",
         "type": "github"
       },
       "original": {
diff --git a/home/home.nix b/home/home.nix
index 84c3d96..7725cca 100644
--- a/home/home.nix
+++ b/home/home.nix
@@ -11,7 +11,7 @@ let
     thunderbird
     calibre
     dino
-    #zotero   has open CVEs, wait for patch in Zotero7
+    zotero
     keepassxc
     ding
     aspell
diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index b115f84..20c09c3 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -1,6 +1,6 @@
 # Edit this configuration file to define what should be installed on
 # your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running `nixos-help`).
+# and in the NixOS manual (accessible by running ‘nixos-help’).
 
 { config, pkgs, lib, inputs, ... }:
 
@@ -61,6 +61,7 @@ in
   boot.plymouth.enable = true;
 
   networking.hostName = "thinknix";
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
 
   # configure console
   console = {
@@ -166,7 +167,7 @@ in
   services.flatpak.enable = true;
   xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-kde ];
 
-  # Define a user account. Don't forget to set a password with `passwd`.
+  # Define a user account. Don't forget to set a password with ‘passwd’.
   users.users.spiollinux = {
     isNormalUser = true;
     uid = 1000;
@@ -198,6 +199,41 @@ in
       devices = [{ device = "/dev/sda"; } { device = "/dev/sdb"; }];
     };
 
+  # block certain sites to prevent procrastination
+  systemd.services.procrastinationstop = {
+    serviceConfig.Type = "oneshot";
+    wantedBy = [ ];
+    script = ''
+      ln -sf ${pkgs.writeText "blockedHosts" ''
+        127.0.0.1 localhost
+        ::1 localhost
+        127.0.0.2 ${config.networking.hostName}
+        ::1 ${config.networking.hostName}
+
+        ::1   twitter.com
+        127.0.0.1   twitter.com
+        ::1   api.twitter.com
+        127.0.0.1   api.twitter.com
+        ::1   toot.matereal.eu
+        127.0.0.1   toot.matereal.eu
+        ::1   tagesschau.de
+        127.0.0.1   tagesschau.de
+        ::1   dnn.de
+        127.0.0.1   www.dnn.de
+        ::1   www.dnn.de
+        127.0.0.1   dnn.de
+        ''} /etc/hosts
+    '';
+  };
+
+  systemd.services.procrastinationstart = {
+    serviceConfig.Type = "oneshot";
+    wantedBy = [ ];
+    script = ''
+      ln -sf /etc/static/hosts /etc/hosts
+    '';
+  };
+
   fonts = {
     fontDir.enable = true;
     fontconfig.enable = true;