{
  me,
  pkgs,
  auxiliaryPkgs,
  unstablePkgs,
  ...
}:

let
  inherit (builtins) filter elem;

  filterUnsupportedPackages =
    packages: filter (p: elem me.system (p.meta.platforms or [ me.system ])) packages;
in
{
  # TODO: the filter already does some good work, but we need some way to
  # pick out x86-only packages, so it is not as opaque as it currently is.
  # (who knows if muse-sounds-manager is actually installed, for example?)
  environment.systemPackages = (with pkgs; filterUnsupportedPackages [
    file unzip jq dig htop wget screen dive
    gnupg pinentry-gnome3 age agenix minisign openssl cryptsetup pamtester
    bitwarden-desktop bitwarden-cli
    inetutils pciutils usbutils lshw lsof inxi iw pmutils acpi acpid
    minicom miniserve netcat-gnu socat tcpdump nmap iftop iperf mtr arp-scan ethtool
    sysprof wireshark seer mitmproxy hardinfo2 btrfs-assistant remmina trayscale
    vlc celluloid foliate calibre
    yt-dlp ffmpeg_7-full imagemagick handbrake mpv helvum
    gimp3 krita mypaint aseprite rnote fontforge-gtk
    blender inkscape obs-studio darktable davinci-resolve
    orca-slicer
    renderdoc
    audacity musescore muse-sounds-manager reaper
    # bitwigs bubblewrap configuration requires some non-ARM package sets.
    # bitwig-studio
    ungoogled-chromium librewolf lagrange
    senpai signal-desktop alpaca newsflash
    qemu_full virtiofsd

    openvpn openvpn3 update-resolv-conf
    transmission_4-gtk fragments

    xorg.xeyes wl-clipboard

    ripgrep hyperfine parallel just fzf bat delta eza fd tokei didyoumean
    universal-ctags compiledb graphviz
    python3 uv ruff
    nodejs_22 deno yarn
    rustc rustup cargo rustfmt
    go gopls delve go-task gotags golangci-lint
    meson cmake gnumake ninja gdb gcc clang clang-tools
    hare haredoc
    jdk maven gradle
    nil nixfmt-rfc-style
    nixpkgs-review nixpkgs-fmt nixpkgs-lint-community
    shellcheck shfmt
    postgresql
    helix alacritty ghostty
    androidStudioPackages.dev

    winetricks bottles
    scrcpy apfs-fuse nfs-utils
    ubootTools dtc cloud-utils
    borgbackup pika-backup

    prismlauncher xonotic

    man-pages man-pages-posix
  ]) ++ (with unstablePkgs; [
    claude-code gemini-cli
  ]) ++ (with auxiliaryPkgs; [
    # TODO: need fixes for 25.05
    # retroarch wine

    # TODO: ngfx (obviously) does not work on ARM, put it somewhere else
    # ngfx
  ]);

  environment.etc.openvpn.source = "${pkgs.update-resolv-conf}/libexec/openvpn";
}