diff --git a/README.md b/README.md
index 471605e..829bd2d 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,6 @@ set up git configuration for local development: `git config --local include.path
 # Tasks:
 
 ## Tech Debt
-- allowUnfree should be enabled user side not host side (this isn't enabled at all right now for some reason???)
 - vscode extensions should be in own flake (make sure to add the nixpkgs.overlays in it too)
 - join config for systemd.tmpfiles.rules and service directory bindings
 - monitor configuration in `~/.config/monitors.xml` should be sym linked to `/run/gdm/.config/monitors.xml`
diff --git a/hosts/defiant/configuration.nix b/hosts/defiant/configuration.nix
index 05c590e..ec5cf1d 100644
--- a/hosts/defiant/configuration.nix
+++ b/hosts/defiant/configuration.nix
@@ -23,8 +23,6 @@
     efiInstallAsRemovable = true;
   };
 
-  nixpkgs.config.allowUnfree = true;
-
   domains = {
     base_domain = "jan-leila.com";
     headscale.subdomain = "vpn";
diff --git a/hosts/horizon/configuration.nix b/hosts/horizon/configuration.nix
index 1bd5bfc..c83fcc6 100644
--- a/hosts/horizon/configuration.nix
+++ b/hosts/horizon/configuration.nix
@@ -33,9 +33,6 @@
   # Enable touchpad support (enabled default in most desktopManager).
   # services.xserver.libinput.enable = true;
 
-  # Allow unfree packages
-  nixpkgs.config.allowUnfree = true;
-
   # Open ports in the firewall.
   # networking.firewall.allowedTCPPorts = [ ... ];
   # networking.firewall.allowedUDPPorts = [ ... ];
diff --git a/hosts/twilight/configuration.nix b/hosts/twilight/configuration.nix
index c2951f3..6441e2a 100644
--- a/hosts/twilight/configuration.nix
+++ b/hosts/twilight/configuration.nix
@@ -227,9 +227,6 @@
   # Enable touchpad support (enabled default in most desktopManager).
   # services.xserver.libinput.enable = true;
 
-  # Allow unfree packages
-  nixpkgs.config.allowUnfree = true;
-
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave
diff --git a/users/ester/default.nix b/users/ester/default.nix
index e3ddc15..c4a18fb 100644
--- a/users/ester/default.nix
+++ b/users/ester/default.nix
@@ -11,6 +11,8 @@ in {
   };
 
   config = {
+    nixpkgs.config.allowUnfree = true;
+
     sops.secrets = lib.mkIf cfg.isFullUser {
       "passwords/ester" = {
         neededForUsers = true;
diff --git a/users/eve/default.nix b/users/eve/default.nix
index 32693c1..b674331 100644
--- a/users/eve/default.nix
+++ b/users/eve/default.nix
@@ -11,6 +11,8 @@ in {
   };
 
   config = {
+    nixpkgs.config.allowUnfree = true;
+
     sops.secrets = lib.mkIf cfg.isFullUser {
       "passwords/eve" = {
         neededForUsers = true;
diff --git a/users/leyla/default.nix b/users/leyla/default.nix
index 1934bd2..cd4332e 100644
--- a/users/leyla/default.nix
+++ b/users/leyla/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   config,
-  pkgs,
   ...
 }: let
   cfg = config.users.leyla;
@@ -17,6 +16,8 @@ in {
   };
 
   config = {
+    nixpkgs.config.allowUnfree = true;
+
     sops.secrets = lib.mkIf (cfg.isFullUser || cfg.isThinUser) {
       "passwords/leyla" = {
         neededForUsers = true;