diff --git a/flake.nix b/flake.nix
index 55079d1..342fc90 100644
--- a/flake.nix
+++ b/flake.nix
@@ -22,7 +22,6 @@
           mkOption
           optional
           optionalAttrs
-          setAttrByPath
           types
           unique
           ;
@@ -143,12 +142,21 @@
 
         whiteboardModuleAvailable = hasAttrByPath [ "services" "nextcloud-whiteboard-server" ] options;
         anubisModuleAvailable = hasAttrByPath [ "services" "anubis" "instances" ] options;
-        authentikTargetAvailable = hasAttrByPath cfg.authentik.blueprint.targetOption options;
+        whiteboardPackage =
+          if cfg.addons.whiteboard.disableRecording then
+            pkgs.nextcloud-whiteboard-server.overrideAttrs (old: {
+              postPatch = (old.postPatch or "") + ''
+                substituteInPlace websocket_server/SocketManager.js \
+                  --replace-fail $'const support = await checkPuppeteerAvailability({ force: false })\n\t\t\tsocket.emit(\'recording-availability\', {\n\t\t\t\tavailable: support.available,\n\t\t\t\treason: support.reason || null,\n\t\t\t})' $'if (process.env.DISABLE_RECORDING === "1") {\n\t\t\tsocket.emit(\'recording-availability\', {\n\t\t\t\tavailable: false,\n\t\t\t\treason: null,\n\t\t\t})\n\t\t\treturn\n\t\t}\n\n\t\t\tconst support = await checkPuppeteerAvailability({ force: false })\n\t\tsocket.emit(\'recording-availability\', {\n\t\t\tavailable: support.available,\n\t\t\treason: support.reason || null,\n\t\t})'
+              '';
+            })
+          else
+            pkgs.nextcloud-whiteboard-server;
 
         whiteboardStart = pkgs.writeShellScript "nextcloud-whiteboard-with-secret" ''
           set -euo pipefail
           export JWT_SECRET_KEY="$(<"$CREDENTIALS_DIRECTORY/jwt")"
-          exec ${lib.getExe pkgs.nextcloud-whiteboard-server}
+          exec ${lib.getExe whiteboardPackage}
         '';
 
         configScript = pkgs.writeShellScript "nextcloud-stack-config" ''
@@ -398,20 +406,10 @@
                 description = "Generate an Authentik blueprint under /etc/nextcloud.";
               };
 
-              autoAttach = mkOption {
-                type = types.bool;
-                default = true;
-                description = "Also attach the blueprint to targetOption when that option exists.";
-              };
-
-              targetOption = mkOption {
-                type = types.listOf types.str;
-                default = [
-                  "methanium"
-                  "authentik"
-                  "blueprints"
-                  "nextcloud"
-                ];
+              content = mkOption {
+                type = types.str;
+                readOnly = true;
+                description = "Generated Authentik blueprint for use by an Authentik module.";
               };
 
               secretEnvName = mkOption {
@@ -691,17 +689,6 @@
           })
 
           (mkIf (cfg.addons.whiteboard.enable && cfg.addons.whiteboard.disableRecording) {
-            nixpkgs.overlays = [
-              (final: prev: {
-                nextcloud-whiteboard-server = prev.nextcloud-whiteboard-server.overrideAttrs (old: {
-                  postPatch = (old.postPatch or "") + ''
-                    substituteInPlace websocket_server/SocketManager.js \
-                      --replace-fail $'const support = await checkPuppeteerAvailability({ force: false })\n\t\t\tsocket.emit(\'recording-availability\', {\n\t\t\t\tavailable: support.available,\n\t\t\t\treason: support.reason || null,\n\t\t\t})' $'if (process.env.DISABLE_RECORDING === "1") {\n\t\t\t\tsocket.emit(\'recording-availability\', {\n\t\t\t\t\tavailable: false,\n\t\t\t\t\treason: null,\n\t\t\t\t})\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tconst support = await checkPuppeteerAvailability({ force: false })\n\t\t\tsocket.emit(\'recording-availability\', {\n\t\t\t\tavailable: support.available,\n\t\t\t\treason: support.reason || null,\n\t\t\t})'
-                  '';
-                });
-              })
-            ];
-
             services.nextcloud-whiteboard-server.settings.DISABLE_RECORDING = "1";
           })
 
@@ -744,12 +731,9 @@
           })
 
           (mkIf cfg.authentik.blueprint.enable {
+            custom.nextcloud.authentik.blueprint.content = authentikBlueprint;
             environment.etc."nextcloud/authentik-blueprint.yaml".text = authentikBlueprint;
           })
-
-          (mkIf (
-            cfg.authentik.blueprint.enable && cfg.authentik.blueprint.autoAttach && authentikTargetAvailable
-          ) (setAttrByPath cfg.authentik.blueprint.targetOption authentikBlueprint))
         ]);
       };
   };