diff --git a/bump-riverside.sh b/bump-riverside.sh
index 3a91457..cb75bd6 100755
--- a/bump-riverside.sh
+++ b/bump-riverside.sh
@@ -27,9 +27,12 @@ sed -i -E "s|(riverside@sha256:)[0-9a-f]{64}|\1${NEW_DIGEST}|" "$COMPOSE"
 NEW_LINE=$(grep -n 'riverside@sha256:' "$COMPOSE")
 echo "Updated: $NEW_LINE"
 
-echo "Clearing Drupal config table to trigger fresh install on next boot..."
-docker exec riverside-postgres psql -U drupal -d drupal -c "DROP TABLE IF EXISTS config;"
+echo "Stopping riverside containers..."
+docker stop riverside riverside-postgres
 
-echo "Restarting riverside container..."
-docker restart riverside
+echo "Nuking postgres data directory..."
+rm -rf /var/riverside/postgres/data
+
+echo "Restarting riverside arion service..."
+systemctl restart arion-riverside.service
 echo "Done. Tail logs with: docker logs -f riverside"
diff --git a/nixos/arion-riverside/arion-compose.nix b/nixos/arion-riverside/arion-compose.nix
index 8bf09a1..ed37b25 100644
--- a/nixos/arion-riverside/arion-compose.nix
+++ b/nixos/arion-riverside/arion-compose.nix
@@ -8,7 +8,6 @@
     app = {
       service = {
         image = "forge.quinefoundation.com/ironmagma/riverside@sha256:303ac1b79b675230e917c1f3c35f2e1cd81527374af35a7a8419b9b22b65ca6e";
-        pull_policy = "always";
         container_name = "riverside";
         restart = "unless-stopped";
         networks = [ "riverside" ];
diff --git a/nixos/flake.lock b/nixos/flake.lock
index 59afabf..6a89e45 100644
--- a/nixos/flake.lock
+++ b/nixos/flake.lock
@@ -23,6 +23,28 @@
         "type": "github"
       }
     },
+    "arion": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "haskell-flake": "haskell-flake",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770259557,
+        "narHash": "sha256-EvZ09k9+mzXAngPzU2K7oLLUDlKoT1numb4bDb3Gtl4=",
+        "owner": "hercules-ci",
+        "repo": "arion",
+        "rev": "9b24cf65c72cb0e9616e437d55e1ac8e5c6bc715",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "arion",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -66,6 +88,27 @@
       }
     },
     "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "arion",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
       "inputs": {
         "nixpkgs-lib": [
           "nur",
@@ -86,6 +129,22 @@
         "type": "github"
       }
     },
+    "haskell-flake": {
+      "locked": {
+        "lastModified": 1675296942,
+        "narHash": "sha256-u1X1sblozi5qYEcLp1hxcyo8FfDHnRUVX3dJ/tW19jY=",
+        "owner": "srid",
+        "repo": "haskell-flake",
+        "rev": "c2cafce9d57bfca41794dc3b99c593155006c71e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "ref": "0.1.0",
+        "repo": "haskell-flake",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -198,7 +257,7 @@
     },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts",
+        "flake-parts": "flake-parts_2",
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
@@ -218,6 +277,7 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "arion": "arion",
         "disko": "disko",
         "home-manager": "home-manager_2",
         "nix-index-database": "nix-index-database",
diff --git a/nixos/flake.nix b/nixos/flake.nix
index 55e1843..c27d4cc 100644
--- a/nixos/flake.nix
+++ b/nixos/flake.nix
@@ -23,6 +23,9 @@
   inputs.disko.url = "github:nix-community/disko";
   inputs.disko.inputs.nixpkgs.follows = "nixpkgs";
 
+  inputs.arion.url = "github:hercules-ci/arion";
+  inputs.arion.inputs.nixpkgs.follows = "nixpkgs";
+
   outputs = inputs:
     with inputs; let
       system = "x86_64-linux";
@@ -88,6 +91,7 @@
             [
               (configurationDefaults specialArgs)
               home-manager.nixosModules.home-manager
+              arion.nixosModules.arion
             ]
             ++ modules;
         };
diff --git a/nixos/linux.nix b/nixos/linux.nix
index e384fcb..fd156ba 100644
--- a/nixos/linux.nix
+++ b/nixos/linux.nix
@@ -31,23 +31,6 @@
 
   pullomatic = "${pullomaticPkg}/bin/pullomatic";
 
-  start-arion-run = pkgs.writeShellScriptBin "start-arion-run" ''
-    set -e
-    export PATH="${pkgs.nixVersions.stable}/bin:${pkgs.docker}/bin:$PATH"
-    export NIX_PATH="nixpkgs=${pkgs.path}:nixos-config=/etc/nixos/configuration.nix:/nix/var/nix/profiles/per-user/root/channels"
-    cd /root/petersweb-infra/nixos/arion
-    ${pkgs.arion}/bin/arion down 2>> /var/log/start-arion-run.log >> /var/log/start-arion-run.log
-    ${pkgs.arion}/bin/arion up -d 2>> /var/log/start-arion-run.log >> /var/log/start-arion-run.log
-  '';
-
-  start-arion-riverside-run = pkgs.writeShellScriptBin "start-arion-riverside-run" ''
-    set -e
-    export PATH="${pkgs.nixVersions.stable}/bin:${pkgs.docker}/bin:$PATH"
-    export NIX_PATH="nixpkgs=${pkgs.path}:nixos-config=/etc/nixos/configuration.nix:/nix/var/nix/profiles/per-user/root/channels"
-    cd /root/petersweb-infra/nixos/arion-riverside
-    ${pkgs.arion}/bin/arion down 2>> /var/log/start-arion-riverside-run.log >> /var/log/start-arion-riverside-run.log
-    ${pkgs.arion}/bin/arion up -d 2>> /var/log/start-arion-riverside-run.log >> /var/log/start-arion-riverside-run.log
-  '';
 in {
   imports = [
     (import ./cloned_repos {inherit pkgs pullomatic lib;})
@@ -100,10 +83,6 @@ in {
 
     pkgs.unstable.claude-code
 
-    # For docker-compose like setups
-    pkgs.arion
-    start-arion-run
-    start-arion-riverside-run
   ];
 
   swapDevices = [
@@ -113,26 +92,10 @@ in {
     }
   ];
 
-  systemd.services.forgejo-arion = {
-    description = "Forgejo via Arion";
-    after = [ "network.target" "podman.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = "${start-arion-run}/bin/start-arion-run";
-    };
-  };
-
-  systemd.services.riverside-arion = {
-    description = "Riverside via Arion";
-    after = [ "network.target" "docker.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = "${start-arion-riverside-run}/bin/start-arion-riverside-run";
-    };
+  virtualisation.arion = {
+    backend = "docker";
+    projects.forgejo.settings = import ./arion/arion-compose.nix;
+    projects.riverside.settings = import ./arion-riverside/arion-compose.nix;
   };
 
   services.gitea-actions-runner.instances."ubuntu" = {