diff --git a/flake.lock b/flake.lock
index 965d277..5ef373b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -52,11 +52,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1715653378,
-        "narHash": "sha256-6kbg/PI3+SBP17f4T0js3CBsMLVtlD0JqJhDKgzk1mQ=",
+        "lastModified": 1717976995,
+        "narHash": "sha256-u3HBinyIyUvL1+N816bODpJmSQdgn0Mbb8BprFw7kqo=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "de8b0d60d6fd34f35abffc46adc94ebaa6996ce2",
+        "rev": "315aa649ba307704db0b16c92f097a08a65ec955",
         "type": "github"
       },
       "original": {
diff --git a/home/hosts/ivr/default.nix b/home/hosts/ivr/default.nix
index 5936604..9f38b22 100644
--- a/home/hosts/ivr/default.nix
+++ b/home/hosts/ivr/default.nix
@@ -5,7 +5,6 @@ let
 		djangorestframework
 		django-rapyd-modernauth
 		environs
-		#itg-django-utils
 		mysqlclient
 		pyyaml
 		ruamel-yaml
@@ -22,14 +21,10 @@ in {
 			aacs
 			ansible
 			bitwarden-cli
-			bruno
 			direnv
-			gcc
 			home-manager
 			insomnia
-			libmysqlclient
 			pipenv-ivr
-			pkg-config
 		];
 		file.".pip/pip.conf".text = (lib.strings.concatStringsSep "\n" [
 			"[global]"
diff --git a/home/xonsh.nix b/home/xonsh.nix
index 411ef8e..10cb5c6 100644
--- a/home/xonsh.nix
+++ b/home/xonsh.nix
@@ -5,18 +5,10 @@
 		enable = true;
 
 		sessionVariables = {
-			TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
 			CLICOLOR = 1;
-			LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd";
 			EDITOR = "${pkgs.vim}/bin/vim";
-			# Tells vox where to find virtualenvs
-			VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/";
 			# vte_new_tab_cwd causes new Terminal tabs to open in the
 			# same CWD as the current tab
-			PROMPT = "{vte_new_tab_cwd}{env_name}{BOLD_GREEN}{user}@{hostname}{BOLD_BLUE} {short_cwd}{branch_color}{curr_branch: {}}{RESET} {BOLD_BLUE}{prompt_end}{RESET} ";
-			SWORD_PATH = "${config.home.homeDirectory}/.sword/";
-			OS_CLOUD = "default";
-			MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true";
 			LESS_TERMCAP_mb = "\\033[01;31m";     # begin blinking
 			LESS_TERMCAP_md = "\\033[01;31m";     # begin bold
 			LESS_TERMCAP_me = "\\033[0m";         # end mode
@@ -24,6 +16,15 @@
 			LESS_TERMCAP_se = "\\033[0m";         # end standout-mode
 			LESS_TERMCAP_us = "\\033[00;36m";     # begin underline
 			LESS_TERMCAP_ue = "\\033[0m";         # end underline
+			LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1";
+			LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd";
+			MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true";
+			OS_CLOUD = "default";
+			PROMPT = "{vte_new_tab_cwd}{env_name}{BOLD_GREEN}{user}@{hostname}{BOLD_BLUE} {short_cwd}{branch_color}{curr_branch: {}}{RESET} {BOLD_BLUE}{prompt_end}{RESET} ";
+			SWORD_PATH = "${config.home.homeDirectory}/.sword/";
+			TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
+			# Tells vox where to find virtualenvs
+			VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/";
 
 			COMPASS_SKIP_ORIGIN_CHECK = "True";
 
@@ -41,7 +42,6 @@
 			cci = "compass workspace run src/python3/uc/tools:circleci-checks";
 			ccover = "compass workspace cover --extra-cmd-args=\"--test_output=errors\"";
 			cexec = "compass workspace exec";
-			cfetch = "compass workspace exec bazel run src/go/compass.com/tools/circleci_results_cache/fetch/cmd/fetch:fetch";
 			cgh = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/compass\" gh";
 			cpip = "compass workspace run src/python3/uc/tools:run_pip_compile";
 			crun = "compass workspace run";
diff --git a/home/xonsh_footer.xsh b/home/xonsh_footer.xsh
index 8554b2d..019831e 100644
--- a/home/xonsh_footer.xsh
+++ b/home/xonsh_footer.xsh
@@ -1,5 +1,25 @@
 # vim: set ft=python :
 
+def bw_unlock():
+    """Unlocks the BitWarden CLI and adds the resulting session code to the
+    current environment variables. Also returns the code for them."""
+    if "BW_SESSION" in ${...}:
+        return $BW_SESSION
+    result = $(bw unlock)
+    while "BW_SESSION" not in result:
+        result = $(bw unlock)
+    lines = result.split("\n")
+    l = [k for k in lines if 'BW_SESSION="' in k][0]
+    left, right = l.split("=", 1)
+    token = right[1:-1]
+    $BW_SESSION = token
+    return token
+
+def _cfetch(args):
+    bw_unlock()
+    $CIRCLECI_CLI_TOKEN=$(bw get password CircleCI) 
+    compass workspace exec bazel run src/go/compass.com/tools/circleci_results_cache/fetch/cmd/fetch:fetch
+
 def _rebuild(args):
     system = uname()
     if system.sysname == 'Darwin':
@@ -48,6 +68,7 @@ def _bake(args):
         git clone src:greg/copier-templates.git ~/.copier-templates
     copier copy @(str(templates / args[0])) .
 
+aliases['cfetch'] = _cfetch
 aliases['bake'] = _bake
 aliases['rebuild'] = _rebuild
 aliases['yaml2json'] = _yaml2json