diff --git a/flake.nix b/flake.nix
index 652da6c..beefbc2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -96,7 +96,8 @@
     flake-utils.lib.eachDefaultSystem (
       system: let
         inherit (self) outputs;
-        pkgs = nixpkgs.legacyPackages.${system};
+
+        pkgs = import nixpkgs {inherit system;};
       in {
         formatter = pkgs.alejandra;
         devShells.default = pkgs.mkShell {
@@ -111,7 +112,7 @@
         packages = {
           homeConfigurations = let
             extraSpecialArgs = {inherit inputs outputs system;};
-            pkgs = nixpkgs.legacyPackages.x86_64-linux;
+            pkgs = import nixpkgs {inherit system;};
             defaultUserModules = [
               inputs.sops-nix.homeManagerModules.sops
               inputs.spicetify.homeManagerModules.default
diff --git a/hosts/naromk3/default.nix b/hosts/naromk3/default.nix
index 101f0a6..609fade 100644
--- a/hosts/naromk3/default.nix
+++ b/hosts/naromk3/default.nix
@@ -23,9 +23,9 @@
       id = "0003beef";
       firewall = {
         openPorts = [
-          22  # Gitea SSH
-          25  # SMTP
-          80  # HTTP
+          22 # Gitea SSH
+          25 # SMTP
+          80 # HTTP
           443 # HTTPS
           465 # SMTPS
           993 # IMAPS
diff --git a/packages/bun-baseline.nix b/packages/bun-baseline.nix
new file mode 100644
index 0000000..30f9ed9
--- /dev/null
+++ b/packages/bun-baseline.nix
@@ -0,0 +1,70 @@
+# Baseline variant of Bun for x86_64-linux CPUs without AVX2 support.
+# The regular `bun` from nixpkgs requires AVX2 and crashes with SIGILL on older hardware.
+#
+# Version is typically kept in sync with nixpkgs's `bun` (passed via `callPackage`).
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  autoPatchelfHook,
+  unzip,
+  makeBinaryWrapper,
+  glibc,
+  stdenv,
+  version ? "1.3.13",
+}: let
+  # When updating `version`, compute the new hash with:
+  #   nix store prefetch-file  "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64-baseline.zip"
+  hash = {
+    "1.3.13" = "sha256-nYokKSpwaAkCBdqsCloiP19pc29Sh+N7+I07QDHtx1A=";
+  };
+in
+  stdenvNoCC.mkDerivation {
+    pname = "bun-baseline";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64-baseline.zip";
+      hash = hash.${version};
+    };
+
+    nativeBuildInputs =
+      [unzip]
+      ++ lib.optionals stdenvNoCC.hostPlatform.isLinux [
+        autoPatchelfHook
+        makeBinaryWrapper
+      ];
+
+    buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+      glibc
+      (lib.getLib stdenv.cc.cc)
+    ];
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    unpackPhase = ''
+      runHook preUnpack
+      mkdir -p source
+      cd source
+      ${lib.getExe unzip} -q $src
+      runHook postUnpack
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/bin
+      find . -type f -name "bun" -not -path "./__MACOSX/*" -exec cp {} $out/bin/bun \;
+      chmod +x $out/bin/bun
+      ln -s $out/bin/bun $out/bin/bunx
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "Bun JavaScript runtime (baseline variant, works without AVX2)";
+      homepage = "https://bun.sh";
+      license = lib.licenses.mit;
+      platforms = ["x86_64-linux"];
+      mainProgram = "bun";
+    };
+  }
diff --git a/users/modules/dev/ai/opencode.nix b/users/modules/dev/ai/opencode.nix
index 61ecdf0..12c3433 100644
--- a/users/modules/dev/ai/opencode.nix
+++ b/users/modules/dev/ai/opencode.nix
@@ -1,15 +1,30 @@
 {
   config,
   lib,
-  inputs,
   pkgs,
   ...
 }:
 with lib; let
-  inherit (pkgs.stdenv.hostPlatform) system;
   cfg = config.home.dev.ai.opencode;
-  defaultPackageCli = inputs.opencode.packages.${system}.opencode;
-  defaultPackageDesktop = inputs.opencode.packages.${system}.desktop;
+
+  # On x86_64-linux CPUs without AVX2, use the baseline bun variant
+  # when building opencode - the regular `bun` from nixpkgs requires
+  # AVX2 and crashes on older hardware, such as my Thinkpad x220’s
+  # Intel Core i5 2640M.
+  needsBaselineBun =
+    pkgs.stdenv.hostPlatform.isx86_64 && !pkgs.stdenv.hostPlatform.avx2Support;
+  bunBaseline = pkgs.callPackage ../../../../packages/bun-baseline.nix {};
+
+  defaultPackageCli =
+    if needsBaselineBun
+    then pkgs.opencode.override {bun = bunBaseline;}
+    else pkgs.opencode;
+
+  defaultPackageDesktop =
+    if needsBaselineBun
+    then pkgs.opencode-desktop.override {bun = bunBaseline;}
+    else pkgs.opencode-desktop;
+
   corsList = domains: lists.remove "" (lists.forEach (strings.splitString "," domains) trim);
 in {
   options.home.dev.ai.opencode = {
@@ -66,9 +81,9 @@ in {
     };
   };
   config.programs.opencode = mkIf cfg.enable {
-    inherit (cfg) enable tui;
+    inherit (cfg) enable tui package;
     enableMcpIntegration = true;
-    extraPackages = with pkgs; [uv];
+    extraPackages = with pkgs; [uv] ++ lists.optional cfg.desktop.enable cfg.desktop.package;
     settings =
       {
         server = mkIf cfg.web.mdns.enable {
diff --git a/users/phundrak/ai.nix b/users/phundrak/ai.nix
index 4d07462..f8e05de 100644
--- a/users/phundrak/ai.nix
+++ b/users/phundrak/ai.nix
@@ -1,6 +1,6 @@
 {config, ...}: {
   home.dev.ai = {
-    enable =  true;
+    enable = true;
     opencode = {
       tui = {
         mouse = true;