diff --git a/config/hosts/zbox.nix b/config/hosts/zbox.nix
index d4f8240..a90ce5b 100644
--- a/config/hosts/zbox.nix
+++ b/config/hosts/zbox.nix
@@ -1,6 +1,8 @@
 { config, lib, pkgs, ... }:
 
 {
+  system.stateVersion = "20.09";
+  
   # TODO: remove?
   nixpkgs.config.permittedInsecurePackages = [
     "openssh-with-gssapi-8.4p1" # CVE-2021-28041
diff --git a/config/profiles/common-ui.nix b/config/profiles/common-ui.nix
index 4210b28..ac39060 100644
--- a/config/profiles/common-ui.nix
+++ b/config/profiles/common-ui.nix
@@ -14,6 +14,11 @@ in {
 
   system.autoUpgrade.enable = true;
 
+  environment.systemPackages = with pkgs; [
+    firefox
+    spotify
+  ];
+
   services = {
     xserver = mkIf enable-gui {
     enable = true;
diff --git a/home-manager/niten.nix b/home-manager/niten.nix
index 0b218bf..d818577 100644
--- a/home-manager/niten.nix
+++ b/home-manager/niten.nix
@@ -17,6 +17,7 @@ let
     doomEmacsInit
     enca
     file
+    firefox
     fortune
     gnupg
     guile
@@ -44,6 +45,7 @@ let
     rustc
     sbcl
     signal-desktop
+    spotify
     stdenv
     telnet
     texlive.combined.scheme-basic