diff --git a/config/hosts/wind/data/secrets/secrets.nix b/config/hosts/wind/data/secrets/secrets.nix
index 063fd3a..b00061f 100644
Binary files a/config/hosts/wind/data/secrets/secrets.nix and b/config/hosts/wind/data/secrets/secrets.nix differ
diff --git a/config/sources/nix/sources.json b/config/sources/nix/sources.json
index a544f32..bef4006 100644
--- a/config/sources/nix/sources.json
+++ b/config/sources/nix/sources.json
@@ -29,10 +29,10 @@
         "homepage": "",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "22b6dc7dbd0fed58f41c117123494c6ed691fdb8",
-        "sha256": "1p88904pshasnivgw44m3vv14gwrq6cf25301spx3vpw89f48d2a",
+        "rev": "580d1ea22a647908f159fb6b138083dfe5c8c7b0",
+        "sha256": "1gsrpc7gg6844sncryx3rbaly0rfd2bkwrrzyvl03b7g29mwvdvb",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/22b6dc7dbd0fed58f41c117123494c6ed691fdb8.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/580d1ea22a647908f159fb6b138083dfe5c8c7b0.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "nixus": {
diff --git a/config/sources/nix/sources.nix b/config/sources/nix/sources.nix
index 1938409..9a01c8a 100644
--- a/config/sources/nix/sources.nix
+++ b/config/sources/nix/sources.nix
@@ -31,8 +31,28 @@ let
           if spec ? branch then "refs/heads/${spec.branch}" else
             if spec ? tag then "refs/tags/${spec.tag}" else
               abort "In git source '${name}': Please specify `ref`, `tag` or `branch`!";
+      submodules = if spec ? submodules then spec.submodules else false;
+      submoduleArg =
+        let
+          nixSupportsSubmodules = builtins.compareVersions builtins.nixVersion "2.4" >= 0;
+          emptyArgWithWarning =
+            if submodules == true
+            then
+              builtins.trace
+                (
+                  "The niv input \"${name}\" uses submodules "
+                  + "but your nix's (${builtins.nixVersion}) builtins.fetchGit "
+                  + "does not support them"
+                )
+                {}
+            else {};
+        in
+          if nixSupportsSubmodules
+          then { inherit submodules; }
+          else emptyArgWithWarning;
     in
-      builtins.fetchGit { url = spec.repo; inherit (spec) rev; inherit ref; };
+      builtins.fetchGit
+        ({ url = spec.repo; inherit (spec) rev; inherit ref; } // submoduleArg);
 
   fetch_local = spec: spec.path;