To keep the nixos/infra macs in sync with the repo it would be great to have a module like system.autoUpgrade, that can update regularly rebuild nix-darwin against config originating from a flake ref.