diff --git a/flake.lock b/flake.lock
index 3af93e7..cab798d 100644
Binary files a/flake.lock and b/flake.lock differ
diff --git a/lib/nixos.nix b/lib/nixos.nix
index 11bb823..c1853ba 100644
--- a/lib/nixos.nix
+++ b/lib/nixos.nix
@@ -227,7 +227,7 @@ in rec {
                 PS1=''${PS1/\\$/\\[\\e[93m\\](${name})\\[\\e[97m\\]\\$}
 
                 source "'"$self"'" ; PATH=$hostPath
-            ') -i -s ':' "$@"
+            ') -i -s ':' "$@" # execute : (noop) as command, preserve argv
         fi
 
         # provide installer tools (not necessarily for system.pkgs.config.hostPlatform)
diff --git a/lib/setup-scripts/install.sh b/lib/setup-scripts/install.sh
index a9f7e36..38b4521 100644
--- a/lib/setup-scripts/install.sh
+++ b/lib/setup-scripts/install.sh
@@ -200,7 +200,7 @@ function install-system-to {( set -u # 1: mnt, 2?: topLevel
         else
             ( set +x ; echo "Installation done! This shell is in a chroot in the mounted system for inspection. Exiting the shell will unmount the system." 1>&2 )
         fi
-        LC_ALL=C PATH=$PATH:@{native.util-linux}/bin @{native.nixos-install-tools}/bin/nixos-enter --root $mnt -- /nix/var/nix/profiles/system/sw/bin/bash -c 'source /etc/set-environment ; CHROOT_DIR="'"$mnt"'" mnt=/ exec "'"$self"'" bash' || exit # +o monitor
+        LC_ALL=C PATH=$PATH:@{native.util-linux}/bin @{native.nixos-install-tools}/bin/nixos-enter --root $mnt -- /nix/var/nix/profiles/system/sw/bin/bash -c 'source /etc/set-environment ; NIXOS_INSTALL_BOOTLOADER=1 CHROOT_DIR="'"$mnt"'" mnt=/ exec "'"$self"'" bash' || exit # +o monitor
     fi
 
     mkdir -p $mnt/var/lib/systemd/timesync && touch $mnt/var/lib/systemd/timesync/clock || true # save current time
diff --git a/lib/setup-scripts/maintenance.sh b/lib/setup-scripts/maintenance.sh
index 28ef5ff..6b17e9a 100644
--- a/lib/setup-scripts/maintenance.sh
+++ b/lib/setup-scripts/maintenance.sh
@@ -58,9 +58,17 @@ declare-flag run-qemu efi-vars      "path" "For »--efi« systems, path to a fil
 declare-flag run-qemu graphic           "" "Open a graphical window even of the target system logs to serial and not (explicitly) TTY1."
 declare-flag run-qemu install "[1|always]" "If any of the guest system's disk images does not exist, perform the its installation before starting the VM. If set to »always«, always install before starting the VM. With this flag set, »diskImages« defaults to paths in »/tmp/."
 declare-flag run-qemu mem            "num" "VM RAM in MiB (»qemu -m«)."
-declare-flag run-qemu nat-fw    "forwards" "Port forwards to the guest's NATed NIC. E.g: »--nat-fw=:8000-:8000,:8001-:8001,127.0.0.1:2022-:22«."
 declare-flag run-qemu no-kvm            "" "Do not rey to use (or complain about the unavailability of) KVM."
+declare-flag run-qemu nat-fw    "forwards" "Port forwards to the guest's NATed NIC. E.g: »--nat-fw=:8000-:8000,:8001-:8001,127.0.0.1:2022-:22«."
 declare-flag run-qemu no-nat            "" "Do not provide a NATed NIC to the guest."
+declare-flag run-qemu nic "type[,options]" "Create an additional network interface using the »-nic« flag. Automatically sets a decent »model« and a »mac« derived from »config.networking.hostId«.
+Example 1 (connect two VMs, unprivileged):
+$ ... --nic=socket,listen=:4321 # once
+$ ... --nic=socket,connect=:4321 # once
+Example 2 (connect many VMs, unprivileged):
+$ nix shell nixpkgs#vde2 --command vde_switch -sock /tmp/vm-net
+$ ... --nic=vde,sock=/tmp/vm-net # multiple times
+"
 declare-flag run-qemu no-serial         "" "Do not connect the calling terminal to a serial adapter the guest can log to and open a terminal on the guests serial, as would be the default if the guests logs to ttyS0."
 declare-flag run-qemu share        "decls" "Host dirs to make available as network shares for the guest, as space separated list of »name:host-path,options. E.g. »--share='foo:/home/user/foo,readonly=on bar:/tmp/bar«. In the VM hte share can be mounted with: »$ mount -t 9p -o trans=virtio -o version=9p2000.L -o msize=4194304 -o ro foo /foo«."
 declare-flag run-qemu smp            "num" "Number of guest CPU cores."
@@ -94,7 +102,7 @@ function run-qemu {
     qemu+=( -m ${args[mem]:-2048} )
     if [[ ${args[smp]:-} ]] ; then qemu+=( -smp ${args[smp]} ) ; fi
 
-    if [[ @{config.boot.loader.systemd-boot.enable} || ${args[efi]:-} ]] ; then # UEFI. Otherwise it boots SeaBIOS.
+    if [[ @{config.virtualisation.useEFIBoot:-} || @{config.boot.loader.systemd-boot.enable} || ${args[efi]:-} ]] ; then # UEFI. Otherwise it boots SeaBIOS.
         local ovmf ; ovmf=$( build-lazy @{pkgs.OVMF.drvPath!unsafeDiscardStringContext} fd ) || return
         #qemu+=( -bios ${ovmf}/FV/OVMF.fd ) # This works, but is a legacy fallback that stores the EFI vars in /NvVars on the EFI partition (which is really bad).
         local fwName=OVMF ; if [[ @{pkgs.system} == aarch64-* ]] ; then fwName=AAVMF ; fi # fwName=QEMU
@@ -144,12 +152,12 @@ function run-qemu {
     fi
 
     if [[ ! ${args[no-nat]:-} ]] ; then # e.g. --nat-fw=:8000-:8000,:8001-:8001,127.0.0.1:2022-:22
-        qemu+=( -nic user,model=virtio-net-pci${args[nat-fw]:+,hostfwd=tcp:${args[nat-fw]//,/,hostfwd=tcp:}} ) # NATed, IPs: 10.0.2.15+/32, gateway: 10.0.2.2
+        qemu+=( -nic user,model=virtio-net-pci${args[nat-fw]:+,hostfwd=tcp:${args[nat-fw]//,/,hostfwd=tcp:}} ) # NATed, IPs: 10.0.2.15+/24, gateway/host: 10.0.2.2, DNS: 10.0.2.3
+    fi
+    if [[ ${args[nic]:-} ]] ; then
+        [[ @{config.networking.hostId} =~ ^(.)(.)(.)(.)(.)(.)(.)(.)$ ]] && mac=$( printf "52:54:%s%s:%s%s:%s%s:%s%s" "${BASH_REMATCH[@]:1}" ) || { echo 'Invalid hostId' &>2 ; return; }
+        qemu+=( -nic model=virtio-net-pci,mac=$mac,type="${args[nic]}" )
     fi
-
-    # TODO: network bridging:
-    #[[ @{config.networking.hostId} =~ ^(.)(.)(.)(.)(.)(.)(.)(.)$ ]] && mac=$( printf "52:54:%s%s:%s%s:%s%s:%s%s" "${BASH_REMATCH[@]:1}" ) || { echo 'Invalid hostId' &>2 ; return; }
-    #qemu+=( -netdev bridge,id=enp0s3,macaddr=$mac -device virtio-net-pci,netdev=hn0,id=nic1 )
 
     # To pass a USB device (e.g. a YubiKey for unlocking), add pass »--usb-port=${bus}-${port}«, where bus and port refer to the physical USB port »/sys/bus/usb/devices/${bus}-${port}« (see »lsusb -tvv«). E.g.: »--usb-port=3-1.1.1.4«
     if [[ ${args[usb-port]:-} ]] ; then local decl ; for decl in ${args[usb-port]//:/ } ; do
diff --git a/modules/installer.nix.md b/modules/installer.nix.md
index 7361ae8..91a4a9d 100644
--- a/modules/installer.nix.md
+++ b/modules/installer.nix.md
@@ -31,16 +31,16 @@ in {
             }; })));
             apply = lib.filterAttrs (k: v: v != null);
         };
-        commands = let desc = when: mounted: ''
+        commands = let cmdOpt = when: mounted: lib.mkOption { description = ''
             Bash commands that are executed during the system installation, ${when}.
             Note that these commands are executed without any further sandboxing (i.e. when not using the VM installation mode, as root on the host).
             Partitions may be used via `/dev/disk/by-partlabel/`.${lib.optionalString mounted '' The target system is mounted at `$mnt`.''}
-        ''; in {
-            postPartition = lib.mkOption { description = desc "after partitioning the disks" false; type = lib.types.lines; default = ""; };
-            postFormat = lib.mkOption { description = desc "after formatting the partitions with filesystems" false; type = lib.types.lines; default = ""; };
-            postMount = lib.mkOption { description = desc "after mounting all filesystems" true; type = lib.types.lines; default = ""; };
-            preInstall = lib.mkOption { description = desc "before installing the bootloader" true; type = lib.types.lines; default = ""; };
-            postInstall = lib.mkOption { description = desc "just before unmounting the new system" true; type = lib.types.lines; default = ""; };
+        ''; type = lib.types.lines; default = ""; }; in {
+            postPartition = cmdOpt "after partitioning the disks" false;
+            postFormat = cmdOpt "after formatting the partitions with filesystems" false;
+            postMount = cmdOpt "after mounting all filesystems" true;
+            preInstall = cmdOpt "before installing the bootloader" true;
+            postInstall = cmdOpt "just before unmounting the new system" true;
         };
         outputName = lib.mkOption {
             description = ''The name this system is (/ should be) exported as by its defining flake (as »nixosConfigurations.''${outputName}« and »apps.*-linux.''${outputName}«).'';