diff --git a/flake.nix b/flake.nix
index c200d0d..7275c42 100644
--- a/flake.nix
+++ b/flake.nix
@@ -59,10 +59,6 @@
       import pkgs {
         inherit system;
         config.allowUnfree = true;
-        config.permittedInsecurePackages = [
-          "dotnet-sdk-6.0.428"
-          "aspnetcore-runtime-6.0.36"
-        ];
         overlays = extraOverlays ++ (lib.attrValues self.overlays);
       };
     pkgs = mkPkgs nixpkgs [self.overlays.default nix-minecraft.overlay flux.overlays.default];
diff --git a/modules/system/services/media.nix b/modules/system/services/media.nix
index 434f533..9ec8e5e 100644
--- a/modules/system/services/media.nix
+++ b/modules/system/services/media.nix
@@ -34,6 +34,12 @@ in
       yt-dlp
     ];
 
+    # need to permit these outdated packages until servarr finally upgrades at some point...
+    permittedInsecurePackages = [
+      "dotnet-sdk-6.0.428"
+      "aspnetcore-runtime-6.0.36"
+    ];
+
     users = {
       users.${user} = {
         isSystemUser = true;