diff --git a/flake.nix b/flake.nix
index af994eb..26df3ff 100644
--- a/flake.nix
+++ b/flake.nix
@@ -59,6 +59,32 @@
           in
             nixpkgs.lib.mapAttrs (n: v: makeJob v) self.nixngSystems;
 
+        apps = forAllSystems (system:
+          let pkgs = pkgsForSystem system;
+          in
+            {
+              terraform = {
+                type = "app";
+                program = toString (pkgs.writeShellScript "terraform" ''
+                  export PATH="${pkgs.lib.makeBinPath (with pkgs; [ terraform bash coreutils jq nix git ])}"
+                  _flake_metadata="$(nix flake metadata git+file://$PWD?rev="$(git rev-parse HEAD)" --json)"
+                  export TF_VAR_flake_rev="$(echo "$_flake_metadata" | jq .locked.rev -r)"
+                  export TF_VAR_flake_sha="$(echo "$_flake_metadata" | jq .locked.narHash -r)"
+                  export TF_VAR_flake_ref="$(git name-rev --name-only HEAD)"
+                  case "$1" in
+                  "env")
+                  shift 1
+                  env
+                  ;;
+                  *)
+                  terraform "$@"
+                  ;;
+                  esac
+                '');
+              };
+            }
+        );
+
 
         devShell = forAllSystems (system:
           let pkgs = pkgsForSystem system;
diff --git a/terraform.tfvars b/terraform.tfvars
index cda2e0a..7d480f4 100644
--- a/terraform.tfvars
+++ b/terraform.tfvars
@@ -1,6 +1,3 @@
-flake_rev = "a27a4c4e78928564383e165b3868aa4f63c451df"
-flake_ref = "conduit-wip"
 flake_host = "git+https://git.sr.ht/~magic_rb/cluster"
 flake_host_alt = "git+https://git.sr.ht/~magic_rb/cluster"
-flake_sha = "sha256-7b/9W8mDnqQv0DfH6if0IVbMWR8iEvor7Ktth/WkX9M="