diff --git a/modules/bitcoind.nix b/modules/bitcoind.nix
index edc1db8..409d264 100644
--- a/modules/bitcoind.nix
+++ b/modules/bitcoind.nix
@@ -256,7 +256,7 @@ in {
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
+    environment.systemPackages = [ cfg.package (hiPrio cfg.cli) ];
     systemd.services.bitcoind = {
       description = "Bitcoin daemon";
       requires = [ "nix-bitcoin-secrets.target" ];
diff --git a/modules/clightning.nix b/modules/clightning.nix
index 9a561c3..607f9e7 100644
--- a/modules/clightning.nix
+++ b/modules/clightning.nix
@@ -71,6 +71,7 @@ in {
   };
 
   config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.nix-bitcoin.clightning (hiPrio cfg.cli) ];
     users.users.clightning = {
         description = "clightning User";
         group = "clightning";
diff --git a/modules/electrs.nix b/modules/electrs.nix
index 1d538f3..3d30187 100644
--- a/modules/electrs.nix
+++ b/modules/electrs.nix
@@ -61,6 +61,8 @@ in {
   };
 
   config = mkIf cfg.enable (mkMerge [{
+    environment.systemPackages = [ pkgs.nix-bitcoin.electrs ];
+
     systemd.services.electrs = {
       description = "Electrs Electrum Server";
       wantedBy = [ "multi-user.target" ];
diff --git a/modules/hardware-wallets.nix b/modules/hardware-wallets.nix
index 33d3a3c..8337e5c 100644
--- a/modules/hardware-wallets.nix
+++ b/modules/hardware-wallets.nix
@@ -32,11 +32,16 @@ in {
   };
 
   config = mkMerge [
-    {
-      # Create group
+    (mkIf (cfg.ledger || cfg.trezor) {
+      environment.systemPackages = with pkgs; [
+        nix-bitcoin.hwi
+        # Provides lsusb for debugging
+        usbutils
+      ];
       users.groups."${cfg.group}" = {};
-    }
+    })
     (mkIf cfg.ledger {
+
       # Ledger Nano S according to https://github.com/LedgerHQ/udev-rules/blob/master/add_udev_rules.sh
       # Don't use rules from nixpkgs because we want to use our own group.
       services.udev.packages = lib.singleton (pkgs.writeTextFile {
@@ -48,6 +53,7 @@ in {
       });
     })
     (mkIf cfg.trezor {
+      environment.systemPackages = [ pkgs.python3.pkgs.trezor ];
       # Don't use rules from nixpkgs because we want to use our own group.
       services.udev.packages = lib.singleton (pkgs.writeTextFile {
         name = "trezord-udev-rules";
diff --git a/modules/lightning-charge.nix b/modules/lightning-charge.nix
index 0d0061a..9566402 100644
--- a/modules/lightning-charge.nix
+++ b/modules/lightning-charge.nix
@@ -24,6 +24,7 @@ in {
   };
 
   config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.nix-bitcoin.lightning-charge ];
     systemd.services.lightning-charge = {
       description = "Run lightning-charge";
       wantedBy = [ "multi-user.target" ];
diff --git a/modules/liquid.nix b/modules/liquid.nix
index 3dce19a..5716230 100644
--- a/modules/liquid.nix
+++ b/modules/liquid.nix
@@ -195,7 +195,11 @@ in {
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.nix-bitcoin.elementsd ];
+    environment.systemPackages = [
+      pkgs.nix-bitcoin.elementsd
+      (hiPrio cfg.cli)
+      (hiPrio cfg.swap-cli)
+    ];
     systemd.services.liquidd = {
       description = "Elements daemon providing access to the Liquid sidechain";
       requires = [ "bitcoind.service" ];
diff --git a/modules/lnd.nix b/modules/lnd.nix
index 7cead2e..878a4ec 100644
--- a/modules/lnd.nix
+++ b/modules/lnd.nix
@@ -77,7 +77,7 @@ in {
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
+    environment.systemPackages = [ cfg.package (hiPrio cfg.cli) ];
     systemd.services.lnd = {
       description = "Run LND";
       path  = [ pkgs.nix-bitcoin.bitcoind ];
diff --git a/modules/nanopos.nix b/modules/nanopos.nix
index b34cf6d..2fa5894 100644
--- a/modules/nanopos.nix
+++ b/modules/nanopos.nix
@@ -52,6 +52,7 @@ in {
   };
 
   config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.nix-bitcoin.nanopos ];
     systemd.services.nanopos = {
       description = "Run nanopos";
       wantedBy = [ "multi-user.target" ];
@@ -60,7 +61,6 @@ in {
       serviceConfig = {
         EnvironmentFile = "${config.nix-bitcoin.secretsDir}/nanopos-env";
         ExecStart = "${pkgs.nix-bitcoin.nanopos}/bin/nanopos -y ${cfg.itemsFile} -p ${toString cfg.port} --show-bolt11";
-
         User = "nanopos";
         Restart = "on-failure";
         RestartSec = "10s";
diff --git a/modules/presets/secure-node.nix b/modules/presets/secure-node.nix
index a9ad064..aff5114 100644
--- a/modules/presets/secure-node.nix
+++ b/modules/presets/secure-node.nix
@@ -108,30 +108,11 @@ in {
     services.nix-bitcoin-webindex.enforceTor = true;
 
 
-    environment.systemPackages = with pkgs; with nix-bitcoin;
-    [
+    environment.systemPackages = with pkgs; [
       tor
-      bitcoind
-      (hiPrio cfg.bitcoind.cli)
-      nodeinfo
       jq
       qrencode
-    ]
-    ++ optionals cfg.clightning.enable [clightning (hiPrio cfg.clightning.cli)]
-    ++ optionals cfg.lnd.enable [lnd (hiPrio cfg.lnd.cli)]
-    ++ optionals cfg.lightning-charge.enable [lightning-charge]
-    ++ optionals cfg.nanopos.enable [nanopos]
-    ++ optionals cfg.nix-bitcoin-webindex.enable [nginx]
-    ++ optionals cfg.liquidd.enable [elementsd (hiPrio cfg.liquidd.cli) (hiPrio cfg.liquidd.swap-cli)]
-    ++ optionals cfg.spark-wallet.enable [spark-wallet]
-    ++ optionals cfg.electrs.enable [electrs]
-    ++ optionals (cfg.hardware-wallets.ledger || cfg.hardware-wallets.trezor) [
-        hwi
-        # To allow debugging issues with lsusb
-        usbutils
-    ]
-    ++ optionals cfg.hardware-wallets.trezor [
-        python3.pkgs.trezor
+      nix-bitcoin.nodeinfo
     ];
 
     # Create user operator which can use bitcoin-cli and lightning-cli
diff --git a/modules/spark-wallet.nix b/modules/spark-wallet.nix
index c1565ea..13a5cca 100644
--- a/modules/spark-wallet.nix
+++ b/modules/spark-wallet.nix
@@ -47,6 +47,7 @@ in {
   };
 
   config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.nix-bitcoin.spark-wallet ];
     services.tor.enable = cfg.onion-service;
     # requires client functionality for Bitcoin rate lookup
     services.tor.client.enable = true;