diff --git a/default.nix b/default.nix
index 6a49ee6e5..df4a7df68 100644
--- a/default.nix
+++ b/default.nix
@@ -6,6 +6,22 @@
   ...
 }:
 
+let
+  filteredSrc = lib.fileset.toSource {
+    root = ./.;
+    fileset = (
+      lib.fileset.intersection ./. (
+        lib.fileset.unions [
+          ./src
+          ./package.json
+          ./tsconfig.json
+          ./package-lock.json
+          ./assets
+        ]
+      )
+    );
+  };
+in
 pkgs.buildNpmPackage {
   pname = "spacebar-server-ts";
   nodejs = pkgs.nodejs_24;
@@ -20,8 +36,8 @@ pkgs.buildNpmPackage {
     maintainers = with maintainers; [ RorySys ]; # lol.
   };
 
-  src = ./.;
-  npmDeps = pkgs.importNpmLock { npmRoot = ./.; };
+  src = filteredSrc;
+  npmDeps = pkgs.importNpmLock { npmRoot = filteredSrc; };
   npmConfigHook = pkgs.importNpmLock.npmConfigHook;
 
   npmBuildScript = "build:src";
diff --git a/nix/modules/default/default.nix b/nix/modules/default/default.nix
index 4d3e425dc..6d13458d5 100644
--- a/nix/modules/default/default.nix
+++ b/nix/modules/default/default.nix
@@ -253,6 +253,8 @@ in
               StateDirectoryMode = "0750";
               RuntimeDirectory = "spacebar";
               RuntimeDirectoryMode = "0750";
+              ReadWritePaths = [ cfg.cdnPath ];
+              NoExecPaths = [ cfg.cdnPath ];
 
               Restart = "on-failure";
               RestartSec = 10;
@@ -267,10 +269,10 @@ in
     in
     {
       assertions = [
-#        {
-#          assertion = lib.all (map (key: !(key == "CONFIG_PATH" || key == "CONFIG_READONLY" || key == "PORT" || key == "STORAGE_LOCATION")) (lib.attrNames cfg.extraEnvironment));
-#          message = "You cannot set CONFIG_PATH, CONFIG_READONLY, PORT or STORAGE_LOCATION in extraEnvironment, these are managed by the NixOS module.";
-#        }
+        #        {
+        #          assertion = lib.all (map (key: !(key == "CONFIG_PATH" || key == "CONFIG_READONLY" || key == "PORT" || key == "STORAGE_LOCATION")) (lib.attrNames cfg.extraEnvironment));
+        #          message = "You cannot set CONFIG_PATH, CONFIG_READONLY, PORT or STORAGE_LOCATION in extraEnvironment, these are managed by the NixOS module.";
+        #        }
       ];
 
       users.users.spacebarchat = {