diff --git a/deployments/argo.nixops b/deployments/argo.nixops
index b56f471106f1085ac2d5ab0b13364c6476a55936..f329596d779316f56fc51e541f59dccc7bdd21df 100644
Binary files a/deployments/argo.nixops and b/deployments/argo.nixops differ
diff --git a/deployments/ci.nix b/deployments/ci.nix
index 34cb61a5c025a7d8e6e4a856014f9bc2e42816b7..4d92cb47407a91be99e7e6a7e23717b5330d756f 100644
--- a/deployments/ci.nix
+++ b/deployments/ci.nix
@@ -67,8 +67,8 @@ let
       options = ''--max-freed "$((32 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
     };
    services.openssh.enable = true;
-   users.extraUsers.root.openssh.authorizedKeys.keys = [ (pkgs.lib.readFile ./keys/id_buildfarm.pub)];
-   users.extraUsers.fre.openssh.authorizedKeys.keys = [ (pkgs.lib.readFile ./keys/id_buildfarm.pub)];
+   users.extraUsers.root.openssh.authorizedKeys.keys = [ (pkgs.lib.readFile ./keys/id_buildfarm.pub)] ++ keys;
+   users.extraUsers.fre.openssh.authorizedKeys.keys = [ (pkgs.lib.readFile ./keys/id_buildfarm.pub)] ++ keys ;
    };
    mkBigChameleonRunner = ip: name: a@{...}:
     ((mkChameleonRunner ip name a)//
@@ -184,7 +184,7 @@ in
         options = ''--max-freed "$((32 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
       };
      services.openssh.enable = true;
-     users.extraUsers.root.openssh.authorizedKeys.keys = [ (pkgs.lib.readFile ./keys/id_buildfarm.pub)];
-     users.extraUsers.fre.openssh.authorizedKeys.keys = [ (pkgs.lib.readFile ./keys/id_buildfarm.pub)];
+     users.extraUsers.root.openssh.authorizedKeys.keys = [ (pkgs.lib.readFile ./keys/id_buildfarm.pub)] ++ keys;
+     users.extraUsers.fre.openssh.authorizedKeys.keys = [ (pkgs.lib.readFile ./keys/id_buildfarm.pub)] ++ keys;
      };
    }
diff --git a/deployments/deploy-runners.sh b/deployments/deploy-runners.sh
new file mode 100755
index 0000000000000000000000000000000000000000..f088560d709db7cacd25de6456eb9526725934a4
--- /dev/null
+++ b/deployments/deploy-runners.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+nixops deploy -s argo.nixops --include gitlab-runner-0 gitlab-runner-1 gitlab-runner-2 gitlab-runner-3 gitlab-runner-4
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 8aa1557b9107ed621c5cc387d1b97e297ab44633..d3e554e0581c00ae5adf116fc3b992db2c3a791c 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -48,6 +48,7 @@ let
     (old:{buildInputs=old.buildInputs ++ [ bi ];});
 
   argopkgs = rec {
+    singularity = bleeding.singularity;
 
     # library of nix expressions
     argolib       = import ../lib/utils.nix;
@@ -68,6 +69,13 @@ let
         cp -r examples $out/share
       '';
     });
+    nrm-virtualenv = nrm.overrideAttrs (o:{
+      buildInputs=o.buildInputs ++ [ pkgs.blas pkgs.liblapack pkgs.binutils-unwrapped];
+      buildPhase=''
+        virtualenv .
+        bin/pip install -r requirements.txt
+        '';
+    });
     containers    = callPackage ./containers {src=containers-src;};
     libnrm        = callPackage ./libnrm     {src=libnrm-src;};
     libnrm-pinned = callPackage ./libnrm     {src=fetched libnrm/pin.json;};
@@ -209,7 +217,7 @@ let
 
     # re-export from hpkgs and add non-haskell build rule specialization
     inherit (haskellPackages) repoquality;
-    inherit (bleedingHaskellPackages) dhall dhall-json;
+    inherit (bleedingHaskellPackages) dhall dhall-lsp-server dhall-json;
 
     nrm-schema = haskellPackages.nrm-schema.overrideAttrs (old:{
       buildInputs = old.buildInputs ++ [