diff --git a/pkgs/clan-cli/clan_cli/vars/_types.py b/pkgs/clan-cli/clan_cli/vars/_types.py
index b058afe6c..6f0c82a21 100644
--- a/pkgs/clan-cli/clan_cli/vars/_types.py
+++ b/pkgs/clan-cli/clan_cli/vars/_types.py
@@ -172,7 +172,7 @@ class StoreBase(ABC):
             -> this provides backward and forward compatibility
         """
         stored_hash = self.get_validation(generator)
-        target_hash = generator.validation
+        target_hash = generator.validation()
         # if the hash is neither set in nix nor on disk, it is considered valid (provides backwards compat)
         if target_hash is None and stored_hash is None:
             return True
diff --git a/pkgs/clan-cli/clan_cli/vars/generate.py b/pkgs/clan-cli/clan_cli/vars/generate.py
index c2fc311b1..2bacb2d34 100644
--- a/pkgs/clan-cli/clan_cli/vars/generate.py
+++ b/pkgs/clan-cli/clan_cli/vars/generate.py
@@ -66,7 +66,6 @@ class Generator:
             prompts=[Prompt.from_json(p) for p in data["prompts"].values()],
         )
 
-    @property
     def final_script(self) -> Path:
         assert self._machine is not None
         final_script = self._machine.build_nix(
@@ -74,7 +73,6 @@ class Generator:
         )
         return final_script
 
-    @property
     def validation(self) -> str | None:
         assert self._machine is not None
         return self._machine.eval_nix(
@@ -208,10 +206,12 @@ def execute_generator(
                 prompt_file.write_text(value)
         from clan_cli import bwrap
 
+        final_script = generator.final_script()
+
         if sys.platform == "linux" and bwrap.bubblewrap_works():
-            cmd = bubblewrap_cmd(str(generator.final_script), tmpdir)
+            cmd = bubblewrap_cmd(str(final_script), tmpdir)
         else:
-            cmd = ["bash", "-c", str(generator.final_script)]
+            cmd = ["bash", "-c", str(final_script)]
         run(cmd, RunOpts(env=env))
         files_to_commit = []
         # store secrets
@@ -222,7 +222,7 @@ def execute_generator(
             secret_file = tmpdir_out / file.name
             if not secret_file.is_file():
                 msg = f"did not generate a file for '{file.name}' when running the following command:\n"
-                msg += str(generator.final_script)
+                msg += str(final_script)
                 raise ClanError(msg)
             if file.secret:
                 file_path = secret_vars_store.set(
@@ -240,18 +240,15 @@ def execute_generator(
                 public_changed = True
             if file_path:
                 files_to_commit.append(file_path)
-            if generator.validation is not None:
+            validation = generator.validation()
+            if validation is not None:
                 if public_changed:
                     files_to_commit.append(
-                        public_vars_store.set_validation(
-                            generator, generator.validation
-                        )
+                        public_vars_store.set_validation(generator, validation)
                     )
                 if secret_changed:
                     files_to_commit.append(
-                        secret_vars_store.set_validation(
-                            generator, generator.validation
-                        )
+                        secret_vars_store.set_validation(generator, validation)
                     )
     commit_files(
         files_to_commit,
diff --git a/pkgs/clan-vm-manager/default.nix b/pkgs/clan-vm-manager/default.nix
index 85f292747..9c0822ad1 100644
--- a/pkgs/clan-vm-manager/default.nix
+++ b/pkgs/clan-vm-manager/default.nix
@@ -14,11 +14,12 @@
   pytest-subprocess, # fake the real subprocess behavior to make your tests more independent.
   pytest-timeout, # Add timeouts to your tests
   pytest-xdist, # Run tests in parallel on multiple cores
-  python3,
+  buildPythonApplication,
   runCommand,
   setuptools,
   webkitgtk_6_0,
   wrapGAppsHook,
+  python,
   lib,
   stdenv,
 }:
@@ -48,7 +49,7 @@ let
     ];
 
   # Deps including python packages from the local project
-  allPythonDeps = [ (python3.pkgs.toPythonModule clan-cli) ] ++ externalPythonDeps;
+  allPythonDeps = [ (python.pkgs.toPythonModule clan-cli) ] ++ externalPythonDeps;
 
   # Runtime binary dependencies required by the application
   runtimeDependencies = [
@@ -71,9 +72,9 @@ let
   testDependencies = runtimeDependencies ++ allPythonDeps ++ externalTestDeps;
 
   # Setup Python environment with all dependencies for running tests
-  pythonWithTestDeps = python3.withPackages (_ps: testDependencies);
+  pythonWithTestDeps = python.withPackages (_ps: testDependencies);
 in
-python3.pkgs.buildPythonApplication rec {
+buildPythonApplication rec {
   name = "clan-vm-manager";
   src = source;
   format = "pyproject";