diff --git a/nixosModules/bcachefs.nix b/nixosModules/bcachefs.nix
index 24968b878..43dc7b43c 100644
--- a/nixosModules/bcachefs.nix
+++ b/nixosModules/bcachefs.nix
@@ -1,17 +1,16 @@
-{ lib, pkgs, ... }:
-
 {
-  # use latest kernel we can support to get more hardware support
-  boot.kernelPackages =
-    lib.mkForce
-      (pkgs.zfs.override { removeLinuxDRM = pkgs.hostPlatform.isAarch64; }).latestCompatibleLinuxPackages;
-  boot.zfs.removeLinuxDRM = lib.mkDefault pkgs.hostPlatform.isAarch64;
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+{
+  # If we also need zfs, we can use the unstable version as we otherwise don't have a new enough kernel version
+  boot.zfs.package = pkgs.zfsUnstable;
+  boot.kernelPackages = lib.mkIf config.boot.zfs.enabled (
+    lib.mkForce config.boot.zfs.package.latestCompatibleLinuxPackages
+  );
 
   # Enable bcachefs support
   boot.supportedFilesystems.bcachefs = lib.mkDefault true;
-
-  environment.systemPackages = with pkgs; [
-    bcachefs-tools
-    keyutils
-  ];
 }
diff --git a/nixosModules/flake-module.nix b/nixosModules/flake-module.nix
index 22797f8d4..32ff61eae 100644
--- a/nixosModules/flake-module.nix
+++ b/nixosModules/flake-module.nix
@@ -3,10 +3,12 @@
   flake.nixosModules = {
     hidden-ssh-announce.imports = [ ./hidden-ssh-announce.nix ];
     bcachefs.imports = [ ./bcachefs.nix ];
+    zfs.imports = [ ./zfs.nix ];
     installer.imports = [
       ./installer
       self.nixosModules.hidden-ssh-announce
       self.nixosModules.bcachefs
+      self.nixosModules.zfs
     ];
     clanCore.imports = [
       inputs.sops-nix.nixosModules.sops
diff --git a/nixosModules/zfs.nix b/nixosModules/zfs.nix
new file mode 100644
index 000000000..01b69613b
--- /dev/null
+++ b/nixosModules/zfs.nix
@@ -0,0 +1,16 @@
+{ lib, config, ... }:
+{
+  # Use the same default hostID as the NixOS install ISO and nixos-anywhere.
+  # This allows us to import zfs pool without using a force import.
+  # ZFS has this as a safety mechanism for networked block storage (ISCSI), but
+  # in practice we found it causes more breakages like unbootable machines,
+  # while people using ZFS on ISCSI is quite rare.
+  networking.hostId = lib.mkDefault "8425e349";
+
+  services.zfs = lib.mkIf (config.boot.zfs.enabled) {
+    autoSnapshot.enable = true;
+    # defaults to 12, which is a bit much given how much data is written
+    autoSnapshot.monthly = lib.mkDefault 1;
+    autoScrub.enable = true;
+  };
+}