diff --git a/flake.lock b/flake.lock
index 411e16b..1ad0fd1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -214,11 +214,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1629636545,
-        "narHash": "sha256-I98lOZxgG2NId549fp/2TAEVQACKKJLEqXCxvOxFmlQ=",
+        "lastModified": 1630150828,
+        "narHash": "sha256-nwabQfj/8/YIoyY7+x0jZbQyvA/D3/OipoEQCT3JWLM=",
         "ref": "master",
-        "rev": "d408a21736f685dec0426edd0bf12fbbd229b778",
-        "revCount": 28,
+        "rev": "f28ea2244d33d0ed663e7864de55a77899e7f226",
+        "revCount": 31,
         "type": "git",
         "url": "https://git.sbruder.de/simon/nixpkgs-overlay"
       },
diff --git a/flake.nix b/flake.nix
index 2ea5864..e9b4885 100644
--- a/flake.nix
+++ b/flake.nix
@@ -50,6 +50,7 @@
     , krops
     , nix-pre-commit-hooks
     , nixpkgs
+    , nixpkgs-overlay
     , ...
     }@inputs: flake-utils.lib.eachDefaultSystem
       (system:
@@ -195,7 +196,8 @@
 
             aria2_exporter.nixosModules.aria2_exporter
             bang-evaluator.nixosModules.bang-evaluator
-          ]) ++ extraModules;
+          ]) ++ (builtins.attrValues nixpkgs-overlay.nixosModules)
+          ++ extraModules;
         })
         (import ./machines inputs);
     };
diff --git a/machines/fuuko/secrets.yaml b/machines/fuuko/secrets.yaml
index b9d50fe..81414a0 100644
--- a/machines/fuuko/secrets.yaml
+++ b/machines/fuuko/secrets.yaml
@@ -2,6 +2,7 @@ drone-rpc-environment: ENC[AES256_GCM,data:2Alck43ZrOFzhY7fKonIyboROD5qGuKkalTXl
 drone-server-environment: ENC[AES256_GCM,data:73uDSq+u3nGiKhLqdhdegTIvec9mF9jxVLJLtCjer5jUiFEZu5PkeYv0AWAyLWbB7s8b0V+4fxNQo/QsAfBWH0eP2TVOAy1TAo/sOso9PEVRaQCdilw39UJBdT8II3dy9YIfGFUXRUXCMU+1xfzUFjhU0s7sc+mYQ4jEj2ZX90UbUDcbgppNjC7KIHo8mQdrxFHeMq+wQpaoncwFMlwwzn8lFlG75+dMnkPGYa4xSqkwjHn2tewLM8f9dCiBQVoMVQCWo+1RieMq2cd3CYEkP7MPl+y3OA==,iv:kggBBXdN01LJ82azzxOZap1lfWglshCjkKqaU+oi+T4=,tag:Zg0Ay2aLGok4fgX3/y4ILA==,type:str]
 gitea-mail: ENC[AES256_GCM,data:ck4S9YJ1BLUb6+mOrRmg22KWI1xQwsdIw1dowNk1OOk=,iv:+aQiTSGzmBOLYbIVgwH/SIhslKgdJKoL1ZaGAXCeqHY=,tag:H3vCEGMktqAV/9BASVR5tg==,type:str]
 go-neb-overrides: ENC[AES256_GCM,data:Ws/2yCNNLLEpa9MbN7mZk6BBBaJxtHN2X9I41baWJylZeUld6/h4WCxyHw4MWzigK7k26E+7CGVGThF5Ucd6AuvuD9dd21uaoOtwsAKJVsCavk6VPQvfAuSqYJcBYY2pSwDpA6KbXbQqhC9OgcktvYQdnvNPbsSffK4zhrDjcFpDYYyBRQWxqHu/ZGh2088ECbhm2OCWeC9/5u/2id8dHutip6tUXBIalFmWObc6zgx4atCJGdq9/bOPgajQzrpWlauV0h3ioMwp0gsulOJl2LuI7Lvbsvm+UWe8hVd9ZLqR+4ZAwC5oCQht68AxekKrLNl02KQ8rM4fmWJpbK4NsR/m8+ifMZhqIe8tqUUhWGvJqbxEI/Rsbqm92ToIHL5x9hNSZ/crm+hF4c2Uh9jnSA3E/tOxjZaMU5hB+2Y4tF83nz61tzFnwhQ32VxFeq6IHyMOhgQzGZkDPAyFg2e4tbG6zp5oMx2lsUlgbaXrSrzBU73CjWiLDiJFNyGLx7ADeZ4aZVsZnvGL6y7K4p0uVuK7KSNzoW0=,iv:tniWSP8RgSDJ8ap+PK83TcPAvRdaXWC/gchF6+8uffs=,tag:SC6RB8zyVmjjbLA73cFb4A==,type:str]
+hcloud_exporter-environment: ENC[AES256_GCM,data:TPMeNK7uC716PC8UqDCnUKtriueIkg3l1ql9e3lse46Ko3TVvwW1oAQRSbwK8CG5AjuF2s2Y8GJdYcI8PN6Z5kERYF1RL2GDpN4pLSuw/l0YqsFkt0uK,iv:cmB+hZHvbk1p8uRmLDyYdPr6rTsFxKcoTcQVo729sAQ=,tag:nkiSvy7rsoInDN0l+1FOOQ==,type:str]
 nix-binary-cache-htpasswd: ENC[AES256_GCM,data:IktPHrrvExeZlCPmP82W9AovC59ILPbMQExVDO7U2S9lJ9cQKP14mQPuYwA+yKTycIdA01MwRDbt/SxhVleZ+aKkyOPwx/iG5B0cQX6cVqQWVTNVmxlW2sjupnnwwibcdikU21CIw6YsDKs7pMqRAfC/U2OJ3POo2qH5GgFY,iv:ofzEQ143HQQGZIEVkdWCrcENz0i6JPljLDGmG0A7aJ8=,tag:a557cdgRD25jWHhZeT+CnQ==,type:str]
 prometheus-htpasswd: ENC[AES256_GCM,data:eJOWrcTC3YISJJLuQV6sxzD0r8Gr8uoUt48D9sSEHhsbNUUy3pDgIPqJHrkG0ek2sIF6NvpWdDGK1kFcduRAL9h7nLxQLOtf7dxsdObGlPH5nwe6CwdR+1wTE/2WzrsmTGnUrMjMiBgLPV2yRiQg3VJ7W1Me8tHPYHrqYhM=,iv:WvgwIoIfxc3vyjF+znyUzOElv+sd/thoYpxWVaIavx0=,tag:9FnRw7ol++1PCbl1c2IyoA==,type:str]
 restic-password: ENC[AES256_GCM,data:IVFXmuzzvvqDS0T3P0R5ZMIn2wdkbE1AqwDMkWqMpDdCOVMP4/HhP4jF+tEarq22,iv:Eu6Wspzm0rPl0CuSoYTTLz+MmaEtmwCD57nH2JTBuaA=,tag:tKqt5Z7nF7lLcSsDKS4E3A==,type:str]
@@ -15,11 +16,12 @@ sops:
     gcp_kms: []
     azure_kv: []
     hc_vault: []
-    lastmodified: '2021-05-02T11:00:36Z'
-    mac: ENC[AES256_GCM,data:/6fzsH4xIoJtjUY68pfYBGNT8a22SwJ/JITqHMEdwqEMclZKbKLiU56RMREc88kqXz8Fj4sSTCc4lE4Q0o6IhWD3LXdh31PjrNatvxjobgXPsGP64j+g/7xlw1Q/o+MyNpnrK8+1oxswPNiLs2vivFY18PtIiCDZW+6tJ1SuLic=,iv:8J6743R+21xNlGohLyZ46f9a8VjCdLN3Ezm5t5uoRq8=,tag:YZ4hbYTRgYtgCB/myv5+tw==,type:str]
+    age: []
+    lastmodified: "2021-08-28T11:43:22Z"
+    mac: ENC[AES256_GCM,data:vMOdapzHflV6LtUQbSmP2y0wgPXFxKqC3XtVfThy7DvBcZNSa/TN/ZOGMdKXx4qX0na1lwd8JEQ97i4FOgyediCwshjJXVFLqcFP5roXlA+hgeWtWEsrWdnZlz9KoWsFX5Cm+QU3oV+0g8tAnznfXCwDPlBTnqPAnj8BtjQVSIc=,iv:8F07K351cJBpNA0BURSeVYeW7CuC9hpNeODNF8Qq2W4=,tag:BHx83f+hHghPEt7q5xzVyg==,type:str]
     pgp:
-    -   created_at: '2021-04-06T11:27:21Z'
-        enc: |
+        - created_at: "2021-04-06T11:27:21Z"
+          enc: |
             -----BEGIN PGP MESSAGE-----
 
             hQIMAwDgSONkM+d4AQ/+KSo1N4aEuIAF2JMX+3RborUdEMIJNqIQsBYejPF4o5UD
@@ -37,9 +39,9 @@ sops:
             m2npmJ9OCKyEN+zAd/WRIQ0wChFgadlTugsDcmXazdvzJ1qJiuNGmzpRn3QF
             =dltN
             -----END PGP MESSAGE-----
-        fp: 47E7559E037A35652DBBF8AA8D3C82F9F309F8EC
-    -   created_at: '2021-04-06T11:27:21Z'
-        enc: |
+          fp: 47E7559E037A35652DBBF8AA8D3C82F9F309F8EC
+        - created_at: "2021-04-06T11:27:21Z"
+          enc: |
             -----BEGIN PGP MESSAGE-----
 
             hQIMA2nIGHycQ3VOAQ//RC1NMySQoeqfTGEKFB7LwC3o0yLTMHAqoi4qm2Q8jKxH
@@ -57,6 +59,6 @@ sops:
             7kdIBtI8XA2CW/oXYcoxHlkqbPNqPAhaRu3YDci8oQ==
             =ukYv
             -----END PGP MESSAGE-----
-        fp: 2372651C56E22972C2D9F3F569C8187C9C43754E
+          fp: 2372651C56E22972C2D9F3F569C8187C9C43754E
     unencrypted_suffix: _unencrypted
-    version: 3.6.0
+    version: 3.7.1
diff --git a/machines/fuuko/services/prometheus.nix b/machines/fuuko/services/prometheus.nix
index 2445d7c..7e67f04 100644
--- a/machines/fuuko/services/prometheus.nix
+++ b/machines/fuuko/services/prometheus.nix
@@ -119,6 +119,10 @@ in
           replacement = "fuuko.home.sbruder.de";
         };
       }
+      {
+        job_name = "hcloud";
+        static_configs = mkStaticTarget config.services.hcloud_exporter.listenAddress;
+      }
     ];
 
     rules =
@@ -184,6 +188,14 @@ in
   # get rid of “could not call action: authorization required” every scrape
   systemd.services.prometheus-fritzbox-exporter.serviceConfig.StandardOutput = "null";
 
+  # exporters that are not part of nixpkgs’ prometheus infrastructure
+  services.hcloud_exporter = {
+    enable = true;
+    listenAddress = "127.0.0.1:9501";
+    environmentFile = config.sops.secrets.hcloud_exporter-environment.path;
+  };
+  sops.secrets.hcloud_exporter-environment.sopsFile = ../secrets.yaml;
+
   sops.secrets.prometheus-htpasswd = {
     owner = "nginx";
     sopsFile = ../secrets.yaml;