diff --git a/machines/nunotaba/configuration.nix b/machines/nunotaba/configuration.nix
index 7d53761..770b5f3 100644
--- a/machines/nunotaba/configuration.nix
+++ b/machines/nunotaba/configuration.nix
@@ -28,4 +28,6 @@
   };
 
   networking.hostName = "nunotaba";
+
+  system.stateVersion = "20.03";
 }
diff --git a/machines/sayuri/configuration.nix b/machines/sayuri/configuration.nix
index 2740c1c..f1b2930 100644
--- a/machines/sayuri/configuration.nix
+++ b/machines/sayuri/configuration.nix
@@ -33,4 +33,6 @@
   };
 
   networking.hostName = "sayuri";
+
+  system.stateVersion = "20.03";
 }
diff --git a/modules/default.nix b/modules/default.nix
index 56fd7f7..a0ac22b 100644
--- a/modules/default.nix
+++ b/modules/default.nix
@@ -93,9 +93,6 @@ in
     programs.gnupg.agent.enable = true;
     programs.ssh.startAgent = true;
 
-    # NixOS state version (see https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion)
-    system.stateVersion = "20.03";
-
     # When this is set to true (default), routing everything through a
     # wireguard tunnel does not work.
     networking.firewall.checkReversePath = "loose";
diff --git a/users/simon/default.nix b/users/simon/default.nix
index 491ee5c..c6dbafd 100644
--- a/users/simon/default.nix
+++ b/users/simon/default.nix
@@ -47,7 +47,7 @@ in
     imports = [ ./modules ];
 
     config = {
-      home.stateVersion = "20.09";
+      home.stateVersion = config.system.stateVersion;
     };
   };
 }