diff --git a/packages/common.nix b/packages/common.nix
index c9f2c57..380f846 100644
--- a/packages/common.nix
+++ b/packages/common.nix
@@ -17,6 +17,9 @@
 
   renderBunFilters = filters:
     lib.concatMapStringsSep "\n" (filter: "          --filter ${filter} \\") filters;
+
+  renderBunInstallFlags = flags:
+    lib.concatMapStringsSep "\n" (flag: "          ${flag} \\") flags;
 in {
   inherit workspacePreparePatched;
 
@@ -29,6 +32,7 @@ in {
     src,
     outputHash,
     filters,
+    installFlags ? [],
     extraNativeBuildInputs ? [],
     impureEnvVars ? [],
     extraEnv ? "",
@@ -68,6 +72,7 @@ in {
           --backend=copyfile \
           --linker=hoisted \
           --no-progress \
+${renderBunInstallFlags installFlags}
 ${renderBunFilters filters}
 
         bun --bun ${./scripts/canonicalize-node-modules.ts}
diff --git a/packages/node-modules-layers.nix b/packages/node-modules-layers.nix
new file mode 100644
index 0000000..b243c3d
--- /dev/null
+++ b/packages/node-modules-layers.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  pkgs,
+  src,
+}: let
+  common = pkgs.callPackage ./common.nix {};
+
+  t3codeNodeModulesBase = common.mkNodeModules {
+    pname = "t3code";
+    version = "base";
+    inherit src;
+    outputHash = "sha256-eXNOHRuNv9XFhXmsFtkunZswtRPd8gzJB1Jdw2DxYZY=";
+    filters = [
+      "."
+      "./apps/server"
+      "./apps/web"
+      "./packages/client-runtime"
+      "./packages/contracts"
+      "./packages/effect-acp"
+      "./packages/effect-codex-app-server"
+      "./packages/shared"
+    ];
+  };
+
+  t3codeNodeModulesDesktopOverlay = common.mkNodeModules {
+    pname = "t3code-desktop-overlay";
+    version = "overlay";
+    inherit src;
+    outputHash = "sha256-P6hlfpIZOLmkdXn99e0WC1CHAf7SD4CjouVwvAYo0+w=";
+    filters = [
+      "."
+      "./apps/desktop"
+    ];
+    impureEnvVars =
+      lib.fetchers.proxyImpureEnvVars
+      ++ [
+        "GIT_PROXY_COMMAND"
+        "SOCKS_SERVER"
+      ];
+    extraNativeBuildInputs = [
+      pkgs.gcc
+      pkgs.gnumake
+      pkgs.pkg-config
+      pkgs.python3
+    ];
+    extraEnv = ''
+      export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+      export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
+      export npm_config_build_from_source=true
+    '';
+  };
+
+in {
+  inherit
+    t3codeNodeModulesBase
+    t3codeNodeModulesDesktopOverlay
+    ;
+}
diff --git a/packages/t3code-desktop/default.nix b/packages/t3code-desktop/default.nix
index b75355d..2a9024d 100644
--- a/packages/t3code-desktop/default.nix
+++ b/packages/t3code-desktop/default.nix
@@ -29,7 +29,6 @@
 
   pname = "t3code-desktop";
   version = desktopPackageJson.version;
-
 in
   stdenv.mkDerivation (finalAttrs: {
     inherit pname version;
@@ -71,6 +70,42 @@ in
       '';
     };
 
+    runtimeNodeModules = common.mkNodeModules {
+      inherit (finalAttrs) pname version src;
+      outputHash = "sha256-q1xo2GiU3Ct4Sq5+qGsfXMI0ei1c5AXkdq0GaBWr1PI=";
+      installFlags = [
+        "--production"
+      ];
+      filters = [
+        "."
+        "./apps/desktop"
+        "./apps/server"
+        "./apps/web"
+        "./packages/client-runtime"
+        "./packages/contracts"
+        "./packages/effect-acp"
+        "./packages/effect-codex-app-server"
+        "./packages/shared"
+      ];
+      impureEnvVars =
+        lib.fetchers.proxyImpureEnvVars
+        ++ [
+          "GIT_PROXY_COMMAND"
+          "SOCKS_SERVER"
+        ];
+      extraNativeBuildInputs = [
+        gcc
+        gnumake
+        pkg-config
+        python3
+      ];
+      extraEnv = ''
+        export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+        export PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
+        export npm_config_build_from_source=true
+      '';
+    };
+
     nativeBuildInputs = [
       asar
       bun
@@ -104,8 +139,10 @@ in
 
       bun run build:desktop
       node ${./build-nix-desktop-package.mjs} --output-dir packaged-app
-      cp -R node_modules packaged-app/node_modules
+      cp -R ${finalAttrs.runtimeNodeModules} packaged-app/node_modules
       chmod -R u+rwX packaged-app/node_modules
+      rm -rf packaged-app/node_modules/node-pty
+      cp -R node_modules/node-pty packaged-app/node_modules/
       patchShebangs packaged-app/node_modules
       find packaged-app/node_modules -xtype l -delete
       rm -rf packaged-app/node_modules/electron
@@ -132,9 +169,9 @@ in
         --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
         --set-default ELECTRON_IS_DEV 0 \
         --prefix PATH : ${lib.makeBinPath [
-          git
-          xdg-utils
-        ]} \
+        git
+        xdg-utils
+      ]} \
         --add-flags "$out/share/${pname}/resources/app.asar"
 
       export out
diff --git a/packages/t3code-server/default.nix b/packages/t3code-server/default.nix
index 772fccd..a6b0674 100644
--- a/packages/t3code-server/default.nix
+++ b/packages/t3code-server/default.nix
@@ -44,6 +44,24 @@ in
       ];
     };
 
+    runtimeNodeModules = common.mkNodeModules {
+      inherit (finalAttrs) pname version src;
+      outputHash = "sha256-EcUsCt8liYnmzsDXzdwfLbMEk4/OYHB6DkcjjvmTWEM=";
+      installFlags = [
+        "--production"
+      ];
+      filters = [
+        "."
+        "./apps/server"
+        "./apps/web"
+        "./packages/client-runtime"
+        "./packages/contracts"
+        "./packages/effect-acp"
+        "./packages/effect-codex-app-server"
+        "./packages/shared"
+      ];
+    };
+
     nativeBuildInputs = [
       bun
       makeBinaryWrapper
@@ -76,7 +94,10 @@ in
       mkdir -p "$out/libexec/t3code/apps"
       mkdir -p "$out/libexec/t3code/packages"
 
-      cp -R --no-preserve=mode node_modules "$out/libexec/t3code/"
+      cp -R --no-preserve=mode ${finalAttrs.runtimeNodeModules} "$out/libexec/t3code/node_modules"
+      chmod -R u+rwX "$out/libexec/t3code/node_modules"
+      rm -rf "$out/libexec/t3code/node_modules/node-pty"
+      cp -R --no-preserve=mode node_modules/node-pty "$out/libexec/t3code/node_modules/"
       cp -R --no-preserve=mode apps/server/dist "$out/libexec/t3code/apps/server/"
       cp -R --no-preserve=mode apps/web "$out/libexec/t3code/apps/"
       cp -R --no-preserve=mode packages/client-runtime "$out/libexec/t3code/packages/"