Install Nixpkgs and/or channel out of band; pluggable out of band deployments?

[Atemu]

When I deploy remotely, that machine will not have access to the Nixpkgs I used for eval. This has some upsides as it means that the entire ~250MiB Nixpkgs checkout isn't copied over a potentially very slow network every time I just want to quickly test something and also not the nix store which I think is a good thing.

I would like a machine that I have permanently deployed to (switch, boot) to have access to the Nixpkgs used to build that system closure for the purpose of opening nix shells etc. though.

Colmena can already deploy keys statefully. It'd be great if it could also deploy nixpkgs or other Nix sources to a specific location that could be added to the NIX_PATH, flake registries etc.

Colmena may already be able to accommodate such a feature by (ab)using the secrets; declaring a Nixpkgs checkout a secret and having Colmena copy it like any other secret. (I have not attempted this yet but it should work.)
This does not facilitate efficient copying of said Nix sources however as they're rather quite a lot of individual files and most of them usually don't change very much. There should be a mechanism more tailored towards that purpose such as rsync or git.

This may not be something Colmena should implement itself. In that case, it'd be great if there was some sort of pluggable mechanism to transfer state to the target hosts outside of the confines of a Nix derivation. What would be necessary here would be an option to specify "hooks" to be executed at certain times during a deployment which would have access to some Colmena metadata such as the target host, Nixpkgs used (perhaps also simply abitrary data from the module system declared by the user) or operation performed (local test, remote boot etc.).

I'd love to hear other people's solutions to my problem and thoughts on the proposals.