{
  perSystem =
    { pkgs, ... }:
    let
      tools = import ./_packages.nix { inherit pkgs; };
    in
    {
      # Tooling only: no credential loading, mounts, or Python dependency installs.
      devShells.workbench = pkgs.mkShell {
        LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath [
          pkgs.stdenv.cc.cc.lib
          pkgs.zlib
        ];
        UV_PYTHON = "${pkgs.python314}/bin/python";
        UV_PYTHON_DOWNLOADS = "never";
        packages = [
          tools.gardenctl
          tools.gardenlogin
        ]
        ++ (with pkgs; [
          k9s
          kubectl
          kubelogin-oidc
          jq
          just
          python314
          rclone
          sops
          util-linux
          uv
        ]);
      };
    };
}