we need both Kolide and Fleet MDM clients installed by policy, and it's the lack of nix packaging for the latter and lack of support on that by Fleet which is really the issue.

my choices were essentially to either install Fleet with a separate Orbit with updates disabled... or to use OSQuery to enrol with Fleet... but both then fail compliance as Fleet needs updates, and Fleet needs to be detected as Fleet by Kolide.

I've raised this with Fleet via our shared Slack, and cited https://github.com/fleetdm/fleet/issues/7319 and https://github.com/fleetdm/fleet/issues/30510 and the one helpful signal here is that my being senior and a customer does help indicate the demand for supported nix packaging for Fleet.

I'll probably now switch to a Debian and just run nix for everything that isn't Kolide or Fleet... will build up from a minimal install Debian to get much the same experience, but with the weirdness of apt still being there doing updates for Fleet.