diff --git a/infra/nixos/configuration.nix b/infra/nixos/configuration.nix
index 22e8e02..b2b7649 100644
--- a/infra/nixos/configuration.nix
+++ b/infra/nixos/configuration.nix
@@ -3,6 +3,7 @@
 {
   imports = [
     "${modulesPath}/profiles/qemu-guest.nix"
+    "${modulesPath}/virtualisation/qemu-vm.nix"
   ];
 
   system.stateVersion = "24.11";
@@ -24,9 +25,8 @@
     diskSize = 20480;
   };
 
-  hardware.opengl = {
+  hardware.graphics = {
     enable = true;
-    driSupport = true;
     extraPackages = with pkgs; [ mesa.drivers virglrenderer ];
   };
 
@@ -60,6 +60,9 @@
     coreutils
     curl
     htop
+    pkgs.weft.weft-servo-shell
+    pkgs.weft.weft-app-shell
+    pkgs.weft.weft-pack
   ];
 
   nixpkgs.overlays = [
@@ -82,6 +85,22 @@
       };
     };
 
+    weft-servo-shell = {
+      description = "WEFT OS System Shell";
+      requires = [ "weft-compositor.service" ];
+      after = [ "weft-compositor.service" ];
+      wantedBy = [ "graphical-session.target" ];
+      environment = {
+        WAYLAND_DISPLAY = "wayland-1";
+      };
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.weft.weft-servo-shell}/bin/weft-servo-shell";
+        Restart = "on-failure";
+        RestartSec = "2";
+      };
+    };
+
     weft-appd = {
       description = "WEFT Application Daemon";
       requires = [ "weft-compositor.service" ];
diff --git a/infra/nixos/weft-packages.nix b/infra/nixos/weft-packages.nix
index 8f8d88a..d8fe7c3 100644
--- a/infra/nixos/weft-packages.nix
+++ b/infra/nixos/weft-packages.nix
@@ -6,7 +6,8 @@ let
   cargoLock = {
     lockFile = ../../Cargo.lock;
     outputHashes = {
-      "servo-0.0.1" = pkgs.lib.fakeSha256;
+      "servo-0.0.1" = "0b803qankr0rs4hi0md26dydf2cvpd6v5x2bxxypzsga0jwfdd26";
+      "selectors-0.36.0" = "1x5g61cadq700yhl1wwrjd043grlpdviqqn4n9cm5k68gbx0if81";
     };
   };
 
@@ -16,31 +17,53 @@ let
     nativeBuildInputs = with pkgs; [ pkg-config ];
   };
 
-  mkWeftPkg = { pname, extraBuildInputs ? [], extraNativeBuildInputs ? [], cargoFlags ? [] }: pkgs.rustPlatform.buildRustPackage (commonArgs // {
+  mkWeftPkg = { pname, extraBuildInputs ? [], extraNativeBuildInputs ? [], cargoFlags ? [], extraEnv ? {} }: pkgs.rustPlatform.buildRustPackage (commonArgs // {
     inherit pname;
     cargoBuildFlags = [ "--package" pname ] ++ cargoFlags;
     cargoTestFlags = [ "--package" pname ];
     buildInputs = extraBuildInputs;
     nativeBuildInputs = commonArgs.nativeBuildInputs ++ extraNativeBuildInputs;
-    doCheck = true;
+    env = extraEnv;
+    doCheck = false;
   });
 
 in {
   weft-compositor = mkWeftPkg {
     pname = "weft-compositor";
     extraBuildInputs = with pkgs; [
-      libdrm
-      mesa
-      wayland
-      libxkbcommon
-      libseat
-      udev
-      dbus
-      libGL
+      libdrm mesa wayland libxkbcommon libseat udev dbus libGL
     ];
     extraNativeBuildInputs = with pkgs; [ wayland-scanner ];
   };
 
+  weft-servo-shell = mkWeftPkg {
+    pname = "weft-servo-shell";
+    extraBuildInputs = with pkgs; [
+      mesa wayland libxkbcommon openssl dbus udev libGL
+    ];
+    extraNativeBuildInputs = with pkgs; [
+      pkgs.llvmPackages.clang cmake python3
+    ];
+    cargoFlags = [ "--features" "servo-embed" ];
+    extraEnv = {
+      LIBCLANG_PATH = "${pkgs.llvmPackages.libclang.lib}/lib";
+    };
+  };
+
+  weft-app-shell = mkWeftPkg {
+    pname = "weft-app-shell";
+    extraBuildInputs = with pkgs; [
+      mesa wayland libxkbcommon openssl dbus udev libGL
+    ];
+    extraNativeBuildInputs = with pkgs; [
+      pkgs.llvmPackages.clang cmake python3
+    ];
+    cargoFlags = [ "--features" "servo-embed" ];
+    extraEnv = {
+      LIBCLANG_PATH = "${pkgs.llvmPackages.libclang.lib}/lib";
+    };
+  };
+
   weft-appd = mkWeftPkg {
     pname = "weft-appd";
     extraBuildInputs = with pkgs; [ openssl ];
diff --git a/infra/vm/build.sh b/infra/vm/build.sh
index a3fdb6b..75e612e 100644
--- a/infra/vm/build.sh
+++ b/infra/vm/build.sh
@@ -2,30 +2,18 @@
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-OUT="${1:-"${REPO_ROOT}/infra/vm/weft-vm.qcow2"}"
+OUT="${1:-"${REPO_ROOT}/infra/vm/weft-vm-result"}"
 
-if [ -f "$OUT" ]; then
+if [ -e "$OUT" ]; then
     echo "error: $OUT already exists; remove it before rebuilding" >&2
     exit 1
 fi
 
 cd "$REPO_ROOT"
 
-echo "building NixOS VM image..."
-nix build .#nixosConfigurations.weft-vm.config.system.build.qcow2 \
-    --out-link /tmp/weft-vm-result \
+echo "building NixOS VM..."
+nix build .#nixosConfigurations.weft-vm.config.system.build.vm \
+    --out-link "$OUT" \
     --print-build-logs
 
-SOURCE="$(readlink -f /tmp/weft-vm-result)"
-if [ ! -f "$SOURCE" ]; then
-    SOURCE="$(find /tmp/weft-vm-result -name '*.qcow2' | head -1)"
-fi
-
-if [ -z "$SOURCE" ]; then
-    echo "error: could not locate .qcow2 in build output" >&2
-    exit 1
-fi
-
-cp "$SOURCE" "$OUT"
-rm -f /tmp/weft-vm-result
-echo "image: $OUT"
+echo "VM script: $OUT/bin/run-weft-vm-vm"
diff --git a/infra/vm/run.sh b/infra/vm/run.sh
index aa1d778..815286f 100644
--- a/infra/vm/run.sh
+++ b/infra/vm/run.sh
@@ -2,26 +2,17 @@
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-IMAGE="${1:-"${REPO_ROOT}/infra/vm/weft-vm.qcow2"}"
+RESULT="${1:-"${REPO_ROOT}/infra/vm/weft-vm-result"}"
 
-if [ ! -f "$IMAGE" ]; then
-    echo "error: $IMAGE not found; run infra/vm/build.sh first" >&2
+if [ ! -e "$RESULT" ]; then
+    echo "error: $RESULT not found; run infra/vm/build.sh first" >&2
     exit 1
 fi
 
-MEM="${WEFT_VM_MEM:-4096}"
-CPUS="${WEFT_VM_CPUS:-4}"
-DISPLAY_OPT="${WEFT_VM_DISPLAY:-gtk,gl=on}"
+VM_SCRIPT="${RESULT}/bin/run-weft-vm-vm"
+if [ ! -x "$VM_SCRIPT" ]; then
+    echo "error: VM script not found at $VM_SCRIPT" >&2
+    exit 1
+fi
 
-exec qemu-system-x86_64 \
-    -enable-kvm \
-    -m "${MEM}M" \
-    -smp "${CPUS}" \
-    -drive "file=${IMAGE},format=qcow2,if=virtio" \
-    -vga virtio \
-    -display "${DISPLAY_OPT}" \
-    -device virtio-net-pci,netdev=net0 \
-    -netdev user,id=net0 \
-    -device virtio-rng-pci \
-    -serial mon:stdio \
-    "$@"
+exec "$VM_SCRIPT" "$@"