diff --git a/users/erwin/download-factorio.sh b/users/erwin/download-factorio.sh
new file mode 100644
index 0000000..96c9f73
--- /dev/null
+++ b/users/erwin/download-factorio.sh
@@ -0,0 +1,15 @@
+# shellcheck shell=bash
+
+edition=alpha
+if [[ $# -ge 1 ]]; then
+	edition="${1}"
+fi
+
+releases_file=$(mktemp --suffix=.json)
+xhs -o "${releases_file}" factorio.com/api/latest-releases
+
+version=$(jaq -r '.stable.alpha' "${releases_file}")
+token=$(cat "${FACTORIO_TOKEN_FILE:?}")
+
+nix-prefetch-url --name "factorio_${edition}_x64-${version}.tar.xz" \
+	"https://factorio.com/get-download/${version}/${edition}/linux64?username=eboskma&token=${token}"
diff --git a/users/erwin/home.nix b/users/erwin/home.nix
index e9301b5..808fa26 100644
--- a/users/erwin/home.nix
+++ b/users/erwin/home.nix
@@ -11,10 +11,21 @@ let
   homeCfg = config.home-manager.users.erwin;
   bt = config.eboskma.bluetooth;
 
-  downloadFactorio = pkgs.writeShellScriptBin "download-factorio" ''
-    version=$(${pkgs.xh}/bin/xhs factorio.com/api/latest-releases | ${pkgs.jaq}/bin/jaq -r '.stable.alpha')
-    ${pkgs.nix}/bin/nix-prefetch-url --name factorio_alpha_x64-''${version}.tar.xz https://factorio.com/get-download/''${version}/alpha/linux64\?username=eboskma\&token=$(cat ${config.sops.secrets.factorio-token.path})
-  '';
+  downloadFactorio = pkgs.writeShellApplication {
+    name = "download-factorio";
+    text = builtins.readFile ./download-factorio.sh;
+    runtimeInputs = with pkgs; [
+      jaq
+      nix
+      xh
+    ];
+    runtimeEnv = {
+      FACTORIO_TOKEN_FILE = config.sops.secrets.factorio-token.path;
+    };
+    derivationArgs = {
+      version = "0.0.1";
+    };
+  };
 in
 {
   config = mkIf cfg.home {