diff --git a/launch/default.nix b/launch/default.nix
index bb96db72..139b4300 100644
--- a/launch/default.nix
+++ b/launch/default.nix
@@ -1,6 +1,7 @@
 {
   system ? builtins.currentSystem,
   sources ? import ../npins,
+  # match the same versions we deploy locally
   inputs ? import sources.flake-inputs {
     root = ../.;
   },
@@ -13,11 +14,11 @@ let
   inherit (pkgs) lib;
 in
 {
+  # shell for testing TF directly
   shell = pkgs.mkShellNoCC {
     packages = [
-      pkgs.npins
-      pkgs.jaq # tf
       (import ./tf.nix { inherit lib pkgs; })
+      pkgs.jaq
     ];
   };
 
diff --git a/launch/tf-env.nix b/launch/tf-env.nix
index b0e02d93..a29114f9 100644
--- a/launch/tf-env.nix
+++ b/launch/tf-env.nix
@@ -10,6 +10,7 @@ pkgs.stdenv.mkDerivation {
     with lib.fileset;
     toSource {
       root = ../.;
+      # don't copy ignored files
       fileset = intersection (gitTracked ../.) ../.;
     };
   buildInputs = [
@@ -18,7 +19,9 @@ pkgs.stdenv.mkDerivation {
   buildPhase = ''
     runHook preBuild
     pushd launch/
+    # calculated pins
     echo '${lib.strings.toJSON sources}' > .npins.json
+    # generate TF lock for nix's TF providers
     tofu init -input=false
     popd
     runHook postBuild