diff --git a/deployment/check/common/data-model.nix b/deployment/check/common/data-model.nix
index 43528cb8..5bcf4237 100644
--- a/deployment/check/common/data-model.nix
+++ b/deployment/check/common/data-model.nix
@@ -26,8 +26,6 @@ let
     sshOpts
     key-file
     httpBackend
-    proxmox-user
-    proxmox-password
     node-name
     bridge
     vlanId
@@ -332,8 +330,6 @@ let
                       args
                       deployment-name
                       httpBackend
-                      proxmox-user
-                      proxmox-password
                       node-name
                       bridge
                       vlanId
diff --git a/deployment/check/data-model-tf-proxmox/nixosTest.nix b/deployment/check/data-model-tf-proxmox/nixosTest.nix
index 7a66d8d2..3261ff65 100644
--- a/deployment/check/data-model-tf-proxmox/nixosTest.nix
+++ b/deployment/check/data-model-tf-proxmox/nixosTest.nix
@@ -23,8 +23,6 @@ let
       "ProxyCommand=ssh -W %h:%p pve"
     ];
     key-file = "/root/.ssh/id_ed25519";
-    proxmox-user = "root@pam";
-    proxmox-password = "mytestpw";
     node-name = "pve";
     bridge = "br0";
     vlanId = 0;
diff --git a/deployment/check/data-model-tf/options.nix b/deployment/check/data-model-tf/options.nix
index b928087e..3a865236 100644
--- a/deployment/check/data-model-tf/options.nix
+++ b/deployment/check/data-model-tf/options.nix
@@ -25,15 +25,6 @@ in
       type = types.str;
       default = "";
     };
-    proxmox-user = mkOption {
-      description = "The ProxmoX user to use.";
-      type = types.str;
-      default = "root@pam";
-    };
-    proxmox-password = mkOption {
-      description = "The ProxmoX password to use.";
-      type = types.str;
-    };
     node-name = mkOption {
       description = "the name of the ProxmoX node to use.";
       type = types.str;
diff --git a/deployment/data-model.nix b/deployment/data-model.nix
index 6a1f849c..1b259f80 100644
--- a/deployment/data-model.nix
+++ b/deployment/data-model.nix
@@ -311,16 +311,6 @@ let
             description = "The path to the root of the repository.";
             type = types.path;
           };
-          proxmox-user = mkOption {
-            description = "The ProxmoX user to use.";
-            type = types.str;
-            default = "root@pam";
-          };
-          # TODO: is sensitivity here handled properly?
-          proxmox-password = mkOption {
-            description = "The ProxmoX password to use.";
-            type = types.str;
-          };
           node-name = mkOption {
             description = "the name of the ProxmoX node to use.";
             type = types.str;
@@ -388,8 +378,6 @@ let
                   deployment-name
                   httpBackend
                   root-path
-                  proxmox-user
-                  proxmox-password
                   node-name
                   bridge
                   vlanId
@@ -464,8 +452,6 @@ let
                     bridge
                     ;
                   node_name = node-name;
-                  proxmox_user = proxmox-user;
-                  proxmox_password = proxmox-password;
                   ssh_user = username;
                   vlan_id = vlanId;
                   image_datastore_id = imageDatastoreId;
diff --git a/deployment/run/tf-proxmox/main.tf b/deployment/run/tf-proxmox/main.tf
index 6d00e7a3..b147f076 100644
--- a/deployment/run/tf-proxmox/main.tf
+++ b/deployment/run/tf-proxmox/main.tf
@@ -31,15 +31,6 @@ provider "proxmox" {
     #   # port = 22
     # }
   }
-
-  # # Choose one authentication method:
-  # api_token = var.virtual_environment_api_token
-  # # OR
-  username  = var.proxmox_user
-  password  = var.proxmox_password
-  # # OR
-  # auth_ticket           = var.virtual_environment_auth_ticket
-  # csrf_prevention_token = var.virtual_environment_csrf_prevention_token
 }
 
 # # FIXME move to host
diff --git a/deployment/run/tf-proxmox/variables.tf b/deployment/run/tf-proxmox/variables.tf
index eb0c90fe..fc4a945f 100644
--- a/deployment/run/tf-proxmox/variables.tf
+++ b/deployment/run/tf-proxmox/variables.tf
@@ -9,23 +9,6 @@ variable "ssh_user" {
   default = "root"
 }
 
-variable "proxmox_user" {
-  description = <<EOT
-    the ProxmoX user to use. needs privileges:
-    - `VM.Monitor`
-    - ...
-  EOT
-  type = string
-  default = "root@pam"
-}
-
-variable "proxmox_password" {
-  description = "the ProxmoX password to use"
-  type = string
-  sensitive = true
-  default = ""
-}
-
 variable "host" {
   description = "the host of the ProxmoX Virtual Environment."
   type = string
diff --git a/flake.nix b/flake.nix
index d1935840..7f2eea1b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -81,35 +81,37 @@
             apps.default =
               let
                 inherit (pkgs) system;
-                deployment =
-                  (import ./deployment/check/common/data-model.nix {
-                    inherit system;
-                    config = {
-                      targetSystem = system;
-                      nodeName = "192.168.51.81"; # root@fediversity-proxmox
-                      pathToRoot = builtins.path {
-                        path = ./.;
-                        name = "root";
+                deployment = pkgs.writeShellScriptBin "my-app-with-environment" ''
+                  export PROXMOX_VE_SSH_USERNAME="kiara@ProcoliX"
+                  export PROXMOX_VE_SSH_PASSWORD=""
+                    ${(import ./deployment/check/common/data-model.nix {
+                      inherit system;
+                      config = {
+                        targetSystem = system;
+                        nodeName = "192.168.51.81"; # root@fediversity-proxmox
+                        pathToRoot = builtins.path {
+                          path = ./.;
+                          name = "root";
+                        };
+                        sshOpts = [ ];
+                        key-file = "";
+                        node-name = "node051";
+                        bridge = "ovsbr0";
+                        vlanId = 1305;
+                        imageDatastoreId = "local";
+                        vmDatastoreId = "linstor_storage";
+                        cdDatastoreId = "local-lvm";
+                        ipv4Gateway = "eth0";
+                        ipv4Address = "";
+                        # ipv4Address = "95.215.187.${vm-id}";
+                        ipv6Gateway = "eth0";
+                        ipv6Address = "";
+                        # ipv6Address = "2a00:51c0:13:1305::${vm-id}";
                       };
-                      sshOpts = [ ];
-                      key-file = "";
-                      proxmox-user = "kiara@ProcoliX";
-                      proxmox-password = "";
-                      node-name = "node051";
-                      bridge = "ovsbr0";
-                      vlanId = 1305;
-                      imageDatastoreId = "local";
-                      vmDatastoreId = "linstor_storage";
-                      cdDatastoreId = "local-lvm";
-                      ipv4Gateway = "eth0";
-                      ipv4Address = "";
-                      # ipv4Address = "95.215.187.${vm-id}";
-                      ipv6Gateway = "eth0";
-                      ipv6Address = "";
-                      # ipv6Address = "2a00:51c0:13:1305::${vm-id}";
-                    };
-                    # opt not to pass `inputs`, as we could only pass serializable arguments through to its self-call
-                  })."tf-proxmox-deployment".tf-proxmox-host;
+                      # opt not to pass `inputs`, as we could only pass serializable arguments through to its self-call
+                    })."tf-proxmox-deployment".tf-proxmox-host
+                    }
+                '';
               in
               {
                 type = "app";