diff --git a/deployment/check/data-model-basic/constants.nix b/deployment/check/data-model-basic/constants.nix
new file mode 100644
index 00000000..9af9d7a8
--- /dev/null
+++ b/deployment/check/data-model-basic/constants.nix
@@ -0,0 +1,12 @@
+{
+  targetMachines = [
+    # FIXME removing caused error: expected an indented block after 'with'
+    "ssh"
+  ];
+  # stablize path, as just the path would yield distinct paths when applied multiple times
+  pathToRoot = builtins.path {
+    path = ../../..;
+    name = "root";
+  };
+  pathFromRoot = "/deployment/check/data-model-basic";
+}
diff --git a/deployment/check/data-model-basic/default.nix b/deployment/check/data-model-basic/default.nix
new file mode 100644
index 00000000..1371928b
--- /dev/null
+++ b/deployment/check/data-model-basic/default.nix
@@ -0,0 +1,22 @@
+{
+  pkgs,
+  runNixOSTest,
+  inputs,
+  sources,
+}:
+
+runNixOSTest {
+  imports = [
+    ../common/nixosTest.nix
+    ./nixosTest.nix
+  ];
+  _module.args = {
+    inherit inputs sources;
+    modulesPath = "${builtins.toString pkgs.path}/nixos/modules";
+  };
+  inherit (import ./constants.nix)
+    targetMachines
+    pathToRoot
+    pathFromRoot
+    ;
+}
diff --git a/deployment/check/data-model-basic/nixosTest.nix b/deployment/check/data-model-basic/nixosTest.nix
new file mode 100644
index 00000000..eb654317
--- /dev/null
+++ b/deployment/check/data-model-basic/nixosTest.nix
@@ -0,0 +1,59 @@
+{
+  pkgs,
+  lib,
+  modulesPath,
+  ...
+}:
+let
+  inherit (lib) mkOption;
+  inherit (pkgs.callPackage ../common/utils.nix { inherit modulesPath; }) mkNixosConfiguration;
+in
+{
+  _class = "nixosTest";
+  name = "deployment-model";
+
+  nodes.deployer =
+    ((pkgs.callPackage ../../utils.nix { }).evalModel (
+      { config, ... }:
+      {
+        imports = [ ../common/model.nix ];
+        options = {
+          default =
+            let
+              env = config.environments.default;
+            in
+            mkOption {
+              type = env.resource-mapping.output-type;
+              default = env.deployment {
+                deployment-name = "default";
+                configuration = config."example-configuration";
+              };
+            };
+          deploy = mkOption {
+            default = config.default.ssh-host.run;
+          };
+        };
+        config = {
+          environments.default = environment: {
+            resources."operator-environment".login-shell.username = "operator";
+            implementation =
+              { required-resources, ... }:
+              {
+                nixos-configuration = {
+                  imports = [
+                    (mkNixosConfiguration environment required-resources)
+                    "${modulesPath}/../lib/testing/nixos-test-base.nix"
+                  ];
+                };
+              };
+          };
+        };
+      }
+    )).default.nixos-configuration;
+
+  extraTestScript = ''
+    with subtest("Check the data model"):
+      deployer.wait_for_unit("multi-user.target")
+      deployer.succeed("su - operator -c hello 1>&2")
+  '';
+}
diff --git a/deployment/flake-part.nix b/deployment/flake-part.nix
index 3ad6bf55..b8a6491b 100644
--- a/deployment/flake-part.nix
+++ b/deployment/flake-part.nix
@@ -27,6 +27,11 @@
           inherit pkgs inputs sources;
         };
 
+        deployment-model-basic = import ./check/data-model-basic {
+          inherit (pkgs.testers) runNixOSTest;
+          inherit pkgs inputs sources;
+        };
+
         deployment-model-ssh = import ./check/data-model-ssh {
           inherit (pkgs.testers) runNixOSTest;
           inherit pkgs inputs sources;
diff --git a/deployment/run/default.nix b/deployment/run/default.nix
index 3d35d39e..8c0f9102 100644
--- a/deployment/run/default.nix
+++ b/deployment/run/default.nix
@@ -38,6 +38,8 @@ let
     # which would otherwise not be serializable, while nix also makes it hard to
     # produce its derivation to pass thru without a `nix-instantiate` call,
     # which in turn would need to be passed the (unserializable) nixos config.
+    # FIXME find a way to serialize nixos configurations without needing recursion
+    # c.f. inability to serialize functions: https://github.com/NixOS/nix/issues/4000
     builtins.toString (
       pkgs.writers.writeText "configuration.nix" ''
         import ${root-path}/deployment/nixos.nix {
@@ -65,6 +67,20 @@ let
     description = "A NixOS configuration.";
     type = raw;
   };
+  # FIXME ensure this works from outside this repo too
+  caller = mkOption {
+    description = "The calling module to obtain the NixOS configuration from.";
+    type = types.str;
+  };
+  args = mkOption {
+    description = "The arguments with which to call the module to obtain the NixOS configuration.";
+    type = types.attrs;
+  };
+  deployment-name = mkOption {
+    description = "The name of the deployment for which to obtain the NixOS configuration.";
+    type = types.str;
+    default = "default";
+  };
   httpBackend = mkOption {
     description = "environment variables to configure the TF HTTP back-end, see <https://developer.hashicorp.com/terraform/language/backend/http#configuration-variables>";
     # type = types.attrsOf (types.either types.str types.int);
@@ -182,6 +198,7 @@ let
   };
 in
 {
+  inherit nixos-configuration;
   ssh-host = mkOption {
     description = "A deployment by SSH to update a single existing NixOS host.";
     type = submodule (
@@ -192,21 +209,13 @@ in
             description = "The architecture of the system to deploy to.";
             type = types.str;
           };
-          inherit nixos-configuration;
+          inherit
+            caller
+            args
+            deployment-name
+            nixos-configuration
+            ;
           ssh = host-ssh;
-          caller = mkOption {
-            description = "The calling module to obtain the NixOS configuration from.";
-            type = types.str;
-          };
-          args = mkOption {
-            description = "The arguments with which to call the module to obtain the NixOS configuration.";
-            type = types.attrs;
-          };
-          deployment-name = mkOption {
-            description = "The name of the deployment for which to obtain the NixOS configuration.";
-            type = types.str;
-            default = "default";
-          };
           root-path = mkOption {
             description = "The path to the root of the repository.";
             type = types.path;
@@ -274,20 +283,14 @@ in
             description = "The architecture of the system to deploy to.";
             type = types.str;
           };
-          inherit httpBackend nixos-configuration;
+          inherit
+            caller
+            args
+            deployment-name
+            httpBackend
+            nixos-configuration
+            ;
           ssh = host-ssh;
-          caller = mkOption {
-            description = "The calling module to obtain the NixOS configuration from.";
-            type = types.str;
-          };
-          args = mkOption {
-            description = "The arguments with which to call the module to obtain the NixOS configuration.";
-            type = types.attrs;
-          };
-          deployment-name = mkOption {
-            description = "The name of the deployment for which to obtain the NixOS configuration.";
-            type = types.str;
-          };
           root-path = mkOption {
             description = "The path to the root of the repository.";
             type = types.path;
@@ -439,20 +442,14 @@ in
             description = "The architecture of the system to deploy to.";
             type = types.str;
           };
-          inherit httpBackend nixos-configuration;
+          inherit
+            caller
+            args
+            deployment-name
+            httpBackend
+            nixos-configuration
+            ;
           ssh = host-ssh;
-          caller = mkOption {
-            description = "The calling module to obtain the NixOS configuration from.";
-            type = types.str;
-          };
-          args = mkOption {
-            description = "The arguments with which to call the module to obtain the NixOS configuration.";
-            type = types.attrs;
-          };
-          deployment-name = mkOption {
-            description = "The name of the deployment for which to obtain the NixOS configuration.";
-            type = types.str;
-          };
           root-path = mkOption {
             description = "The path to the root of the repository.";
             type = types.path;