diff --git a/checks/impure/flake-module.nix b/checks/impure/flake-module.nix
index de96bc4b..3cd0af96 100644
--- a/checks/impure/flake-module.nix
+++ b/checks/impure/flake-module.nix
@@ -8,13 +8,12 @@
 
           export TMPDIR=$(${pkgs.coreutils}/bin/mktemp -d)
           trap "${pkgs.coreutils}/bin/chmod -R +w '$TMPDIR'; ${pkgs.coreutils}/bin/rm -rf '$TMPDIR'" EXIT
-
-          export PATH="${lib.makeBinPath [
+          export PATH="${lib.makeBinPath ([
             pkgs.coreutils
             pkgs.gitMinimal
             pkgs.nix
             self'.packages.clan-cli.checkPython
-          ]}"
+          ] ++ self'.packages.clan-cli.pytestDependencies)}"
 
           export CLAN_CORE=$TMPDIR/CLAN_CORE
           cp -r ${self} $CLAN_CORE
diff --git a/formatter.nix b/formatter.nix
index 949e7b4c..28b3de2b 100644
--- a/formatter.nix
+++ b/formatter.nix
@@ -21,7 +21,7 @@
 
     treefmt.programs.mypy.enable = true;
     treefmt.programs.mypy.directories = {
-      "pkgs/clan-cli".extraPythonPackages = self'.packages.clan-cli.testDependencies;
+      "pkgs/clan-cli".extraPythonPackages = self'.packages.clan-cli.pytestDependencies;
     };
 
     treefmt.settings.formatter.nix = {
diff --git a/pkgs/clan-cli/default.nix b/pkgs/clan-cli/default.nix
index 4bd65f6a..a92ba2f7 100644
--- a/pkgs/clan-cli/default.nix
+++ b/pkgs/clan-cli/default.nix
@@ -1,4 +1,5 @@
 { age
+, lib
 , argcomplete
 , fastapi
 , uvicorn
@@ -20,7 +21,11 @@
 , rsync
 , pkgs
 , ui-assets
-, lib
+, bash
+, sshpass
+, zbar
+, tor
+, git
 }:
 let
 
@@ -30,16 +35,35 @@ let
     uvicorn # optional dependencies: if not enabled, webui subcommand will not work
   ];
 
-  testDependencies = [
+  pytestDependencies = runtimeDependencies ++ dependencies ++ [
     pytest
     pytest-cov
     pytest-subprocess
     pytest-parallel
     openssh
+    git
     stdenv.cc
   ];
 
-  checkPython = python3.withPackages (_ps: dependencies ++ testDependencies);
+  # Optional dependencies for clan cli, we re-expose them here to make sure they all build.
+  runtimeDependencies = [
+    bash
+    nix
+    zerotierone
+    bubblewrap
+    openssh
+    sshpass
+    zbar
+    tor
+    age
+    rsync
+    sops
+    git
+  ];
+
+  runtimeDependenciesAsSet = builtins.listToAttrs (builtins.map (p: lib.nameValuePair (lib.getName p.name) p) runtimeDependencies);
+
+  checkPython = python3.withPackages (_ps: pytestDependencies);
 
   # - vendor the jsonschema nix lib (copy instead of symlink).
   source = runCommand "clan-cli-source" { } ''
@@ -73,6 +97,7 @@ let
       --experimental-features 'nix-command flakes' \
       --override-input nixpkgs ${pkgs.path}
   '';
+
 in
 python3.pkgs.buildPythonPackage {
   name = "clan-cli";
@@ -85,25 +110,24 @@ python3.pkgs.buildPythonPackage {
   ];
   propagatedBuildInputs = dependencies;
 
-  passthru.tests.clan-pytest = runCommand "clan-pytest"
-    {
-      nativeBuildInputs = [ age zerotierone bubblewrap sops nix openssh rsync stdenv.cc ];
-    } ''
-    cp -r ${source} ./src
-    chmod +w -R ./src
-    cd ./src
+  # also re-expose dependencies so we test them in CI
+  passthru.tests = (lib.mapAttrs' (n: lib.nameValuePair "package-${n}") runtimeDependenciesAsSet) // {
+    clan-pytest = runCommand "clan-pytest" { nativeBuildInputs = [ checkPython ] ++ pytestDependencies; } ''
+      cp -r ${source} ./src
+      chmod +w -R ./src
+      cd ./src
 
-    # git is needed for test_git.py
-    export PATH="${lib.makeBinPath [pkgs.git]}:$PATH"
-
-    export NIX_STATE_DIR=$TMPDIR/nix IN_NIX_SANDBOX=1
-    ${checkPython}/bin/python -m pytest -m "not impure" -s ./tests
-    touch $out
-  '';
+      export NIX_STATE_DIR=$TMPDIR/nix IN_NIX_SANDBOX=1
+      ${checkPython}/bin/python -m pytest -m "not impure" -s ./tests
+      touch $out
+    '';
+  };
   passthru.clan-openapi = runCommand "clan-openapi" { } ''
     cp -r ${source} ./src
     chmod +w -R ./src
     cd ./src
+    export PATH=${checkPython}/bin:$PATH
+
     ${checkPython}/bin/python ./bin/gen-openapi --out $out/openapi.json --app-dir . clan_cli.webui.app:app
     touch $out
   '';
@@ -113,9 +137,10 @@ python3.pkgs.buildPythonPackage {
   passthru.devDependencies = [
     setuptools
     wheel
-  ] ++ testDependencies;
+  ] ++ pytestDependencies;
 
-  passthru.testDependencies = dependencies ++ testDependencies;
+  passthru.pytestDependencies = pytestDependencies;
+  passthru.runtimeDependencies = runtimeDependencies;
 
   postInstall = ''
     cp -r ${nixpkgs} $out/${python3.sitePackages}/clan_cli/nixpkgs
diff --git a/pkgs/clan-cli/flake-module.nix b/pkgs/clan-cli/flake-module.nix
index 9d3b88cf..464e87aa 100644
--- a/pkgs/clan-cli/flake-module.nix
+++ b/pkgs/clan-cli/flake-module.nix
@@ -10,19 +10,6 @@
       clan-openapi = self'.packages.clan-cli.clan-openapi;
       default = self'.packages.clan-cli;
 
-      ## Optional dependencies for clan cli, we re-expose them here to make sure they all build.
-      inherit (pkgs)
-        age
-        bash
-        bubblewrap
-        git
-        openssh
-        rsync
-        sops
-        sshpass
-        tor
-        zbar
-        ;
       # Override license so that we can build zerotierone without
       # having to re-import nixpkgs.
       zerotierone = pkgs.zerotierone.overrideAttrs (_old: { meta = { }; });