diff --git a/MANIFEST.in b/MANIFEST.in
index daa4d69..fb11ae2 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -1,3 +1,4 @@
 recursive-include custominstall/bin/*
 include custominstall/title.db.gz
 include custominstall/TaskbarLib.tlb
+include custominstall/custom-install-finalize.3dsx
diff --git a/custominstall/custom-install-finalize.3dsx b/custominstall/custom-install-finalize.3dsx
new file mode 100644
index 0000000..1209b7e
Binary files /dev/null and b/custominstall/custom-install-finalize.3dsx differ
diff --git a/flake.lock b/flake.lock
index 1b116ed..530f4dc 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,63 @@
 {
   "nodes": {
+    "devkitNix": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "finalize",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1766539742,
+        "narHash": "sha256-F6OeM2LrLo2n+Xg5XU4udQR/vuWWrDMKxXRzNXE2ClQ=",
+        "owner": "bandithedoge",
+        "repo": "devkitNix",
+        "rev": "c97f9880737716085e78009cba6bf85ad104628b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "bandithedoge",
+        "repo": "devkitNix",
+        "type": "github"
+      }
+    },
+    "finalize": {
+      "inputs": {
+        "devkitNix": "devkitNix",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-qQn272f8Z4QhQV2reyd9v0GtypYgnTrOqEiewWnSGJY=",
+        "path": "finalize",
+        "type": "path"
+      },
+      "original": {
+        "path": "finalize",
+        "type": "path"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "hax-nur": {
       "inputs": {
         "nixpkgs": [
@@ -61,11 +119,27 @@
     },
     "root": {
       "inputs": {
+        "finalize": "finalize",
         "hax-nur": "hax-nur",
         "nixpkgs": "nixpkgs",
         "pyctr": "pyctr"
       }
     },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
diff --git a/flake.nix b/flake.nix
index 58e4d63..b773d95 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,6 +7,8 @@
     pyctr.inputs.nixpkgs.follows = "nixpkgs";
     hax-nur.url = "github:ihaveamac/nur-packages/master";
     hax-nur.inputs.nixpkgs.follows = "nixpkgs";
+    finalize.url = "path:finalize";
+    finalize.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs =
@@ -15,6 +17,7 @@
       nixpkgs,
       pyctr,
       hax-nur,
+      finalize,
     }:
     let
       systems = [
@@ -43,5 +46,24 @@
       packages = forAllSystems (
         system: nixpkgs.lib.filterAttrs (_: v: nixpkgs.lib.isDerivation v) self.legacyPackages.${system}
       );
+
+      apps = {
+        # this only works on x86_64-linux due to devkitNix only working there
+        x86_64-linux =
+          let
+            system = "x86_64-linux";
+            pkgs = import nixpkgs { inherit system; };
+          in
+          {
+            update-finalize = {
+              type = "app";
+              program = (pkgs.writeShellScript "update-finalize" ''
+                set -x
+                finalize=${inputs.finalize.packages.${system}.custom-install-finalize}/custom-install-finalize.3dsx
+                cp --no-preserve=mode,ownership,timestamps $finalize custominstall/custom-install-finalize.3dsx
+              '').outPath;
+            };
+          };
+      };
     };
 }
diff --git a/pyproject.toml b/pyproject.toml
index cf4624e..3ae8e98 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -45,4 +45,4 @@ find = {namespaces = false}
 
 # is it even possible to make these OS-specific with pyproject.toml?
 [tool.setuptools.package-data]
-custominstall = ["bin/darwin/save3ds_fuse", "bin/win32/save3ds_fuse.exe", "TaskbarLib.tlb", "title.db.gz"]
+custominstall = ["bin/darwin/save3ds_fuse", "bin/win32/save3ds_fuse.exe", "TaskbarLib.tlb", "title.db.gz", "custom-install-finalize.3dsx"]