diff --git a/src/lib/Hydra/Controller/Root.pm b/src/lib/Hydra/Controller/Root.pm
index 64bdc8cf..efc8f130 100644
--- a/src/lib/Hydra/Controller/Root.pm
+++ b/src/lib/Hydra/Controller/Root.pm
@@ -33,6 +33,7 @@ sub begin :Private {
     $c->stash->{inputTypes} = {
         'string' => 'String value',
         'boolean' => 'Boolean',
+        'nix' => 'Nix expression',
         'build' => 'Build output',
         'sysbuild' => 'Build output (same system)'
     };
diff --git a/src/lib/Hydra/Helper/AddBuilds.pm b/src/lib/Hydra/Helper/AddBuilds.pm
index 62232068..b9d7a297 100644
--- a/src/lib/Hydra/Helper/AddBuilds.pm
+++ b/src/lib/Hydra/Helper/AddBuilds.pm
@@ -157,7 +157,7 @@ sub fetchInput {
     elsif ($type eq "sysbuild") {
         @inputs = fetchInputSystemBuild($db, $project, $jobset, $name, $value);
     }
-    elsif ($type eq "string") {
+    elsif ($type eq "string" || $type eq "nix") {
         die unless defined $value;
         @inputs = { value => $value };
     }
@@ -241,6 +241,9 @@ sub inputsToArgs {
                 when ("boolean") {
                     push @res, "--arg", $input, booleanToString($exprType, $alt->{value});
                 }
+                when ("nix") {
+                    push @res, "--arg", $input, $alt->{value};
+                }
                 default {
                     push @res, "--arg", $input, buildInputToString($exprType, $alt);
                 }
diff --git a/src/root/common.tt b/src/root/common.tt
index 5d4be232..7a52b48a 100644
--- a/src/root/common.tt
+++ b/src/root/common.tt
@@ -247,10 +247,12 @@ END;
 BLOCK renderShortInputValue;
   IF input.type == "build" || input.type == "sysbuild" %]
     <a href="[% c.uri_for('/build' input.dependency.id) %]">[% input.dependency.id %]</a>
-  [% ELSIF input.type == "string" || input.type == "boolean" %]
-    <tt>"[% input.value %]"</tt>
+  [% ELSIF input.type == "string" %]
+    <tt>"[% HTML.escape(input.value) %]"</tt>
+  [% ELSIF input.type == "nix" || input.type == "boolean" %]
+    <tt>[% HTML.escape(input.value) %]</tt>
   [% ELSE %]
-    <tt>[% input.uri %][% IF input.revision %] (r[% input.revision %])[% END %]</tt>
+    <tt>[% HTML.escape(input.uri) %][% IF input.revision %] (r[% HTML.escape(input.revision) %])[% END %]</tt>
   [% END %]
 [% END;
 
@@ -292,13 +294,15 @@ BLOCK renderInputs; %]
           <td>
             [% IF input.type == "build" || input.type == "sysbuild" %]
               [% INCLUDE renderFullBuildLink build=input.dependency %]
-            [% ELSIF input.type == "string" || input.type == "boolean" %]
-              <tt>"[% input.value %]"</tt>
+            [% ELSIF input.type == "string"  %]
+              <tt>"[% HTML.escape(input.value) %]"</tt>
+            [% ELSIF input.type == "nix" || input.type == "boolean" %]
+              <tt>[% HTML.escape(input.value) %]</tt>
             [% ELSE %]
-              <tt>[% input.uri %]</tt>
+              <tt>[% HTML.escape(input.uri) %]</tt>
             [% END %]
           </td>
-          <td>[% IF input.revision %][% input.revision %][% END %]</td>
+          <td>[% IF input.revision %][% HTML.escape(input.revision) %][% END %]</td>
           <td><tt>[% input.path %]</tt></td>
         </tr>
       [% END %]
diff --git a/src/root/reproduce.tt b/src/root/reproduce.tt
index d4624b39..6846ee9f 100644
--- a/src/root/reproduce.tt
+++ b/src/root/reproduce.tt
@@ -141,11 +141,14 @@ fi
 args+=(--arg '[% input.name %]' "{ outPath = $inputDir; rev = \"[% input.revision %]\"; }")
 
 [% ELSIF input.type == "string" %]
-args+=(--arg '[% input.name %]' '"[% input.value %]"')
+args+=(--arg '[% input.name %]' '"[% input.value %]"') # FIXME: escape
 
 [% ELSIF input.type == "boolean" %]
 args+=(--arg '[% input.name %]' '[% input.value %]')
 
+[% ELSIF input.type == "nix" %]
+args+=(--arg '[% input.name %]' '[% input.value %]') # FIXME: escape
+
 [% ELSE %]
 echo "$0: input ‘[% input.name %]’ has unsupported type ‘[% input.type %]’" >&2
 exit 1
diff --git a/src/sql/hydra.sql b/src/sql/hydra.sql
index a1fe253d..07700222 100644
--- a/src/sql/hydra.sql
+++ b/src/sql/hydra.sql
@@ -76,7 +76,7 @@ create table JobsetInputs (
     project       text not null,
     jobset        text not null,
     name          text not null,
-    type          text not null, -- "svn", "path", "uri", "string", "boolean"
+    type          text not null, -- "svn", "path", "uri", "string", "boolean", "nix"
     primary key   (project, jobset, name),
     foreign key   (project, jobset) references Jobsets(project, name) on delete cascade on update cascade
 );