diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,30 @@
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.4]
+
+### Added
+
+ - The path to `secrets.json` is now configurable in the module or config file,
+   using the `secretsJsonPath` setting, analogous to `clusterJoinTokenPath`.
+
+ - `aarch64-darwin` is now officially supported.
+
+ - All module settings options will be visible in the NixOS documentation.
+   Some less-used settings were hidden, specifically the file path options
+   that default to `staticSecretsDirectory + "/cluster-join-token.key"`, etc.
+
+### Changed
+
+ - The flake packages and modules now link with Nix 2.4.
+   Nix 2.3 support is still available via `packages.${system}.hercules-ci-agent-nix_2_3`, but will be removed in agent 0.9.x.
+
+ - No longer patch Boehm GC, staying closer to regular Nix and the Nixpkgs build of the `hercules-ci-agent`.
+
+### Fixed
+
+ - Various fixes related to the upgrade to Nix 2.4.
+
 ## [0.8.3]
 
 ### Added
@@ -428,10 +452,11 @@
 
 - Support ci.nix or nix/ci.nix along with default.nix
 
-## [0.1.0.0] - 2019-03-28
+## 0.1.0.0 - 2019-03-28
 
 - Initial release
 
+[0.8.4]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.8.3...hercules-ci-agent-0.8.4
 [0.8.3]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.8.2...hercules-ci-agent-0.8.3
 [0.8.2]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.8.1...hercules-ci-agent-0.8.2
 [0.8.1]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.8.0...hercules-ci-agent-0.8.1
diff --git a/cbits/hercules-logger.hh b/cbits/hercules-logger.hh
--- a/cbits/hercules-logger.hh
+++ b/cbits/hercules-logger.hh
@@ -13,7 +13,7 @@
 #include <string>
 #include <chrono>
 
-class HerculesLogger : public nix::Logger {
+class HerculesLogger final : public nix::Logger {
 
 public:
   struct LogEntry;
diff --git a/cbits/nix-2.4/hercules-store.hh b/cbits/nix-2.4/hercules-store.hh
--- a/cbits/nix-2.4/hercules-store.hh
+++ b/cbits/nix-2.4/hercules-store.hh
@@ -118,7 +118,7 @@
 
 };
 
-class HerculesStore : public WrappingStore {
+class HerculesStore final : public WrappingStore {
 public:
   StorePathSet ensuredPaths;
   void (* builderCallback)(std::vector<nix::StorePathWithOutputs>*, std::exception_ptr *exceptionToThrow);
diff --git a/hercules-ci-agent.cabal b/hercules-ci-agent.cabal
--- a/hercules-ci-agent.cabal
+++ b/hercules-ci-agent.cabal
@@ -1,7 +1,7 @@
 cabal-version: 2.4
 
 name:           hercules-ci-agent
-version:        0.8.3
+version:        0.8.4
 synopsis:       Runs Continuous Integration tasks on your machines
 category:       Nix, CI, Testing, DevOps
 homepage:       https://docs.hercules-ci.com
@@ -37,6 +37,8 @@
   if os(darwin)
     -- avoid https://gitlab.haskell.org/ghc/ghc/issues/11829
     ld-options:  -Wl,-keep_dwarf_unwind
+    -- llvm severe warnings
+    cxx-options: -Werror=abstract-final-class
 
   if impl(ghc >= 8.10)
     ghc-options:
@@ -49,7 +51,13 @@
     if os(darwin)
       ghc-options: -pgmc=clang++
 
+  if flag(nix-2_4)
+    cpp-options:
+        -DNIX_2_4
+    cxx-options:
+        -DNIX_2_4
 
+
 library
   exposed-modules:
       Data.Fixed.Extras
@@ -251,8 +259,6 @@
   cxx-sources:
       cbits/hercules-logger.cxx
   if flag(nix-2_4)
-    cpp-options:
-        -DNIX_2_4
     cxx-sources:
       cbits/nix-2.4/hercules-store.cxx
   else
diff --git a/hercules-ci-agent/Hercules/Agent/Config.hs b/hercules-ci-agent/Hercules/Agent/Config.hs
--- a/hercules-ci-agent/Hercules/Agent/Config.hs
+++ b/hercules-ci-agent/Hercules/Agent/Config.hs
@@ -53,6 +53,7 @@
     workDirectory :: Item purpose 'Required FilePath,
     clusterJoinTokenPath :: Item purpose 'Required FilePath,
     binaryCachesPath :: Item purpose 'Required FilePath,
+    secretsJsonPath :: Item purpose 'Required FilePath,
     logLevel :: Item purpose 'Required Severity,
     labels :: Item purpose 'Required (Map Text A.Value)
   }
@@ -82,6 +83,8 @@
     .= clusterJoinTokenPath
     <*> dioptional (Toml.string "binaryCachesPath")
     .= binaryCachesPath
+    <*> dioptional (Toml.string "secretsJsonPath")
+    .= secretsJsonPath
     <*> dioptional (Toml.enumBounded "logLevel")
     .= logLevel
     <*> dioptional (Toml.tableMap _KeyText embedJson "labels")
@@ -177,6 +180,10 @@
         fromMaybe
           (staticSecretsDir </> "binary-caches.json")
           (binaryCachesPath input)
+      secretsJsonP =
+        fromMaybe
+          (staticSecretsDir </> "secrets.json")
+          (secretsJsonPath input)
       workDir = fromMaybe (baseDir </> "work") (workDirectory input)
   dabu <- determineDefaultApiBaseUrl
   numProc <- getNumProcessors
@@ -200,6 +207,7 @@
         concurrentTasks = validConcurrentTasks,
         baseDirectory = baseDir,
         staticSecretsDirectory = staticSecretsDir,
+        secretsJsonPath = secretsJsonP,
         workDirectory = workDir,
         logLevel = logLevel input & fromMaybe InfoS,
         labels = fromMaybe mempty $ labels input
diff --git a/hercules-ci-agent/Hercules/Agent/Effect.hs b/hercules-ci-agent/Hercules/Agent/Effect.hs
--- a/hercules-ci-agent/Hercules/Agent/Effect.hs
+++ b/hercules-ci-agent/Hercules/Agent/Effect.hs
@@ -20,7 +20,6 @@
 import qualified Hercules.Agent.WorkerProtocol.LogSettings as LogSettings
 import qualified Network.URI
 import Protolude
-import System.FilePath ((</>))
 import qualified System.Posix.Signals as PS
 import System.Process
 
@@ -62,7 +61,7 @@
                     baseURL = toS $ Network.URI.uriToString identity baseURL ""
                   },
               materializeDerivation = materialize,
-              secretsPath = toS $ Config.staticSecretsDirectory config </> "secrets.json",
+              secretsPath = toS $ Config.secretsJsonPath config,
               token = Sensitive (EffectTask.token effectTask),
               apiBaseURL = Config.herculesApiBaseURL config,
               projectId = EffectTask.projectId effectTask,