diff --git a/modules/home/ai-agent/default.nix b/modules/home/ai-agent/default.nix
index 94ec1ef..cd500a1 100644
--- a/modules/home/ai-agent/default.nix
+++ b/modules/home/ai-agent/default.nix
@@ -30,6 +30,11 @@ let
 
   claudeSettings = {
     effortLevel = "medium";
+    verbose = false;
+    env = {
+      DISABLE_AUTOUPDATER = "1";
+      DISABLE_UPDATES = "1";
+    };
     hooks = {
       SessionStart = [
         {
@@ -84,7 +89,7 @@ in
       recursive = true;
     };
 
-    home.file.".claude/settings.json" = lib.mkIf (config.ai-agent.agent == "claude-code") {
+    home.file.".claude/settings.json" = {
       text = builtins.toJSON claudeSettings;
     };
 
diff --git a/modules/home/niri/default.nix b/modules/home/niri/default.nix
index 1f64c0f..fba1aad 100644
--- a/modules/home/niri/default.nix
+++ b/modules/home/niri/default.nix
@@ -55,6 +55,9 @@ in
 
     programs.noctalia = {
       enable = true;
+      package = inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default.overrideAttrs (old: {
+        patches = (old.patches or [ ]) ++ [ ./resolve-pam-user-before-fork.patch ];
+      });
       systemd.enable = true;
       settings = { };
     };
diff --git a/modules/home/niri/resolve-pam-user-before-fork.patch b/modules/home/niri/resolve-pam-user-before-fork.patch
new file mode 100644
index 0000000..69c4ebe
--- /dev/null
+++ b/modules/home/niri/resolve-pam-user-before-fork.patch
@@ -0,0 +1,39 @@
+diff --git a/src/auth/pam_authenticator.cpp b/src/auth/pam_authenticator.cpp
+index a44f333..57fb998 100644
+--- a/src/auth/pam_authenticator.cpp
++++ b/src/auth/pam_authenticator.cpp
+@@ -175,11 +175,8 @@ namespace {
+     return true;
+   }
+ 
+-  [[nodiscard]] PamAuthenticator::Result authenticateDirect(std::string_view password, std::string_view service) {
+-    std::string user = PamAuthenticator::currentUsername();
+-    if (user.empty()) {
+-      return PamAuthenticator::Result{.success = false, .message = i18n::tr("auth.pam.user-unavailable")};
+-    }
++  [[nodiscard]] PamAuthenticator::Result
++  authenticateDirect(std::string_view password, std::string_view service, const std::string& user) {
+     if (service.empty()) {
+       service = "login";
+     }
+@@ -233,6 +230,11 @@ namespace {
+ 
+ PamAuthenticator::Result
+ PamAuthenticator::authenticateCurrentUser(std::string_view password, std::string_view service) const {
++  const std::string user = currentUsername();
++  if (user.empty()) {
++    return Result{.success = false, .message = i18n::tr("auth.pam.user-unavailable")};
++  }
++
+   int pipeFds[2] = {-1, -1};
+   if (::pipe2(pipeFds, O_CLOEXEC) != 0) {
+     return Result{.success = false, .message = i18n::tr("auth.pam.start-failed")};
+@@ -253,7 +255,7 @@ PamAuthenticator::authenticateCurrentUser(std::string_view password, std::string
+ 
+   if (pid == 0) {
+     ::close(pipeFds[0]);
+-    const Result result = authenticateDirect(passwordCopy, serviceCopy);
++    const Result result = authenticateDirect(passwordCopy, serviceCopy, user);
+     secureClear(passwordCopy);
+     if (!writeResult(pipeFds[1], result)) {
+       ::close(pipeFds[1]);