diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index 992ac1a8..ba386d8f 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -13,6 +13,7 @@
     ./gaming
     ./hardware
     ./headless.nix
+    ./kernel
     ./networking
     ./nix.nix
     ./programs
diff --git a/modules/nixos/security/kernel/blacklisted-modules.nix b/modules/nixos/kernel/blacklisted-modules.nix
similarity index 100%
rename from modules/nixos/security/kernel/blacklisted-modules.nix
rename to modules/nixos/kernel/blacklisted-modules.nix
diff --git a/modules/nixos/security/kernel/default.nix b/modules/nixos/kernel/default.nix
similarity index 90%
rename from modules/nixos/security/kernel/default.nix
rename to modules/nixos/kernel/default.nix
index 7953d0dc..353d5076 100644
--- a/modules/nixos/security/kernel/default.nix
+++ b/modules/nixos/kernel/default.nix
@@ -5,6 +5,7 @@
     ./misc.nix
     ./params.nix
     ./sysctl.nix
+    ./sysfs.nix
     # keep-sorted end
   ];
 }
diff --git a/modules/nixos/security/kernel/misc.nix b/modules/nixos/kernel/misc.nix
similarity index 100%
rename from modules/nixos/security/kernel/misc.nix
rename to modules/nixos/kernel/misc.nix
diff --git a/modules/nixos/security/kernel/params.nix b/modules/nixos/kernel/params.nix
similarity index 100%
rename from modules/nixos/security/kernel/params.nix
rename to modules/nixos/kernel/params.nix
diff --git a/modules/nixos/security/kernel/sysctl.nix b/modules/nixos/kernel/sysctl.nix
similarity index 88%
rename from modules/nixos/security/kernel/sysctl.nix
rename to modules/nixos/kernel/sysctl.nix
index ed0a12e4..924bea26 100644
--- a/modules/nixos/security/kernel/sysctl.nix
+++ b/modules/nixos/kernel/sysctl.nix
@@ -1,16 +1,16 @@
+# you can find out whats recommended for you, by following these steps
+# > sudo sysctl -a > sysctl.txt
+# > kernel-hardening-checker -l /proc/cmdline -c /proc/config.gz -s ./sysctl.txt
+#
+# better read up
+# https://docs.kernel.org/admin-guide/sysctl/vm.html
+#
+# a good place to quickly find what each setting does
+# https://sysctl-explorer.net/
+#
+# we disable sysctl tweaks on wsl since they don't work
 { lib, options, ... }:
 {
-  # you can find out whats recommended for you, by following these steps
-  # > sudo sysctl -a > sysctl.txt
-  # > kernel-hardening-checker -l /proc/cmdline -c /proc/config.gz -s ./sysctl.txt
-  #
-  # better read up
-  # https://docs.kernel.org/admin-guide/sysctl/vm.html
-  #
-  # a good place to quickly find what each setting does
-  # https://sysctl-explorer.net/
-  #
-  # we disable sysctl tweaks on wsl since they don't work
   boot.kernel.sysctl = lib.mkIf (!(options ? "wsl")) {
     # The Magic SysRq key is a key combo that allows users connected to the
     # system console of a Linux kernel to perform some low-level commands.
diff --git a/modules/nixos/kernel/sysfs.nix b/modules/nixos/kernel/sysfs.nix
new file mode 100644
index 00000000..004198bf
--- /dev/null
+++ b/modules/nixos/kernel/sysfs.nix
@@ -0,0 +1,9 @@
+{
+  boot.kernel.sysfs = {
+    kernel.mm.transparent_hugepage = {
+      enabled = "always";
+      defrag = "defer";
+      shmem_enabled = "within_size";
+    };
+  };
+}
diff --git a/modules/nixos/nix.nix b/modules/nixos/nix.nix
index 9d7a9598..ebaf1485 100644
--- a/modules/nixos/nix.nix
+++ b/modules/nixos/nix.nix
@@ -18,7 +18,7 @@
       # the defaults to false even if the experimental feature is enabled
       # so we need to enable it here, this is also only available on linux
       # and the option is explicitly removed on darwin so we have to have this here
-      use-cgroups = false;
+      use-cgroups = true;
 
       # set the build dir to /var/tmp to avoid issues on tmpfs
       # https://github.com/NixOS/nixpkgs/issues/293114#issuecomment-2663470083
diff --git a/modules/nixos/security/default.nix b/modules/nixos/security/default.nix
index 130eb52b..0a47cecb 100644
--- a/modules/nixos/security/default.nix
+++ b/modules/nixos/security/default.nix
@@ -5,7 +5,6 @@
     # keep-sorted start
     ./apparmor.nix # apparmor
     ./auditd.nix # auditd
-    ./kernel # kernel hardening
     ./login-defs.nix # login.defs configuration
     ./pam.nix # pam configuration
     ./polkit.nix # polkit configuration