diff --git a/hosts/lala/crowdsec.nix b/hosts/lala/crowdsec.nix
index 4beb4a6..ededc7a 100644
--- a/hosts/lala/crowdsec.nix
+++ b/hosts/lala/crowdsec.nix
@@ -22,6 +22,13 @@ in
       ${config.sops.placeholder."lala/netbird/crowdsecLAPI"}
     '';
   };
+
+  systemd.services.crowdsec-update-hub.serviceConfig = {
+    # https://github.com/NixOS/nixpkgs/issues/473707
+    # https://serverfault.com/questions/1197547/systemd-let-service-a-reload-service-b-after-finishing/1197553#1197553
+    ExecStartPost = lib.mkForce "+systemctl restart crowdsec.service";
+  };
+
   services.crowdsec = {
     enable = true;
     autoUpdateService = true;
diff --git a/hosts/lala/netbird.nix b/hosts/lala/netbird.nix
index 1c1f3de..a906383 100644
--- a/hosts/lala/netbird.nix
+++ b/hosts/lala/netbird.nix
@@ -132,6 +132,7 @@ in
         DataStoreEncryptionKey._secret = config.sops.secrets."lala/netbird/dataStoreKey".path;
         EmbeddedIdP = {
           Enabled = true;
+          LocalAuthDisabled = true;
           DataDir = "${stateDir}/idp";
           Issuer = "${netbirdUrl}/oauth2";
           DashboardRedirectURIs = [