diff --git a/systems/bavette/configuration.nix b/systems/bavette/configuration.nix
index 48aa98f..4a6b31f 100644
--- a/systems/bavette/configuration.nix
+++ b/systems/bavette/configuration.nix
@@ -11,28 +11,7 @@
       device = "lenovo-wormdingler";
     })
     ../desktop.nix
-  ];
-
-  nixpkgs.overlays = [
-    (final: prev: {
-      # FIXME: wtf
-      # > ======================================================================
-      # > FAIL: test_how_to_type (__main__.TestXkbcli.test_how_to_type) (args=['--verbose', '1'])
-      # > ----------------------------------------------------------------------
-      # > Traceback (most recent call last):
-      # >   File "/build/source/test/tool-option-parsing.py", line 583, in test_how_to_type
-      # >     assert len(lines) >= 1
-      # >            ^^^^^^^^^^^^^^^
-      # > AssertionError
-      # >
-      # > ----------------------------------------------------------------------
-      # > Ran 20 tests in 52.199s
-      # >
-      # > FAILED (failures=13, skipped=95)
-      libxkbcommon = prev.libxkbcommon.overrideAttrs {
-        doCheck = false;
-      };
-    })
+    ../../users
   ];
 
   # TODO: is this truly necessary?
@@ -48,28 +27,10 @@
     chromeos-sc7180-unredistributable-firmware
   ];
 
-  services.desktopManager.gnome.enable = true;
-
   users.users.leah = {
     enable = true;
-    isNormalUser = true;
-    description = "Leah C";
-    extraGroups = [
-      "wheel" # 1984 powers
-    ];
-    home = "/home/leah";
-
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINcpWY17MNJBx56APRSvLOfUjHllXn9gY/cV51JaLoh6"
-    ];
+    presets.niri.enable = false;
   };
 
-  services.openssh = {
-    enable = true;
-    settings.PermitRootLogin = "prohibit-password";
-  };
-
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKbsavGX9rGRx5R+7ovLn+r7D/w3zkbqCik4bS31moSz"
-  ];
+  services.desktopManager.gnome.enable = true;
 }
diff --git a/systems/common.nix b/systems/common.nix
index 6912126..dbd4b54 100644
--- a/systems/common.nix
+++ b/systems/common.nix
@@ -2,7 +2,6 @@
 {
   config,
   inputs,
-  pkgs,
   ...
 }:
 {
@@ -36,22 +35,6 @@
       ];
       trusted-users = [ "@wheel" ];
     };
-
-    # distributedBuilds = true;
-
-    # buildMachines = [
-    #   {
-    #     hostName = "aarch64-build-box";
-    #     sshUser = "pluiedev";
-    #     sshKey = "/root/.ssh/remotebuild";
-    #     system = "aarch64-linux";
-    #     supportedFeatures = [
-    #       "nixos-test"
-    #       "big-parallel"
-    #       "kvm"
-    #     ];
-    #   }
-    # ];
   };
 
   nixpkgs = {
@@ -91,5 +74,39 @@
     algorithm = "zstd";
   };
 
+  # SSH access
+  services.openssh = {
+    enable = true;
+    ports = [
+      22
+      42069
+    ];
+    settings.PermitRootLogin = "prohibit-password";
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKbsavGX9rGRx5R+7ovLn+r7D/w3zkbqCik4bS31moSz"
+  ];
+
+  networking = {
+    # Allow Tailscale users to connect to port 22 directly
+    firewall = {
+      allowedTCPPorts = [ 42069 ];
+      extraInputRules = ''
+        iifname "tailscale0" tcp dport 22 accept
+      '';
+    };
+    nftables.enable = true;
+  };
+
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    extraLocales = [
+      "zh_CN.UTF-8/UTF-8"
+      "de_DE.UTF-8/UTF-8"
+    ];
+    extraLocaleSettings.LC_TIME = "de_DE.UTF-8";
+  };
+
   system.configurationRevision = inputs.self.rev or inputs.self.dirtyRev or "unknown-dirty";
 }
diff --git a/systems/focaccia/configuration.nix b/systems/focaccia/configuration.nix
index 1e69475..6183dcd 100644
--- a/systems/focaccia/configuration.nix
+++ b/systems/focaccia/configuration.nix
@@ -32,12 +32,7 @@
       allowedUDPPorts = [
         443
       ];
-      # Allow Tailscale users to connect to port 22 directly
-      extraInputRules = ''
-        iifname "tailscale0" tcp dport 22 accept
-      '';
     };
-    nftables.enable = true;
   };
 
   users.users.leah = {
diff --git a/systems/laptop.nix b/systems/laptop.nix
index 919f5cb..2a7ca1f 100644
--- a/systems/laptop.nix
+++ b/systems/laptop.nix
@@ -44,6 +44,9 @@
   # instead of power-profile-daemon's rigid profiles
   services.tlp.enable = true;
 
+  # Firmware updates
+  services.fwupd.enable = true;
+
   # Allow GPU usage monitoring utilities like `intel_gpu_top`
   # to function without superuser access
   boot.kernel.sysctl."kernel.perf_event_paranoid" = 0;
diff --git a/systems/pappardelle/configuration.nix b/systems/pappardelle/configuration.nix
index c4001ac..f0a2d52 100644
--- a/systems/pappardelle/configuration.nix
+++ b/systems/pappardelle/configuration.nix
@@ -11,8 +11,13 @@
 
   hardware.bluetooth.enable = true;
   networking.hostName = "pappardelle";
-  users.users.leah.enable = true;
+
+  users.users.leah = {
+    enable = true;
+    presets.niri = {
+      enable = true;
+    };
+  };
 
   boot.kernelParams = [ "intel_idle.max_cstate=9" ];
-  services.fwupd.enable = true;
 }
diff --git a/users/leah/default.nix b/users/leah/default.nix
index 7a9cbec..f0d7f5f 100644
--- a/users/leah/default.nix
+++ b/users/leah/default.nix
@@ -7,7 +7,6 @@
   imports = [
     ../common.nix
     ./appearance.nix
-    # ./presets/plasma
     ./presets/niri
     ./programs
   ];
@@ -29,14 +28,5 @@
   };
 
   # Name and directory should be populated by users.users
-  hjem.users.leah.enable = true;
-
-  i18n = {
-    defaultLocale = "en_US.UTF-8";
-    extraLocales = [
-      "zh_CN.UTF-8/UTF-8"
-      "de_DE.UTF-8/UTF-8"
-    ];
-    extraLocaleSettings.LC_TIME = "de_DE.UTF-8";
-  };
+  hjem.users.leah.enable = config.users.users.leah.enable;
 }
diff --git a/users/leah/presets/niri/default.nix b/users/leah/presets/niri/default.nix
index 7e5801b..1f28175 100644
--- a/users/leah/presets/niri/default.nix
+++ b/users/leah/presets/niri/default.nix
@@ -1,5 +1,7 @@
 {
   pkgs,
+  lib,
+  config,
   ...
 }:
 {
@@ -11,78 +13,84 @@
     ./swayosd
   ];
 
-  programs.niri.enable = true;
+  config.users.users.leah.presets.niri = {
+    enable = lib.mkEnableOption "the Niri preset";
+  };
+
+  options = lib.mkIf config.users.users.leah.presets.niri {
+    programs.niri.enable = true;
 
-  services.gnome.gnome-keyring.enable = true;
-  security.pam.services.login.enableGnomeKeyring = true;
+    services.gnome.gnome-keyring.enable = true;
+    security.pam.services.login.enableGnomeKeyring = true;
 
-  hjem.users.leah = {
-    packages = with pkgs; [
-      networkmanagerapplet
-      xwayland-satellite
-      brightnessctl
-      wleave
+    hjem.users.leah = {
+      packages = with pkgs; [
+        networkmanagerapplet
+        xwayland-satellite
+        brightnessctl
+        wleave
 
-      # Desktop utilities
-      file-roller
-      loupe
-      gnome-logs
-      resources
-      # I'm using Nautilus here because it a) looks nice
-      # and b) avoids configuring XDP GNOME to use a XDP GTK's file chooser
-      nautilus
-    ];
+        # Desktop utilities
+        file-roller
+        loupe
+        gnome-logs
+        resources
+        # I'm using Nautilus here because it a) looks nice
+        # and b) avoids configuring XDP GNOME to use a XDP GTK's file chooser
+        nautilus
+      ];
 
-    xdg.config.files."niri/config.kdl".source = ./config.kdl;
+      xdg.config.files."niri/config.kdl".source = ./config.kdl;
 
-    ext.programs.swaylock = {
-      enable = true;
-      package = pkgs.swaylock-effects;
+      ext.programs.swaylock = {
+        enable = true;
+        package = pkgs.swaylock-effects;
 
-      settings = {
-        show-failed-attempts = true;
-        ignore-empty-password = true;
-        daemonize = true;
+        settings = {
+          show-failed-attempts = true;
+          ignore-empty-password = true;
+          daemonize = true;
 
-        screenshots = true;
-        scaling = "fit";
-        clock = true;
-        indicator-idle-visible = true;
-        grace = 3;
-        effect-blur = "10x10";
-        effect-vignette = "0.5:0.8";
-        effect-pixelate = 4;
+          screenshots = true;
+          scaling = "fit";
+          clock = true;
+          indicator-idle-visible = true;
+          grace = 3;
+          effect-blur = "10x10";
+          effect-vignette = "0.5:0.8";
+          effect-pixelate = 4;
 
-        text-color = "#cdd6f4";
-        inside-color = "#181825";
-        inside-clear-color = "#a6e3a1";
-        inside-ver-color = "#cba6f7";
-        inside-wrong-color = "#f38ba8";
-        ring-color = "#1e1e2e";
-        ring-clear-color = "#a6e3a1";
-        ring-ver-color = "#cba6f7";
-        ring-wrong-color = "#f38ba8";
-        key-hl-color = "#eba0ac";
-        bs-hl-color = "#6c7086";
-        line-color = "#313244";
+          text-color = "#cdd6f4";
+          inside-color = "#181825";
+          inside-clear-color = "#a6e3a1";
+          inside-ver-color = "#cba6f7";
+          inside-wrong-color = "#f38ba8";
+          ring-color = "#1e1e2e";
+          ring-clear-color = "#a6e3a1";
+          ring-ver-color = "#cba6f7";
+          ring-wrong-color = "#f38ba8";
+          key-hl-color = "#eba0ac";
+          bs-hl-color = "#6c7086";
+          line-color = "#313244";
 
-        timestr = "%H:%M";
-        datestr = "%e %b '%y / %a";
+          timestr = "%H:%M";
+          datestr = "%e %b '%y / %a";
+        };
       };
-    };
 
-    ext.programs.vicinae = {
-      enable = true;
-      settings = {
-        closeOnFocusLoss = false;
-        considerPreedit = true;
-        font.size = 12;
-        keybinding = "default";
-        popToRootOnClose = true;
-        window = {
-          csd = true;
-          opacity = 0.85;
-          rounding = 16;
+      ext.programs.vicinae = {
+        enable = true;
+        settings = {
+          closeOnFocusLoss = false;
+          considerPreedit = true;
+          font.size = 12;
+          keybinding = "default";
+          popToRootOnClose = true;
+          window = {
+            csd = true;
+            opacity = 0.85;
+            rounding = 16;
+          };
         };
       };
     };