diff --git a/.nvim.lua b/.nvim.lua
index 0a568b72..4f071266 100644
--- a/.nvim.lua
+++ b/.nvim.lua
@@ -23,8 +23,8 @@ nvim_lsp.nixd.setup({
           expr = "(builtins.getFlake (builtins.toString ./.)).currentSystem.options",
         },
         my_modules = {
-          exper = "(pkgs.lib.evalModules { modules = (builtins.getFlake (builtins.toString ./.)).nixosModules; }).options"
-        }
+          exper = "(pkgs.lib.evalModules { modules = (builtins.getFlake (builtins.toString ./.)).nixosModules; }).options",
+        },
       },
     },
   },
diff --git a/homeModules/profiles/desktop/default.nix b/homeModules/profiles/desktop/default.nix
index 0da0cd14..9a8ce204 100644
--- a/homeModules/profiles/desktop/default.nix
+++ b/homeModules/profiles/desktop/default.nix
@@ -8,6 +8,17 @@ let
   cfg = config.py.profiles.desktop;
   inherit (cfg) shell;
   inherit (lib) mkIf mkDefault mkEnableOption;
+
+  mkShellOption =
+    name: var:
+    lib.mkOption {
+      type = lib.types.bool;
+      default = if (shell == var) then true else false;
+      description = "Enable ${name}";
+      readOnly = true;
+      visible = false;
+      internal = true;
+    };
 in
 {
   options.py.profiles.desktop = {
@@ -20,16 +31,8 @@ in
       default = "caelestia";
       description = "The desktop shell to use in the graphical environment";
     };
-    caelestia = lib.mkOption {
-      type = lib.types.bool;
-      default = if (shell == "caelestia") then true else false;
-      description = "Enable caelestia shell";
-    };
-    dms = lib.mkOption {
-      type = lib.types.bool;
-      default = if (shell == "dms") then true else false;
-      description = "Enable DMS";
-    };
+    caelestia = mkShellOption "Caelestia shell" "caelestia";
+    dms = mkShellOption "DMS" "dms";
   };
   config = mkIf cfg.enable {
     py.profiles.base.enable = true;
diff --git a/homeModules/programs/default.nix b/homeModules/programs/default.nix
index e0da44ea..abac6fd0 100644
--- a/homeModules/programs/default.nix
+++ b/homeModules/programs/default.nix
@@ -1,5 +1,6 @@
 {
   imports = [
+    # keep-sorted start
     ./caelestia
     ./chromium
     ./dms
@@ -17,5 +18,6 @@
     ./starship
     ./vscodium
     ./zed-editor
+    # keep-sorted end
   ];
 }
diff --git a/hosts/zaphod/services/greeter.nix b/hosts/zaphod/services/greeter.nix
index fd714263..2c80e8da 100644
--- a/hosts/zaphod/services/greeter.nix
+++ b/hosts/zaphod/services/greeter.nix
@@ -7,5 +7,4 @@
       hide_version_string = true;
     };
   };
-  security.pam.services.ly.fprintAuth = false;
 }
diff --git a/nixosModules/dn42Wireguard/default.nix b/nixosModules/dn42Wireguard/default.nix
index d86108ec..8f8d082b 100644
--- a/nixosModules/dn42Wireguard/default.nix
+++ b/nixosModules/dn42Wireguard/default.nix
@@ -87,7 +87,7 @@ in
         # so tunnel config overrides defaults
         fc = cfg.tunnelDefaults // (lib.filterAttrs (_: v: v != null) value);
       in
-      (lib.nameValuePair "wg42_${name}" {
+      lib.nameValuePair "wg42_${name}" {
         inherit (fc) listenPort privateKeyFile;
         allowedIPsAsRoutes = false;
         peers = [
@@ -110,12 +110,10 @@ in
             fc.peerAddrs.v6 != null && fc.localAddrs.v6 != null
           ) "${pkgs.iproute2}/bin/ip addr add ${fc.localAddrs.v6} peer ${fc.peerAddrs.v6} dev wg42_${name}"}
         '';
-      })
-    ) (lib.filterAttrs (_: v: v.enable == true) cfg.tunnels);
+      }
+    ) (lib.filterAttrs (_: v: v.enable) cfg.tunnels);
     firewall = {
-      trustedInterfaces = lib.mapAttrsToList (name: _: "wg42_" + name) (
-        lib.filterAttrs (_: v: v.enable == true) cfg.tunnels
-      );
+      trustedInterfaces = lib.mapAttrsToList (name: _: "wg42_" + name) (lib.filterAttrs (_: v: v.enable) cfg.tunnels);
       checkReversePath = false;
       extraInputRules = ''
         ip saddr 172.20.0.0/14 accept