diff --git a/ops/nixos/lib/common.nix b/ops/nixos/lib/common.nix
index 2297ddb513..554c42fff1 100644
--- a/ops/nixos/lib/common.nix
+++ b/ops/nixos/lib/common.nix
@@ -47,6 +47,10 @@ in
       allowPing = true;
     };
 
+    environment.homeBinInPath = true;
+    security.doas.wheelNeedsPassword = false;
+    security.sudo.wheelNeedsPassword = false;
+
     users.mutableUsers = false;
     users.users = let secrets = depot.ops.secrets; in {
       root.hashedPassword = secrets.passwordHashes.root;
diff --git a/ops/nixos/lib/graphical-client.nix b/ops/nixos/lib/graphical-client.nix
index 1f0fdb2c1f..e7e2728b91 100644
--- a/ops/nixos/lib/graphical-client.nix
+++ b/ops/nixos/lib/graphical-client.nix
@@ -22,17 +22,5 @@ in
 
     sound.enable = true;
     hardware.pulseaudio.enable = true;
-
-    users.users.lukegb.packages = mkBefore (with pkgs; [
-      chromium
-      dino
-      lutris
-      pavucontrol
-      rxvt_unicode
-      teamspeak_client
-      virtmanager
-      xclip
-      yubioath-desktop
-    ]);
   };
 }
diff --git a/ops/nixos/lib/home-manager/graphical-client.nix b/ops/nixos/lib/home-manager/graphical-client.nix
index cf92eaacc6..6caab9bca2 100644
--- a/ops/nixos/lib/home-manager/graphical-client.nix
+++ b/ops/nixos/lib/home-manager/graphical-client.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, lib, config, ... }:
 {
   imports = [ ./client.nix ];
 
@@ -12,4 +12,43 @@
     enable = true;
     platformTheme = "gtk";
   };
+
+  home.packages = lib.mkAfter (with pkgs; [
+    chromium
+    dino
+    lutris
+    pavucontrol
+    pngquant
+    rxvt_unicode
+    teamspeak_client
+    virtmanager
+    xclip
+    xss-lock
+    yubioath-desktop
+  ]);
+
+  home.file."bin/screencap" = {
+    executable = true;
+    text = ''
+      #!/usr/bin/env bash
+      set -euxo pipefail
+      import png:/dev/stdout | pngquant - | xclip -t image/png -selection clipboard -in
+    '';
+  };
+
+  xsession.windowManager.i3 = {
+    enable = true;
+    config = {
+      modifier = "Mod4";
+      keybindings = let
+        modifier = config.xsession.windowManager.i3.config.modifier;
+      in lib.mkOptionDefault {
+        "${modifier}+l" = "exec loginctl lock-session";
+        "${modifier}+p" = "exec screencap";
+      };
+      startup = [
+        { command = "xss-lock --transfer-sleep-lock -- i3lock --nofork"; notification = false; }
+      ];
+    };
+  };
 }
diff --git a/ops/nixos/porcorosso/default.nix b/ops/nixos/porcorosso/default.nix
index 729053f963..cee3bb62df 100644
--- a/ops/nixos/porcorosso/default.nix
+++ b/ops/nixos/porcorosso/default.nix
@@ -163,6 +163,8 @@ in {
       iw
       vulkan-tools
     ]);
+
+    xdg.configFile."pulse/default.pa".source = ./default.pa;
   };
 
   # github.com/target/lorri
diff --git a/ops/nixos/porcorosso/default.pa b/ops/nixos/porcorosso/default.pa
new file mode 100644
index 0000000000..4a43959519
--- /dev/null
+++ b/ops/nixos/porcorosso/default.pa
@@ -0,0 +1,19 @@
+.include /etc/pulse/default.pa
+
+.nofail
+
+# Configure my standard USB headphones.
+set-default-sink alsa_output.usb-SteelSeries_Arctis_Pro_Wireless-00.analog-stereo
+set-default-source alsa_input.usb-SteelSeries_Arctis_Pro_Wireless-00.analog-mono
+
+# Webcam
+set-card-profile alsa_card.usb-Microsoft_Microsoft___LifeCam_HD-3000-02 off
+
+# HDA NVIDIA / TU104 HD Audio Controller
+set-card-profile alsa_card.pci-0000_01_00.1 off
+
+# WD19 Dell Dock
+set-card-profile alsa_card.usb-Generic_USB_Audio_200901010001-00 off
+
+# HDA Intel PCH / Cannon Lake PCH cAVS
+set-card-profile alsa_card.pci-0000_00_1f.3 off