{
  security = {
    sudo.execWheelOnly = true;
    polkit.enable = true;
    protectKernelImage = true;
  };
  system.autoUpgrade = {
    enable = true;
    flake = "git+https://k3t.dev/git/nixconf.git?ref=main";
    operation = "boot";
    allowReboot = true;
    rebootWindow = { lower = "10:00"; upper = "14:00"; };
  };
}