{
  security = {
    sudo.execWheelOnly = true;
    polkit.enable = true;
    protectKernelImage = true;
  };
  system.autoUpgrade = {
    enable = true;
    flake = "git+https://git.k3t.dev/k3t/nixconf.git";
    operation = "switch";
    runGarbageCollection = true;
    randomizedDelaySec = "2hr";
    allowReboot = true;
    rebootWindow = { lower = "04:00"; upper = "08:00"; };
  };
}