diff --git a/flake.lock b/flake.lock
index 60aaf00..663e0db 100644
--- a/flake.lock
+++ b/flake.lock
@@ -148,11 +148,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1749794982,
-        "narHash": "sha256-Kh9K4taXbVuaLC0IL+9HcfvxsSUx8dPB5s5weJcc9pc=",
+        "lastModified": 1751792365,
+        "narHash": "sha256-J1kI6oAj25IG4EdVlg2hQz8NZTBNYvIS0l4wpr9KcUo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ee930f9755f58096ac6e8ca94a1887e0534e2d81",
+        "rev": "1fd8bada0b6117e6c7eb54aad5813023eed37ccb",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index dfceea2..23a9555 100644
--- a/flake.nix
+++ b/flake.nix
@@ -45,6 +45,7 @@
             ./host/solo
             ./host
             ./mod
+            ./mod-hm
             overlays
           ];
         };
@@ -58,6 +59,7 @@
             ./host/c2
             ./host
             ./mod
+            ./mod-hm
             overlays
           ];
         };
diff --git a/host/boot.nix b/host/boot.nix
index 037a7cf..66939f6 100644
--- a/host/boot.nix
+++ b/host/boot.nix
@@ -14,7 +14,7 @@
     # builds in /tmp but I think my swap is large enough...
     tmp.useTmpfs = true;
 
-    kernelPackages = pkgs.linuxPackages_6_13;
+    kernelPackages = pkgs.linuxPackages_6_12;
     kernel.sysctl."kernel.sysrq" = 1;
 
     initrd.systemd.network.wait-online.enable = false;
diff --git a/host/c2/default.nix b/host/c2/default.nix
index 3126a01..5eace9e 100644
--- a/host/c2/default.nix
+++ b/host/c2/default.nix
@@ -10,6 +10,7 @@
   ];
 
   boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  boot.resumeDevice = "/dev/disk/by-label/nixswap";
 
   powerManagement = {
     enable = true;
diff --git a/host/roam/default.nix b/host/roam/default.nix
index e370f5f..51eb2de 100644
--- a/host/roam/default.nix
+++ b/host/roam/default.nix
@@ -5,7 +5,6 @@
   imports = [
     ./hardware-configuration.nix
     ./networking.nix
-    ./security.nix
     ./services.nix
   ];
 
diff --git a/mod-hm/default.nix b/mod-hm/default.nix
index 6d748c7..98b24f3 100644
--- a/mod-hm/default.nix
+++ b/mod-hm/default.nix
@@ -1,7 +1,30 @@
-{ ... }:
+# This is a NixOS module, not a home-manager module!
+{
+  lib,
+  inputs,
+  config,
+  options,
+  ...
+}:
 {
   imports = [
-    ./unison.nix
-    ./protonmail-bridge.nix
+    inputs.home-manager.nixosModules.home-manager
   ];
+
+  config = lib.mkIf config.desktop.enable {
+    home-manager.users."hd" = lib.mkAliasDefinitions options.home;
+    # install to /etc/profiles, not ~/.nix-profile
+    home-manager.useUserPackages = true;
+    # dont use home.nixpkgs
+    home-manager.useGlobalPkgs = true;
+
+    home = {
+      imports = [
+        ./unison.nix
+        ./protonmail-bridge.nix
+      ];
+
+      home.stateVersion = config.system.stateVersion;
+    };
+  };
 }
diff --git a/mod/desktop/default.nix b/mod/desktop/default.nix
index b4b01f8..5e9654f 100644
--- a/mod/desktop/default.nix
+++ b/mod/desktop/default.nix
@@ -20,15 +20,6 @@ in
     ./software
     ./window-manager.nix
     inputs.nixos-config-hidden.nixosModules.pc
-    inputs.home-manager.nixosModules.home-manager
-    {
-      home-manager.users."hd" = lib.mkAliasDefinitions options.home;
-      # install to /etc/profiles, not ~/.nix-profile
-      home-manager.useUserPackages = true;
-      # dont use home.nixpkgs
-      home-manager.useGlobalPkgs = true;
-    }
-
   ];
 
   options = {
@@ -67,10 +58,5 @@ in
       ];
 
     programs.nix-ld.enable = true;
-
-    home = {
-      home.stateVersion = config.system.stateVersion;
-      imports = [ ../../mod-hm ];
-    };
   };
 }
diff --git a/mod/desktop/software/default.nix b/mod/desktop/software/default.nix
index 5aaa304..bfd8864 100644
--- a/mod/desktop/software/default.nix
+++ b/mod/desktop/software/default.nix
@@ -26,7 +26,7 @@ in
       signal-desktop
       spotify
       tor-browser
-      vesktop
+      # vesktop
       vlc
       wireguard-tools
       zotero