diff --git a/common/home.nix b/common/home.nix
index 44fd2b3..9b2c1fc 100644
--- a/common/home.nix
+++ b/common/home.nix
@@ -14,11 +14,16 @@
     vscode
     steam
     bitwarden-desktop
+    signal-desktop
     nixd
     treefmt 
     tealdeer
   ];
 
+  home.sessionVariables = {
+    SSH_AUTH_SOCK = "/home/strix/.bitwarden-ssh-agent.sock";
+  };
+
   programs.git = {
     enable = true;
     settings = {
diff --git a/common/profile.png b/common/profile.png
new file mode 100644
index 0000000..eaa80e8
Binary files /dev/null and b/common/profile.png differ
diff --git a/common/users.nix b/common/users.nix
index 98bdabd..b1d27a0 100644
--- a/common/users.nix
+++ b/common/users.nix
@@ -1,7 +1,19 @@
 { home-manager, inputs, filter, ... }:
 {
+  imports = [
+    ../util/profile-icons.nix
+    home-manager.nixosModules.home-manager
+    {
+      home-manager.useGlobalPkgs = true;
+      home-manager.useUserPackages = true;
+      home-manager.extraSpecialArgs = { inherit inputs filter; };
+      home-manager.users.strix = ./home.nix;
+    }
+  ];
+  
   users.users."strix" = {
     isNormalUser = true;
+    icon = "${./common/profile.png}";
     description = "Strix";
     initialPassword = "changeme";
     extraGroups = [
@@ -14,13 +26,4 @@
     ];
   };
   
-  imports = [
-    home-manager.nixosModules.home-manager
-    {
-      home-manager.useGlobalPkgs = true;
-      home-manager.useUserPackages = true;
-      home-manager.extraSpecialArgs = { inherit inputs filter; };
-      home-manager.users.strix = ./home.nix;
-    }
-  ];
 }
diff --git a/devices/p14s/default.nix b/devices/p14s/default.nix
index efb73c5..95761c1 100644
--- a/devices/p14s/default.nix
+++ b/devices/p14s/default.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ pkgs, lib, ... }:
 {
   imports = [
     ../../common
@@ -7,21 +7,32 @@
 
   networking.hostName = "p14s";
   
-  boot.initrd.luks.devices."luks-d51bdb99-5966-40d3-a920-83ea78a73699".device = "/dev/disk/by-uuid/d51bdb99-5966-40d3-a920-83ea78a73699";
+  # secure boot shit
+  environment.systemPackages = [ pkgs.sbctl ];
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.lanzaboote = {
+    enable = true;
+    pkiBundle = "/var/lib/sbctl";
+  }; 
+
+  # swap & hibernate
+  boot.initrd.luks.devices."luks-d51bdb99-5966-40d3-a920-83ea78a73699" = {
+    device = "/dev/disk/by-uuid/d51bdb99-5966-40d3-a920-83ea78a73699";
+    crypttabExtraOpts = [ "tpm2-device=auto" ];
+  };
+  boot.kernelParams = [ "resume=/dev/disk/by-uuid/d51bdb99-5966-40d3-a920-83ea78a73699" ];
   
+  # vm definition
   virtualisation.vmVariant = {
     virtualisation = {
       memorySize = 8192;
       cores = 6;
     };
+    
+    environment.systemPackages = with pkgs; [
+      spice-vdagentd
+    ];
   };
 
-  users.users."guest" = {
-    isNormalUser = true;
-    name = "Guest";
-    initialPassword = "guest";
-    createHome = true;
-  };
-  
   system.stateVersion = "26.05"; # yes
 }
\ No newline at end of file
diff --git a/flake.lock b/flake.lock
index 8dae603..186b670 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,58 @@
 {
   "nodes": {
+    "crane": {
+      "locked": {
+        "lastModified": 1781825982,
+        "narHash": "sha256-SlXKwIRIhrOSAcTjCB3ftPLzJWZStQIPS7J1FlZPnKk=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "469fd08d0bcf6926321fa973c6777fbc87785dd7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -20,6 +73,30 @@
         "type": "github"
       }
     },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit": "pre-commit",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1782141370,
+        "narHash": "sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v1.1.0",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1787360063,
@@ -36,11 +113,56 @@
         "type": "github"
       }
     },
+    "pre-commit": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781733627,
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
+        "lanzaboote": "lanzaboote",
         "nixpkgs": "nixpkgs"
       }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1782012058,
+        "narHash": "sha256-9mWUnReOUXfKjZuJAL/bAFH3LUyECTRtXgSNVjRw3UY=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "8534567325bd8a8d2928e6afd81e0a87d19efd3c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 8859a34..fea3874 100644
--- a/flake.nix
+++ b/flake.nix
@@ -7,6 +7,11 @@
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
   };
 
+  inputs.lanzaboote = {
+    url = "github:nix-community/lanzaboote/v1.1.0";
+    inputs.nixpkgs.follows = "nixpkgs";
+  };
+
   outputs = inputs@{ self, nixpkgs, home-manager, ... }: 
   let 
     filter = with nixpkgs.lib;
@@ -23,6 +28,7 @@
   {
     nixosConfigurations.p14s = nixosConfig {
       modules = [ 
+        inputs.lanzaboote.nixosModules.lanzaboote
         ./devices/p14s
         ./styles/desktop.nix
       ];
diff --git a/styles/desktop.nix b/styles/desktop.nix
index 62429b0..dd27ead 100644
--- a/styles/desktop.nix
+++ b/styles/desktop.nix
@@ -1,9 +1,10 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 {
   imports = [ ];
 
   boot.loader.systemd-boot.enable = true;
+  boot.loader.timeout = 0;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.kernelPackages = pkgs.linuxPackages_latest;
 
@@ -11,15 +12,29 @@
   boot.initrd.verbose = false;
   boot.kernelParams = [
     "quiet"
+    "udev.log_priority=3"
     "rd.udev.log_level=3"
     "rd.systemd.show_status=auto"
   ];
+  boot.initrd.checkJournalingFS = false;
+  
 
   boot.plymouth = {
     enable = true;
     theme = "bgrt";
+    package = pkgs.plymouth.overrideAttrs (old: {
+    postInstall = (old.postInstall or "") + ''
+      sed -i \
+        -e 's/DialogClearsFirmwareBackground=true/DialogClearsFirmwareBackground=false/' \
+        -e 's/DialogVerticalAlignment=.382/DialogVerticalAlignment=.55/' \
+        -e 's/TitleVerticalAlignment=.382/TitleVerticalAlignment=.55/' \
+        $out/share/plymouth/themes/bgrt/bgrt.plymouth
+    '';
+  });
   };
 
+
+
   networking.networkmanager.enable = true;
 
   time.timeZone = "Europe/Amsterdam";
@@ -66,8 +81,6 @@
   programs.virt-manager.enable = true;
   virtualisation.libvirtd.enable = true;
 
-  programs.command-not-found.enable = true;
-
   nix = {
     settings = {
       auto-optimise-store = true;
@@ -80,6 +93,7 @@
 
   environment.systemPackages = with pkgs; [
     neovim
+    htop
     dnsmasq
   ];
   
diff --git a/styles/server.nix b/styles/server.nix
index 545b892..ba46d7f 100644
--- a/styles/server.nix
+++ b/styles/server.nix
@@ -39,7 +39,6 @@
   };
 
   nixpkgs.config.allowUnfree = true;
-  programs.command-not-found.enable = true;
 
   nix = {
     settings = {
diff --git a/util/profile-icons.nix b/util/profile-icons.nix
new file mode 100644
index 0000000..620c634
--- /dev/null
+++ b/util/profile-icons.nix
@@ -0,0 +1,33 @@
+{ lib, config, ...}:
+
+let
+  userOptions = with lib; {
+    options.icon = mkOption { type = types.nullOr types.path; default = null; };
+  };
+
+  mkGdmUserConf = icon: ''
+    [User]
+    Session=
+    XSession=
+    Icon=${icon}
+    SystemAccount=false
+  '';
+
+  userList = with lib; filter (entry: entry.icon != null) (mapAttrsToList (name: value: { inherit name; icon = value.icon; }) config.users.users);
+
+  mkBootCommand = entry: "echo -e '${mkGdmUserConf entry.icon}' > /var/lib/AccountsService/users/${entry.name}\n";
+
+  bootCommands = map mkBootCommand userList;
+in
+
+{
+  options = {
+    users.users = with lib; with types; mkOption {
+      type = attrsOf (submodule userOptions);
+    };
+  };
+
+  config = lib.mkIf config.services.xserver.displayManager.gdm.enable {
+    boot.postBootCommands = with lib; strings.concatStrings bootCommands;
+  };
+}
\ No newline at end of file