diff --git a/.sops.yaml b/.sops.yaml
index 124d41a..05d064c 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -9,3 +9,4 @@ creation_rules:
       - "age1x3lahhkefkap67cdmdjcqaxan9hp62er78akr79v9m73nvgugpeqk0y32a" # laptop-user-doloro
       - "age1exzngtk4d9vcsmcq6ap5xx3ca9qacqjkrv86ymged7msx9z6vfyqsf5sjq" # laptop-system
       - "age1fw4xnh2q52juce94ffn54js708cr6umfwpv0mykuddkea7kr4f0q7a9h05" # rpi5
+      - "age1kc0xu0ue2nrrr7w4gam7wlzackv8jv243rxwwndgxjqklgtnp5csdtpgzp" # laptop-surface-system
diff --git a/config/hosts/aspects/doloro-laptop/host.nix b/config/hosts/aspects/doloro-laptop/host.nix
index d13c7fd..8eb9b28 100644
--- a/config/hosts/aspects/doloro-laptop/host.nix
+++ b/config/hosts/aspects/doloro-laptop/host.nix
@@ -54,6 +54,14 @@
         # Configure network connections interactively with nmcli or nmtui.
         networking.networkmanager.enable = true;
 
+        boot.initrd = {
+          systemd = {
+            enable = true;
+            emergencyAccess = true;
+            tpm2.enable = false;
+          };
+        };
+
         # Set your time zone.
         # time.timeZone = "Europe/London";
         services.automatic-timezoned.enable = true;
diff --git a/config/modules/secrets/content/secrets.yaml b/config/modules/secrets/content/secrets.yaml
index b600f90..a87a400 100644
--- a/config/modules/secrets/content/secrets.yaml
+++ b/config/modules/secrets/content/secrets.yaml
@@ -8,47 +8,56 @@ sops:
         - recipient: age1ykcy2r4kk729e7adqxu8s24ujc60z5eux7ma0ca4ruzydwgm5p6qmdp838
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzdGQ5ZHUxUHE4YXF0bllY
-            dTRsYWc4cllmWEgveGVTLzUvRzJuc0FtUEdvCkNURmxmMnhkaExZcVVNRmRNU1p6
-            UitMYUxNMXgzZC84S3J0SHR4aFV5TGcKLS0tIFB3Skx6UlFDcVJFSlhTd1NRbUl2
-            VGQ3OUpDY0JVaEUyYStHQU83Q1hDYTAKeRgXVA8iWGO8cMMlvBFWGMVIZnaLCpsZ
-            hBjWlxG6oUlCNnO+cyckU3jSTecc+z+EIuseFt710nN5uRJeKs2MlA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSTdpY3hnQ3RoZjVrQStP
+            WHNWa3NCNUdqNUNhZ2hFUTBqMUF5aDFSN2pNCnorT3V5RldUdGlGS1RFaVo5eUYr
+            SWkzLzY0ellTWFhqclQzRG41QUwxVUEKLS0tIDc1c0tuaklKNDBrNmZRS0Q1VEtK
+            a2dXNWk0eHVmeW8rSmxjWS80TVFEWmsK8+S9O1j5EyB5ia4FKSTA+Zky1GF9W3t8
+            0dZz/f5zbwLl4AEh4geX1XgTeOdb36ZiSOdqLW8D4mcS9EX7XUQtuw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1e6vws55p0g23qzthm4qa93hpt6lqmck6670gkygph0sc0j7my4uq5wqjfh
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtM0wvV3pHTUZYdlhPWnU0
-            VElBbDI2bUJhQUVCMlBPNjNzOE9tTXJGelI0CjBEdmhWTGlyc2VhODRnbHE3ZGdC
-            WUoyWU0zcU5BbXhGdm5sVEZHdS80bkkKLS0tIHhpcFZQdkl6eHRUTGhZYmVOSCtz
-            RE8zeFl2ZVgyWVBsRmhlUElybXEwSEEKEhvMUClOOoN3RdzVOFBIPt7rMrukla1t
-            bVWGKX5e3p/EtK7aYzdBxYYvml+TNUD1n5TpTFhcnH2Jwpey8thz2Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1aWdwSjc1b2F1TVN2UGhT
+            Y2VudlBNeTc2RS9FWnVFeDlIODgrZzRUdzBJCmEvOGt5ZDVKcDhYblQ2dDBmYlUx
+            am1aazVvc2hkb0hoM2NCUzFQNm9jd1EKLS0tIGpITjQyNWsvbUg0ZFR4SUI2WlFG
+            SEN5NEtvUU9qY3VheUVlRUlrdVNVWjgKAd7efzl2tDy4BMAga7jPXH0GvyPY/Yp5
+            QSorlGqRBnp2q9qF7R7/n4lkFMyfwC8NapO8UKOrAKqO/5V6cKzhOg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1x3lahhkefkap67cdmdjcqaxan9hp62er78akr79v9m73nvgugpeqk0y32a
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0ODRGRkE3a09MS3Z0QXNm
-            OTBlb2JEV28vTmxhcjM5aFpYbVhYM0wyZkd3CmszblZWVEFkVlMwQ1FMZitBd0Rp
-            MkZpZGViSHlHSko4Tk9rZGNHaWpGWncKLS0tIC9xY1dBSncvQnhHTlhhaEpUK3ZI
-            Tjgwd0VuVGtjaTdaSE5ERmRIa1dVNEkKkN0vp7xDWCnu4aq8VQu5y8Q/6xsFKhCQ
-            ivMqQsqoOBvXSynu7hbNpcGvAsmDHDGcC2b/C9Mkt42OclSYM077bw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOL3JpOTlyNFV0SWpmbWxX
+            Nm4rUVJJQ3l3aFFuNGNIalduVVBWTVJLMkZ3CkYxakdBZUpHQWJUMUw4T1N4MDl3
+            WFBZQWFqN0RIY1VvREpkdE9ZS20vNUUKLS0tIE1aVlcwcGxWOTlGc1VHVzNzeHJz
+            K3AxS2ZESjhIUW5vc29ra2IzaWFWSW8KLyFlhSgVHzw13J7gf14XyzTqMY1eurS5
+            hARQFiKuoCiXPEpIPdqgTZNuK26PCeMLGzJNwquvay4CEj2MiTjqWw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1exzngtk4d9vcsmcq6ap5xx3ca9qacqjkrv86ymged7msx9z6vfyqsf5sjq
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYTmhiUmFWaDFzcnRXcWFp
-            VjJ1b3VRSk8xN0FQMk13UDY1a2FEV3ZQY2l3Cnd0SmMvM0JDOFhZdmtOL3g0dmNj
-            UGZleDV1MU1DMXFiYUNmR2htWXZXQnMKLS0tIFBLa3lPL0VieG9ZWFBOU25vZTJ1
-            VVVDclBGZTRSVDZOanRwOGNaK3VVUW8KCvt/rcP0rJD5aCNdGaJeABuGZ7huRbGw
-            7FBvo6TvIRh0MCyvfbzfUon2m9d4yU8ddFejpSEK1vucxbXgV7KD8g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqcU5NMzcwUno5T3p4YmJ6
+            Zy83d1VuckhuK0lkd1pJMncwSG0vSDVERUV3CnpKQ3U0RWV0WmJIS3dVQTdoN1g0
+            SXpmbi9idFh2azNkSHNSSHpYTVhyb00KLS0tIEJYMDFlcUF4UWs1b2VVU3JiYitK
+            WE9DUUN5SCt4TkUzNE9sWk93Wkx6UTAKnt4maWx/4MbwdlcoBTLp4g+pSLsySPra
+            u8l4G2pAlNeQs2fhdtpmKr6l9I/KYTyJJhnKzO4Rwyi72fDcb2fuaA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1fw4xnh2q52juce94ffn54js708cr6umfwpv0mykuddkea7kr4f0q7a9h05
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLU21oQnlTQ3RQWmNzR3Y4
-            aWhhdFZ6RFEwVm5ITWluS2xZM0QyUHI5SEdvCmFjdDU2YlhlYTJ6Y2pPaGJkNW01
-            WUVVN0xIRXZ3djdVVkYzRThLSzlCVzAKLS0tIFhISmlJcXB2UHNsb2VQS2tnYVUy
-            aW5ERENRS2JWbGZhaGhNSGtqNVRNTncK0uI8n2L5uP3to/sByeO7y17h3ZrcmnOf
-            e3CwdzP4/WcSwbFk0CRnS6Cq8J0esUqweSJxvpt2eNBEYvDZ77SSMw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIVzN4Rnh6Tk1kbXFqSTd6
+            VXNtczQ0VS9PNDV6cnZuYWQwMHJoMkV1TVFNClNJVXRoSWNJaUNYV2UySEJUZzJN
+            dlN2U2FLZENWTE9wNXRLZ1hrLzcydk0KLS0tIDRmQzhMMVh6UEcrT2lpSUJESFRX
+            U3ZuUkRrckpXWnVoMnpTeW1USWlGc1EKXaAYoBxFpokoPmhdk0sP+YTW9z5HhhZA
+            g8FgsAhUKKtK6CncnEVjT6OTx+2FZuxkaEehSFxGZkcXzJxy3Eka1w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1kc0xu0ue2nrrr7w4gam7wlzackv8jv243rxwwndgxjqklgtnp5csdtpgzp
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSU9hc0s0VVJ5NUMwYUF6
+            Q01oZ1Q5SGxCSGpNK04xdFhVbWkwSkRhb1RJCkxCSTliWDA3cStyOUl6ejNLbUN1
+            RzU1YVFiWCs2SkZWVHpmOVBYZkxHbDgKLS0tIDJTNWg3NXowNDhEMGUvaVJEQkhD
+            cEFzcm0wL1ZXK1lmcUNJcmVtdHA4YmMKRQTnlF6Qvht/KQvrmKIQ4ATpq12eI58w
+            vPW99YlAYxrZzzx8CdHAagehtm0tob7lk2YbXaUIihimrtn8rnHVTQ==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-02-14T00:08:39Z"
     mac: ENC[AES256_GCM,data:lp9ZeDxt5gkOkDmYk+F0VQrVhkR0tQiQlYXbygoA8Dcq+gV0IIKKLwRqr5CVfgfRlo3239IwmKLsGaS6zYC1xX4toZ8oqw3Ic2UvP2CiWt6M7HTrlL+3Y2+PKOUvGl7RAqQxQAw7QaoxB4esqdIiWnMDueVHk5BTKrkay+afhno=,iv:NAMaZ9SMBAtROTBSQtU0RJDB60MAuE82AFoPtDqVHVM=,tag:RGBUTQC1pM+LcBweSJbc6w==,type:str]
diff --git a/config/modules/secrets/content/server.yaml b/config/modules/secrets/content/server.yaml
index 0c0b16d..cba55a5 100644
--- a/config/modules/secrets/content/server.yaml
+++ b/config/modules/secrets/content/server.yaml
@@ -5,47 +5,56 @@ sops:
         - recipient: age1ykcy2r4kk729e7adqxu8s24ujc60z5eux7ma0ca4ruzydwgm5p6qmdp838
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSYm92cVo0Ykg2R3hTUWpW
-            UlNOTXF2cFI4Y29uRTh2aXIySFNSTFhZZ0RFCnR4YmRrQTVrY0hkUloxMGgzdFFa
-            ejFST0FESytnN3NIZW45blhmWDRMSlkKLS0tIE1MNWlHWWd1WEhNUGtiUm5GZ2pn
-            QUR3aGtVczZYV1FSUFdMRGw4a2lGU2MKh/56SL7neNFXN70dzwtwTHBaECoMvArR
-            TicJhSPV5S/vUrC9oDmSE3MMYtdzXSZkcRHYPI8fy5LcPOxXVPRARQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmWDU5b2s0dThuUkF4d3NN
+            SUF3VUUzUjBhVHVsWGo1V1drNkZjWVB5ZW1FCnZoRldIWGtKbGFkZmRoeGJ5SWdx
+            SUdqZzFONW1Kb1ZacWMrVkdpcjhRSDgKLS0tIFllTmhZU1Z4SHdzWHJ5UlJuRXda
+            MjgybEYxaFhGdnBpNUlZbG4zTXVramsKNj+tPbkSvooKfk54azmUGVbXHLAfMwg9
+            Mm/f5UFVoMG5c0W13Z6c1ZSBsHoZbvJbdKyNmjzAdUR/UONEZHSGcQ==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1e6vws55p0g23qzthm4qa93hpt6lqmck6670gkygph0sc0j7my4uq5wqjfh
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3K3ZxKzdvdVFMYnZLS0Nv
-            bDBkRWRNMkRMS09UWlZlcFYvZ1pEd09VVmlJCk9uMGJyNzd5QnZtWkdxOE40TVdG
-            YkJiaGZMaEFlNXljcnFvODVSL3Q2d3cKLS0tIFg5UFFPVElyR0xlbXEvMDNDQmpW
-            TGo3cUJVQ2NETkhWdmNCazNYSVpyUWcKr4EUvbK28WCiymL1BgYk6N6J27ZnadK8
-            kQ8tzwVS7iI1frBoHOVzXhCRt2CEg+O3EnXMRJDrahhxwmpqlx6cRA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpUXdlS3AyUklWRE53bFY0
+            SHQ1UDBoNU9IQ29QMG1zeDl2MUxtUjJRWDNFClEyaXBWdkFvK2NDT3Z5YXRaR055
+            V1R1YUdXbWIxeVUxTEs0VlcrdCtwWWsKLS0tIDNKQmlaNnVMWjNURi9QRThZMncv
+            dmljMnByNHkxTytqRnY1a0FXeEZQU1EK4zB8N35mgrlYq2JN94sCOttIftmp3F83
+            jfnxAMnuEWow3JB1xTyvdDCFzoN1AYV9/FIOqAjtLyIbk1NiGrTDbA==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1x3lahhkefkap67cdmdjcqaxan9hp62er78akr79v9m73nvgugpeqk0y32a
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRWGVsRmkwZGxId0hXQlEv
-            czdmclRXYWNrL0t4bGpEQ0lmNE0vb1RuZEhjCkhEaGlxY3JKS3l4WGxHS0Uya2tM
-            Zm1Lb3RpY2h0K2lKaHR1bjdFL25yQ0UKLS0tIFYvNmkrUWNFekVoMFVLck81bXhl
-            WHNSbHpCTTZSS3lkUiszeEE0RGw4QncKTr1ZzIHtkv8aJNKT1v0m+QMJyht43+XJ
-            0CRxdoZ/HXoymMQ7oZvT8vf6Ehz41aLe1gZHl8ZJPexDHrSl28NCtg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXVlZTN1Q3UHhhMXhPRG9s
+            REFFUVl4M3ptRForV0hqcWNjZnV0SFprTkN3Cjl5RnlzMER1MnhEWEp5L082Szd3
+            Y1pJYWhja3RUUi9zU1BQNkFpMmxqTjgKLS0tIFNMZ2tRSHlWRmRwcEN6QitrMmlD
+            bUtaa0dRRVppaHAxR2MrR0dwSHJ4REkK2tj4Wp6z6RzmKGsgm40EcvV+Um3oSUNv
+            PXlPkrIR/aj/PyeuKkonIHqakaBjB+6W51UBOyrmWhCztS256MOGvw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1exzngtk4d9vcsmcq6ap5xx3ca9qacqjkrv86ymged7msx9z6vfyqsf5sjq
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlc0tUVjVGVS85YUZOSmJq
-            a0pvcGV4UDBEc0N0Zk0xVEhUc1l1ZUFFTGxnClNocURmTE5ZaUorSVdWcE1kbW81
-            U3doQm9ZbHVrdVlsSVhFaEFoSHo5NU0KLS0tIGgvd05PY2tlbnRwbTRrdXpsT0ho
-            Zm1jbTlSMnA1WDUrZUVCOHNDWWJ2RFUK+cvqFK49rIVj3FITF/4HtCELvZhvkCZ9
-            8Ss77uE6qtGyhuGWXB0HwnO3fsCpXA62uUt/zv08o9LmIgRi7o7adg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWU2NkVUNoNXZkRTUyek5l
+            NnVaOGJ3ZEJpMUpFRlBteFdFK0o2WWxLUkN3CjJBNXU3L1lkTDdvNi9tMGtIZnl5
+            NlBlY3c5a3l2SCtITFJRVjYvWXM3VEUKLS0tIDhCd0lGc25qUWYrZCttU2Vad1RI
+            NS93RUdWVHdaRUZyQ21GK1hBYXQzOTgKxbpRzZHXb4GSzjtAb/50gdawr7phnS2v
+            xQ4wQsRxOnxsG4u2O7f98zavFyD7lC0/TtQwe7mkR+eKph5/YqtPcw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1fw4xnh2q52juce94ffn54js708cr6umfwpv0mykuddkea7kr4f0q7a9h05
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuN0dkcExkR2pyaUxhbUlz
-            NkR2WTNWRUpHSWdRTFdUY05jcm4ybDdEbW4wCmR1TTV5VlFudHN1cC8yRG5Nd2ts
-            K3duNEE1dit0Ym9PdmNaM1pEWjlZZU0KLS0tIHBXaXhzQ0VuTWFxdDQrczQ4YTBM
-            VlhpZ0N2ZmVkSC90NlowUkNuYWZUclEKzQUfWDETV5lPgrtCxYTLtVP8y7R8RFJj
-            4J1bei0nJHlsap8V88u+QiYRgFsEthd++hzkYmUDvYPsA48PnzMupw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIdWUvSlk3U3pUUHluakQx
+            VUJiR21NRjNHdHlndjEvRFg0VHRmS3hvL0JZCjB5Y0RCeFNaQ3V5RlBqQ2JkZXd4
+            SzFYUEl2dkd1Z0IweXdXSGxMdVRTeVUKLS0tIHBGYno4MWVzWmlKa0RIeHVZS0tX
+            eWV5clRQcjc5Rnd4N2ppOFh2QmhpdEEKNBR1VQ/Us0kZuxxEGq4Mdhnr2O2Zuv3D
+            xO5r5qplwS8BA0KPvqQ9T6RrIfHJEuQsOaiBA0PbKUCOqJ3lFgPJ/g==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1kc0xu0ue2nrrr7w4gam7wlzackv8jv243rxwwndgxjqklgtnp5csdtpgzp
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOYTdhUEwzTmU0c3lob20w
+            VWM4MDJyZjFscDZVaFBsTGZSVzRsZFF4UWlZClRiZThJYjE5SFF4bFVkbEJuY0pu
+            TnNvZlJLK1NTOXJNcFArWW5hNXd1WGcKLS0tIFpsbTBtUTFKQkRaS2wxMjhVaWk3
+            TUFxcC9FV1pLRFoya2dMQUFSQURXNk0KiOKkboTUyJ/0D++hGXkAloSN4F9ndp7W
+            BQECjgmazbwonrI3wG/ZXgmdL7lbLnlN6yw8Xuu0WmaGXmJlcQeACA==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-02-14T00:09:32Z"
     mac: ENC[AES256_GCM,data:nYWQYK5QOA0u3DYGTozSGFMYhx2uMqkAWoqhthgagRFRnKA/j852fVKqRFcwn+fPSQ4e8i4WpcvoM7FVwuFDC+ixNp7xtz16pnswiNS4N/mNEYXfajkon7wIoUYNtrHahUeYlAnID0vYSQFA3XKgV7ZDD9b4V8X5N+yMlVXex4c=,iv:IW7276v0nnmFBe9Z7HIn6Tl9vX4sDoqWdDfJ1uwKoAY=,tag:YC8OiTcoL+nYV4x8rkivbg==,type:str]