@ -390,7 +390,7 @@ let
# USB stick, nothing is mistakenly written to persistent storage.
boot.kernelParams = [ "copytoram" ];
# Secure defaults
boot.cleanTmpDir = true;
boot.tmp.cleanOnBoot = true;
boot.kernel.sysctl = { "kernel.unprivileged_bpf_disabled" = 1; };
services.pcscd.enable = true;