diff --git a/nixos/hosts/fw/profiles.nix b/nixos/hosts/fw/profiles.nix
index b5c94637..a0ac2155 100644
--- a/nixos/hosts/fw/profiles.nix
+++ b/nixos/hosts/fw/profiles.nix
@@ -1,14 +1,7 @@
-{
-  config,
-  lib,
-  pkgs,
-  inputs,
-  ...
-}: {
+{ config, lib, pkgs, inputs, ... }: {
   imports = [
     ../../profiles
     ../../profiles/boot
-    # ../../profiles/boot/secureboot.nix
     ../../profiles/desktop
     ../../profiles/desktop/de/gnome
     ../../profiles/hardware/display
diff --git a/nixos/hosts/wyse/default.nix b/nixos/hosts/wyse/default.nix
index 145049d1..06d5d71d 100644
--- a/nixos/hosts/wyse/default.nix
+++ b/nixos/hosts/wyse/default.nix
@@ -27,7 +27,6 @@
     ../../profiles
 
     ../../profiles/boot
-    #../../profiles/boot/unl0kr.nix
     ../../profiles/desktop
     ../../profiles/desktop/de/gnome
     ../../profiles/hardware/display
diff --git a/nixos/profiles/boot/default.nix b/nixos/profiles/boot/default.nix
index ae412f73..ca08b82e 100644
--- a/nixos/profiles/boot/default.nix
+++ b/nixos/profiles/boot/default.nix
@@ -1,46 +1,64 @@
 { config, lib, pkgs, user, ... }:
+#
+# https://wiki.archlinux.org/index.php/Disk_encryption
+# https://nixos.wiki/wiki/Full_Disk_Encryption
+# https://nixos.org/wiki/Encrypted_Root_on_NixOS
+# https://nixos.wiki/wiki/Remote_disk_unlocking
+#
 let
-  inherit (lib) mkDefault;
+  inherit (lib) mkDefault mkIf;
+  opts = {
+    disk-unlock-password-entry = true;
+    disk-unlock-usb-key = false;
+  };
 in
 {
   imports = [
-    ./plymouth.nix
+    ./plymouth.nix        # imports ./quiet.nix
     ./systemd-boot.nix
     ./systemd-initrd.nix
 
-    #./disko.nix
-    #./extra-bootloader-entries.nix
-    #./hibernation.nix
-    #./iscsi-initiator.nix
-    #./nvme.nix
-    #./print-config-install.nix
-    #./secureboot.nix
     #./systemd-debug.nix
     #./systemd-emergency.nix
     #./systemd-repart.nix
-    #./unl0kr.nix
 
-    #./entries #          # ./entries/{efi-shell,fwupd,memtest86,netbootxyz,restart-bootloader,usb-boot}.nix
-    #./filesystem-support # ./filesystem-support/{bcachefs,btrfs,f2fs,lvm2,mdadm,ntfs,xfs,zfs}.nix
+    #./entries            # ./entries/{efi-shell,fwupd,memtest86,netbootxyz,restart-bootloader,usb-boot}.nix
+    #./fs                 # ./fs/{bcachefs,btrfs,lvm2,mdadm,ntfs,zfs}.nix
+    #./fs                 # ./fs/{f2fs,ntfs,xfs}.nix
+    #./fs/layouts         # ./fs/layouts/xbootldr.nix
+    #./hw                 # ./hw/{nvme,tpm2}.nix
+    #./network            # ./network/{iscsi-initiator,netboot,pixieboot}.nix
 
     #./efivars.nix
-    #./tpm.nix
-    #./xbootldr.nix
+    #./hibernation.nix
   ];
 
   boot = {
     bootspec = {
       # Write bootspec docs for each build.
-      enable = mkDefault true;
+      enable = true; #mkDefault true;
 
       # Validate bootspec documents upon each build.
       # - Note: introduces build-time Golang dep Cuelang.
       # - Warn: Make certain bootspec docs are correct.
-      enableValidation = mkDefault true;
+      enableValidation = true; #mkDefault true;
 
       # extensions = {}; 
     };
 
+    initrd = {
+      # --- Graphical Disk Unlock w/ Touch Keyboard ---
+      # https://github.com/droidian/unl0kr
+      # TODO: Enable when:
+      # - no keyboard OR touchscreen (mobile devices)
+      # - disk encrypted
+      # TODO: Write configuration file.
+      # TODO: Create NixOS module for config options.
+      # TODO: Move config to profiles/mobile?
+      unl0kr.enable = opts.disk-unlock-password-entry;
+      kernelModules = mkIf opts.disk-unlock-usb-key ["usb_storage"];
+    };
+
     loader = {
       # Second until default bootloader entry boots.
       # - `null` = wait indefinitely
@@ -49,11 +67,19 @@ in
 
       efi = {
         # Where to mount the EFI system partition
-        efiSysMountPoint     = mkDefault "/boot"; #"/boot/efi";
+        #  TODO: Follow Discoverable Partitions Spec: 
+        #    https://uapi-group.org/specifications/specs/discoverable_partitions_specification/
+        #    - TODO: `XBOOTLDR` / `ESP` splitting?
+        #    - TODO: Rewrite to `/efi`, `/boot`, or `/boot/efi`?
+        #  NOTE: Set to "/boot/efi" in `nixos/hosts/fw/configuration.nix`
+        #  Default: "/boot"
+        efiSysMountPoint = mkDefault "/boot"; #"/boot/efi";
 
         # Whether install process allowed to modify EFI boot variables
         canTouchEfiVariables = mkDefault true; 
       };
     };
   };
+
+  environment.systemPackages = mkIf config.boot.bootspec.enable [pkgs.bootspec];
 }
diff --git a/nixos/profiles/boot/disko.nix b/nixos/profiles/boot/disko.nix
deleted file mode 100644
index bad0a349..00000000
--- a/nixos/profiles/boot/disko.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ inputs, config, lib, pkgs, ... }:
-{
-  imports = [
-  ];
-
-}
diff --git a/nixos/profiles/boot/entries/usb-boot.nix b/nixos/profiles/boot/entries/usb-boot.nix
index f7666943..92a6ad8d 100644
--- a/nixos/profiles/boot/entries/usb-boot.nix
+++ b/nixos/profiles/boot/entries/usb-boot.nix
@@ -1,20 +1,15 @@
-{ config, ... }:
-{
-  imports = [ ];
-
+{ config, ... }: {
   # TODO: Enable networking, disks in initrd / UEFI?
-
+  # TODO: Add EFI binary paths for all extraEntries.
   boot.loader.systemd-boot = {
     extraEntries = {
-      # TODO: Add EFI binary paths for all extraEntries.
       "usb-boot" = ''
         title Boot from USB drive
         efi
       '';
     };
-
     extraFiles = {
-      #"efi/<dirName>/<efiBinaryName>.efi" = "${pkgs.<efiBinaryPackage>}/<efiBinaryName>.efi";
+      #"efi/<dirName>/<efiBinaryName>.efi"     = "${pkgs.<efiBinaryPackage>}/<efiBinaryName>.efi";
       #"efi/reboot-bootloader/no-plymouth.efi" = "${pkgs.systemd-boot}/systemd-boot.efi";  # TODO: Get real path
     };
   };
diff --git a/nixos/profiles/boot/hibernation.nix b/nixos/profiles/boot/hibernation.nix
index 3a9146ac..cb0d950d 100644
--- a/nixos/profiles/boot/hibernation.nix
+++ b/nixos/profiles/boot/hibernation.nix
@@ -1,9 +1,5 @@
-{ inputs
-, config
-, lib
-, pkgs
-, ...
-}:
+{ inputs, config, lib, pkgs, ... }:
+#
 # TODO: Possible to work with machines that are Kubernetes nodes?
 # TODO: Setup Full Disk Encryption (FDE) before enabling swap & hibernation.
 # TODO: Encrypt keyfiles with agenix or sops-nix, then add to repo.
@@ -12,16 +8,13 @@
 #  - [ ] Mount other keyfiles at proper location on disk.
 # TODO: Configure hardware-configuration & disk partitions with Disko.
 #
-#
 # See:
 #
 # - https://nixos.wiki/wiki/Laptop
 # - https://sawyershepherd.org/post/hibernating-to-an-encrypted-swapfile-on-btrfs-with-nixos/
 #
 {
-  imports = [
-    #./swap.nix
-  ];
+  # imports = [ ./swap.nix ];
 
   # Device for manual resume attempt during boot.
   #  This should be used primarily if you want to resume from file.
@@ -65,51 +58,28 @@
   #  - the path of the swap device or file (device) or
   #  - the label of the swap device (label, see mkswap -L).
   #  Using a label is recommended.
-  swapDevices = {
-
-    primary-swap = {
-
-      # --- Swap device parameters ---
-      device = "/dev/nvme0n1p2"; # Path of the device or swap file.
-      discardPolicy = null; # null | once | pages | both
-      label = "swap"; # Label of the device. Can be used instead of device.
-      options = [ "defaults" ]; # Options used to mount the swap.
-      priority = 10; # Priority of the swap device b/w [0, 32767] where higher number => higher priority. null lets kernel choose priority, which will show up as negative value.
-      size = 2048; # Swap size in Megabytes.                # TODO: Set to RAM size * 1.5
-
-      # --- Swap Encryption ---
-      encrypted = {
-        enable = true; # The block device is backed by an encrypted one, adds this device as a initrd luks entry.
-        blkDev = "/dev/nvme0n1p2"; # Location of the backing encrypted device.
-        # Path to a keyfile used to unlock the backing encrypted device.
-        #  At the time this keyfile is accessed,
-        #   the neededForBoot filesystems (see fileSystems.<name?>.neededForBoot) will have been mounted under /mnt-root,
-        #   so the keyfile path should usually start with “/mnt-root/”.
-        keyFile = "/mnt-root/root/.swapkey";
-
-        # Label of the unlocked encrypted device. Set fileSystems.<name?>.device to /dev/mapper/<label> to mount the unlocked device.
-        label = "swap";
-      };
-
-      # --- Swap Random Encryption ---
-      # Encrypt swap device with a random key. This way you won’t have a persistent swap device.
-      #  HINT: run `cryptsetup benchmark` to test cipher performance on your machine.
-      #  WARNING: Don’t try to hibernate when you have at least one swap partition with this option enabled!
-      #    We have no way to set the partition into which hibernation image is saved, so if your image ends up on an encrypted one you would lose it!
-      #  WARNING: Do not use /dev/disk/by-uuid/… or /dev/disk/by-label/… as your swap device when using randomEncryption
-      #   ...as the UUIDs & labels will get erased on every boot when the partition is encrypted.
-      #   Best to use /dev/disk/by-partuuid/…
-      randomEncryption = {
-        enable = false; # Encrypt swap with random data. Note: cannot be used w/ hibernate!
-        allowDiscards = false; # Harden: set false.
-        cipher = "aes-xts-plain64"; #
-        keySize = "512"; # If null, will be determined by cryptsetup. See: cryptsetup-open(8)
-        sectorSize = "4096"; #  If null, will be determined by cryptsetup. See: cryptsetup-open(8)
-        source = "/dev/urandom"; # /dev/random
-      };
-
+  swapDevices.primary-swap = {
+    device = "/dev/nvme0n1p2"; # Path of the device or swap file.
+    discardPolicy = null; # null | once | pages | both
+    label = "swap"; # Label of the device. Can be used instead of device.
+    options = [ "defaults" ]; # Options used to mount the swap.
+    priority = 10; # Priority of the swap device b/w [0, 32767] where higher number => higher priority. null lets kernel choose priority, which will show up as negative value.
+    size = 2048; # Swap size in Megabytes.                # TODO: Set to RAM size * 1.5
+
+    # --- Swap Encryption ---
+    encrypted = {
+      enable = true; # The block device is backed by an encrypted one, adds this device as a initrd luks entry.
+      blkDev = "/dev/nvme0n1p2"; # Location of the backing encrypted device.
+      # Path to a keyfile used to unlock the backing encrypted device.
+      #  At the time this keyfile is accessed,
+      #   the neededForBoot filesystems (see fileSystems.<name?>.neededForBoot) will have been mounted under /mnt-root,
+      #   so the keyfile path should usually start with “/mnt-root/”.
+      keyFile = "/mnt-root/root/.swapkey";
+
+      # Label of the unlocked encrypted device. Set fileSystems.<name?>.device to /dev/mapper/<label> to mount the unlocked device.
+      label = "swap";
     };
-
+    randomEncryption.enable = lib.mkForce false;
   };
 
   # If you have issues w/ device not shutting off after hibernating, uncomment these lines:
@@ -117,8 +87,5 @@
   #  [Sleep]
   #  HibernateMode=shutdown
   #'';
-
-
-
 }
 
diff --git a/nixos/profiles/boot/plymouth.nix b/nixos/profiles/boot/plymouth.nix
index 6dc048e7..b4b00c61 100644
--- a/nixos/profiles/boot/plymouth.nix
+++ b/nixos/profiles/boot/plymouth.nix
@@ -1,51 +1,40 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ config, lib, pkgs, ... }:
+#
 # Set quiet boot so splash isnt interrupted by scrolling boot logging text.
 # TODO: Determine if using disk encryption. If so, display unlock util (requires systemd-based initrd?)
+#
 {
-  #imports = [ ./quiet.nix ];
+  imports = [ ./quiet.nix ];
   boot = {
-    plymouth = {
+    plymouth = with pkgs; {
       enable = lib.mkDefault true;
-      font = "${pkgs.cantarell-fonts}/share/fonts/cantarell/Cantarell-VF.otf"; # # Console font.
-      #font = "${pkgs.dejavu_fonts.minimal}/share/fonts/truetype/DejaVuSans.ttf"; # TODO: Font work w/ boot-console/Plymouth?
-      #logo="${pkgs.nixos-icons}/share/icons/hicolor/48x48/apps/nix-snowflake-white.png"; # OS logo img (can use files in Nix store)
-      #logo=pkgs.fetchurl {url="https://nixos.org/logo/nixos-hires.png"; sha256="1ivzgd7iz0i06y36p8m5w48fd8pjqwxhdaavc0pxs7w1g7mcy5si";};
 
-      # Tutorial to create Plymouth theme: https://brej.org/blog/?p=197
-      # https://brej.org/blog/?p=238
-      theme = "spinner"; # bgrt|spinner-monochrome|details|fade-in|glow|script|solar|spinfinity|spinner|text|tribar|breeze
-      themePackages = [
-        # Packages providing Plymouth themes
-        pkgs.adi1090x-plymouth-themes
-        pkgs.catppuccin-plymouth
-        pkgs.libsForQt5.breeze-plymouth
-        pkgs.nixos-bgrt-plymouth
-        #(pkgs.plymouth-spinner-monochrome.override { inherit (config.boot.plymouth) logo; })
-      ];
+      # Console font.
+      # TODO: Font work w/ boot-console/Plymouth?
+      # TODO: Share font with desktop?
+      #font = "${dejavu_fonts.minimal}/share/fonts/truetype/DejaVuSans.ttf";
+      font = "${cantarell-fonts}/share/fonts/cantarell/Cantarell-VF.otf";
+
+      # OS logo img (can use files in Nix store)
+      #logo="${nixos-icons}/share/icons/hicolor/48x48/apps/nix-snowflake-white.png";
+      #logo = fetchurl {url="https://nixos.org/logo/nixos-hires.png"; sha256="1ivzgd7iz0i06y36p8m5w48fd8pjqwxhdaavc0pxs7w1g7mcy5si";};
+
+      # Tutorials to create Plymouth themes:
+      # - https://brej.org/blog/?p=197
+      # - https://brej.org/blog/?p=238
+      # Options: bgrt | spinner-monochrome | details | fade-in | glow |
+      #        script | solar | spinfinity | spinner | breeze  | text | tribar
+      theme = "spinner";
+
+      # Packages providing Plymouth themes
+      #  (plymouth-spinner-monochrome.override { inherit (config.boot.plymouth) logo; })
+      themePackages = with pkgs; [adi1090x-plymouth-themes catppuccin-plymouth libsForQt5.breeze-plymouth nixos-bgrt-plymouth];
+
       # Extra lines to append to Plymouth config.
       extraConfig = ''
         DeviceScale=2
       '';
     };
-
-    # --- quiet / silent boot ---
-    consoleLogLevel =
-      lib.mkIf config.boot.plymouth.enable 0; # Lowest boot console log level
-    initrd.verbose =
-      !config.boot.plymouth.enable; # # Minimal info to console in initrd.
-    kernelParams = lib.mkIf config.boot.plymouth.enable [
-      "quiet"
-      "loglevel=3"
-      "systemd.show_status=auto"
-      "udev.log_level=3"
-      "rd.udev.log_level=3"
-      "vt.global_cursor_default=0"
-    ]; # "splash"
   };
 
   console = {
diff --git a/nixos/profiles/boot/print-config-install.nix b/nixos/profiles/boot/print-config-install.nix
deleted file mode 100644
index f69aac1b..00000000
--- a/nixos/profiles/boot/print-config-install.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ config, ... }:
-{
-  # Print out default bootloader name & its config
-  boot.extraInstallCommands = ''
-    default_cfg=$(cat /boot/loader/loader.conf | grep default | awk '{print $2}')
-    init_value=$(cat /boot/loader/entries/$default_cfg | grep init= | awk '{print $2}')
-    sed -i "s|@INIT@|$init_value|g" /boot/custom/config_with_placeholder.conf
-  '';
-}
diff --git a/nixos/profiles/boot/quiet.nix b/nixos/profiles/boot/quiet.nix
new file mode 100644
index 00000000..372af320
--- /dev/null
+++ b/nixos/profiles/boot/quiet.nix
@@ -0,0 +1,35 @@
+{ config, lib, pkgs, ... }:
+{
+  # Enable "Silent Boot"
+  # - Note: Required for Plymouth bootsplash?
+  boot = {
+    # Hide the OS choice for bootloaders.
+    # It's still possible to open the bootloader list by pressing any key
+    # It will just not appear on screen unless a key is pressed
+    loader.timeout = 0;
+
+    # Lowest boot console log level
+    consoleLogLevel = 0;
+
+    # Minimal info to console in initrd
+    initrd.verbose = false;
+
+    kernelParams = [
+      "quiet"
+      "splash"
+      "boot.shell_on_fail"
+      "loglevel=3"
+      "rd.systemd.show_status=false"
+      "rd.udev.log_level=3"
+      "udev.log_priority=3"
+
+      # -- plymouth.nix ---
+      # These params were previously enabled in ./plymouth.nix,
+      # but weren't in wiki page on quiet boot / Plymouth, so we removed them.
+      #
+      #"systemd.show_status=auto"
+      #"udev.log_level=3"
+      #"vt.global_cursor_default=0"
+    ];
+  };
+}
diff --git a/nixos/profiles/boot/secureboot.nix b/nixos/profiles/boot/secureboot.nix
deleted file mode 100644
index 46b1f9c6..00000000
--- a/nixos/profiles/boot/secureboot.nix
+++ /dev/null
@@ -1,94 +0,0 @@
-{ inputs
-, config, lib, pkgs
-, ...
-}:
-# 
-# let
-#   sbctl = lib.getExe pkgs.sbctl;
-#   enroll-script = pkgs.writeShellApplication "secureboot-encroll.sh" ''
-#     echo 'Creating keys...'
-#     echo '> sbctl create-keys'
-#     ${sbctl} create-keys
-#       \ && echo 'Created keys.'
-#       \ || echo 'Failed to create keys.'
-#     ${sbctl} verify
-#   '';
-# in
-{
-
-  # --- SecureBoot ---
-  # https://github.com/nix-community/lanzaboote
-  # https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md
-  # https://wiki.archlinux.org/title/Secure_Boot#Booting_an_installation_medium
-  #
-  # Process:
-  #
-  # 1. Create keys
-  #   $ sudo sbctl create-keys
-  #
-  # 2. Configure NixOS secureboot (activate this profile)
-  #
-  # 3. Reboot into UEFI firmware settings
-  #   $ sudo systemctl reboot --firmware-setup
-  #
-  # 4. Enable Secure Boot in UEFI firmware
-  #   b. Select "Administrator Secure Boot"
-  #   c. Select "Erase all Secure Boot Settings"
-  #   d. Press "F10" to save and exit
-  #
-  # 4. Reboot
-  #   $ sudo systemctl reboot
-  #
-  # 5. Enroll keys
-  #   $ sudo sbctl enroll-keys --microsoft
-  #
-  # 6. Reboot
-  #   $ sudo systemctl reboot --firmware-setup
-  #
-  # 7. Enable Secure Boot
-  #    a. Select "Administrator Secure Boot"
-  #    b. Enable "Enforce Secure Boot"
-  #
-  # 7. Test
-  #   $ bootctl status
-  # 
-  #
-  # TODO: TPM2.0 authenticated boot
-  # TODO: Boot counting
-  imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
-
-  boot = {
-
-    lanzaboote = {
-      enable = true;
-      pkiBundle = "/etc/secureboot";
-    };
-
-    loader = {
-      efi = {
-        canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot/efi"; # Default: `/boot`  # TODO: `XBOOTLDR` / `ESP` splitting. # TODO: Rewrite to `/efi`?
-      };
-      grub.enable         = lib.mkForce false;
-      systemd-boot.enable = lib.mkForce false;
-    };
-
-    # bootspec = {
-    #   enable = true;           # Write bootspec docs for each build.
-    #   enableValidation = true; # Validate bootspec documents upon each build.
-    #   #extensions = {};         #  ^ Introduces build-time Golang dep Cuelang. Make certain bootspec docs are correct.
-    # };
-    # initrd.systemd = {
-    #   enable = true;
-    #   enableTpm2 = true;
-    # };
-
-  };
-
-  # Util to sign Secure Boot keys, etc.
-  environment.systemPackages = [ pkgs.sbctl ];
-
-  # TODO: sops-nix enrollment of Secure Boot keys
-  # TODO: impermanence persist /etc/secureboot
-  # TODO: generators.install-iso add secure boot setup script.
-}
diff --git a/nixos/profiles/boot/systemd-boot.nix b/nixos/profiles/boot/systemd-boot.nix
index a537c999..cf5e68a6 100644
--- a/nixos/profiles/boot/systemd-boot.nix
+++ b/nixos/profiles/boot/systemd-boot.nix
@@ -1,14 +1,32 @@
-{ inputs, config, lib, pkgs, user, ... }:
-{
+{ inputs, config, lib, pkgs, ... }: {
   #imports = [ inputs.srvos.nixosModules.mixins-systemd-boot ];
   boot.loader.systemd-boot = {
     enable = lib.mkDefault true;
-    configurationLimit = lib.mkForce 50; # Max generations in boot menu. Prevent boot partition from running out of space
-    #consoleMode = "keep"; # keep (keep mode selected by firmware) | max (pick highest-numbered available mode) | auto (auto-pick using heuristics) | "2" (1st non-standard mode provided by firmware if any) | "1" (80x50) | "0" (UEFI 80x25)
-    editor = lib.mkDefault false; # Allow editing bootloader entries. Recommended to disable. Default=true for compat. Hardening: disable
-    graceful = lib.mkDefault false; # Invoke bootctl install with the --graceful option, which ignores errors when EFI variables cannot be written or when the EFI System Partition cannot be found.
-    # Currently only applies to random seed operations.
-    # Only enable this option if systemd-boot otherwise fails to install, as the scope or implication of the --graceful option may change in the future.
+
+    # Max generations in boot menu. Prevent boot partition from running out of space
+    configurationLimit = lib.mkDefault 20;
+
+    # Console resolution
+    #   Options:
+    #   - keep (keep mode selected by firmware)
+    #   - max (pick highest-numbered available mode)
+    #   - auto (auto-pick using heuristics)
+    #   - "2" (1st non-standard mode provided by firmware if any) 
+    #   - "1" (80x50)
+    #   - "0" (UEFI 80x25)
+    #consoleMode = lib.mkDefault "keep";
+
+    # Allow editing bootloader entries. (Default: true (for compat), Recommended/Hardened: false)
+    editor = lib.mkDefault false;
+
+    # Invoke bootctl install with the --graceful option, which ignores errors when:
+    # - EFI variables cannot be written 
+    # - EFI System Partition cannot be found.
+    # Notes:
+    # - Currently only applies to random seed operations.
+    # - Only enable this option if systemd-boot otherwise fails to install,
+    #   as the scope or implication of the --graceful option may change in the future.
+    graceful = lib.mkDefault false;
 
     # --- EFI Binaries ---
     #memtest86 = {
@@ -27,18 +45,8 @@
     #    efi /etc/memtest86/memtest.efi
     #  '';
     #};
-
     #extraFiles = {
     #  "efi/memtest86/memtest.efi" = "${pkgs.memtest86plus}/memtest.efi";
     #};
-
-    # Additional shell commands inserted in the bootloader installer script after generating menu entries.
-    #  It can be used to expand on extra boot entries that cannot incorporate certain pieces of information (such as the resulting init= kernel parameter).
-    #extraInstallCommands = ''
-    #  default_cfg=$(cat /boot/loader/loader.conf | grep default | awk '{print $2}')
-    #  init_value=$(cat /boot/loader/entries/$default_cfg | grep init= | awk '{print $2}')
-    #  sed -i "s|@INIT@|$init_value|g" /boot/custom/config_with_placeholder.conf
-    #'';
-
   };
 }
diff --git a/nixos/profiles/boot/systemd-debug.nix b/nixos/profiles/boot/systemd-debug.nix
index 0cd8265a..3ae59977 100644
--- a/nixos/profiles/boot/systemd-debug.nix
+++ b/nixos/profiles/boot/systemd-debug.nix
@@ -1,26 +1,20 @@
-{ inputs, config, lib, pkgs, modulesPath, ... }:
-{
-  imports = [
-    #./crash-dump.nix  # ???
-    #./systemd-emergency.nix  # ???
-  ];
-
-  # --- Crash Dumps ---
+{ config, lib, pkgs, ... }: {
   boot = {
     crashDump = {
-      enable = true;
-      kernelParams = [ "1" "boot.shell_on_fail" ]; # TODO: Find list of others
-      reservedMemory = "128M";
-      initrd.systemd = {
-        additionalUpstreamUnits = [
-          "debug-shell.service"
-          "systemd-quotacheck.service"
-        ];
-        managerEnvironment.SYSTEMD_LOG_LEVEL = "debug";
-      };
+      enable = lib.mkDefault true;
+
+      # TODO: Find list of others
+      kernelParams = lib.mkDefault [ "1" "boot.shell_on_fail" ];
+      reservedMemory = lib.mkDefault "128M";
     };
+
+    initrd.systemd = {
+      additionalUpstreamUnits = lib.mkDefault [ "debug-shell.service" "systemd-quotacheck.service" ];
+      managerEnvironment.SYSTEMD_LOG_LEVEL = lib.mkDefault "debug";
+    };
+
     # Print out default bootloader name & its config
-    extraInstallCommands = ''
+    loader.systemd-boot.extraInstallCommands = ''
       default_cfg=$(cat /boot/loader/loader.conf | grep default | awk '{print $2}')
       init_value=$(cat /boot/loader/entries/$default_cfg | grep init= | awk '{print $2}')
       sed -i "s|@INIT@|$init_value|g" /boot/custom/config_with_placeholder.conf
diff --git a/nixos/profiles/boot/systemd-emergency.nix b/nixos/profiles/boot/systemd-emergency.nix
index 23afa200..9869fe7c 100644
--- a/nixos/profiles/boot/systemd-emergency.nix
+++ b/nixos/profiles/boot/systemd-emergency.nix
@@ -1,23 +1,17 @@
-{ inputs, config, lib, pkgs, modulesPath, ... }:
-{
-  imports = [
-    #./crash-dump.nix     # ???
-    #./systemd-debug.nix  # ???
-  ];
-
-  # --- systemd Emergency Mode ---
+{ config, lib, pkgs, ... }: {
   systemd.enableEmergencyMode = true;
   boot.initrd.systemd = {
-    emergencyAccess = true;
-    enableEmergencyMode = true;
-    initrdBin = [ "btrfs" "btrfs-progs" ]; # Packages to include in /bin for the stage 1 emergency shell
-    extraBin = [ "btrfs" "btrfs-progs" ]; # Packages to include in /bin for the stage 1 emergency shell
-  };
+    # TODO: Set to hashed super user password to enable authentication in emergency mode
+    emergencyAccess = lib.mkDefault true;
+    enableEmergencyMode = lib.mkDefault true;
 
-  # Print out default bootloader name & its config
-  boot.extraInstallCommands = ''
-    default_cfg=$(cat /boot/loader/loader.conf | grep default | awk '{print $2}')
-    init_value=$(cat /boot/loader/entries/$default_cfg | grep init= | awk '{print $2}')
-    sed -i "s|@INIT@|$init_value|g" /boot/custom/config_with_placeholder.conf
-  '';
+    # Packages to include in /bin for the stage 1 emergency shell
+    initrdBin = [ pkgs.btrfs pkgs.btrfs-progs ];
+
+    # extraBin  = {
+    #   umount = "${pkgs.util-linux}/bin/umount";
+    #   btrfs = "${lib.getExe pkgs.btrfs}";
+    #   btrfs-progs = "${lib.getExe pkgs.btrfs-progs}";
+    # };
+  };
 }
diff --git a/nixos/profiles/boot/systemd-initrd.nix b/nixos/profiles/boot/systemd-initrd.nix
index 2151a08c..2564683b 100644
--- a/nixos/profiles/boot/systemd-initrd.nix
+++ b/nixos/profiles/boot/systemd-initrd.nix
@@ -1,16 +1,28 @@
-{ inputs, config, lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
+let
+  inherit (lib) mkDefault;
+  systemd-boot-based = with config.boot; loader.systemd-boot.enable || lanzaboote.enable;
+in
 {
   boot.initrd.systemd = {
+    enable = systemd-boot-based;
+    enableTpm2  = mkDefault systemd-boot-based;
+    dbus.enable = mkDefault systemd-boot-based;
+
+    # true  = unauthed-emerg-access,
+    # <str> = hashed-su-passwd (authed-emerg-access)
+    emergencyAccess = mkDefault false;
+
     #contents."/etc/hostname".text = config.networking.hostName;
-    enable = config.boot.loader.systemd-boot.enable; #    # d:false
-    enableTpm2 = lib.mkDefault config.boot.loader.systemd-boot.enable; ## d:false
-    emergencyAccess = lib.mkDefault false; # # true=unauthed-emerg-access,<str>=hashed-su-passwd (authed-emerg-access)
-    dbus.enable = lib.mkDefault config.boot.loader.systemd-boot.enable; # d:false
     #extraBin = { umount=${pkgs.util-linux}/bin/umount; }; #            # Tools to add to `/bin`
     #extraConfig = "DefaultLimitCORE=infinity"; #                       # See: `man systemd-system.conf(5)`
     #initrdBin = []; #                                                  # Packages to include in `/bin` for stage1 emergency shell
-    #managerEnvironment = {SYSTEMD_LOG_LEVEL="debug";}; #               # Env vars of PID 1. Not passed to started units.
-    #additionalUpstreamUnits=["debug-shell.service" "systemd-quotacheck.service"]; # Enable builtin systemd units
-    #packages = [pkgs.systemd-cryptsetup-generator]; # Packages providing systemd units/hooks
+    #managerEnvironment = { SYSTEMD_LOG_LEVEL = "debug"; }; #           # Env vars of PID 1. Not passed to started units.
+
+    # Enable builtin systemd units
+    #additionalUpstreamUnits=["debug-shell.service" "systemd-quotacheck.service"]; 
+
+    # Packages providing systemd units/hooks
+    #packages = [pkgs.systemd-cryptsetup-generator]; 
   };
 }
diff --git a/nixos/profiles/boot/unl0kr.nix b/nixos/profiles/boot/unl0kr.nix
deleted file mode 100644
index bcfdc6ec..00000000
--- a/nixos/profiles/boot/unl0kr.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ config, lib, pkgs, modulesPath, ... }:
-
-# --- Visual Disk Unlock ---
-# https://github.com/droidian/unl0kr
-#
-# TODO: Enable for mobile devices
-# TODO: Deterrmine if system has encrypted partitions
-#
-# TODO: Does this work with keyboard & mouse?
-# TODO: Only enable for mobile devices? touchscreens?
-#
-# TODO: Write configuration file.
-# TODO: Create NixOS module for config options.
-# TODO: Move config to profiles/mobile?
-{
-  imports = [ ];
-
-  boot.initrd.unl0kr = {
-    enable = true;
-  };
-
-}
diff --git a/nixos/profiles/hardware/tpm2.nix b/nixos/profiles/hardware/tpm2.nix
index ffa8262d..55463bca 100644
--- a/nixos/profiles/hardware/tpm2.nix
+++ b/nixos/profiles/hardware/tpm2.nix
@@ -1,11 +1,4 @@
-{ inputs
-, config
-, lib
-, pkgs
-, user
-, ...
-}:
-{
+{ config, lib, pkgs, user, ... }: {
   security.tpm2 = {
     enable = true;
     #applyUdevRules = true;
@@ -30,5 +23,8 @@
   #  endorsementCred = "${config.services.tcsd.stateDir}/endorsement.cert";
   #  platformCred = "${config.services.tcsd.stateDir}/platform.cert";
   #};
-  users.extraGroups.tss.members = [ user ];
+  users.extraGroups.${config.security.tpm2.tssGroup}.members = [ user ];
+
+  boot.initrd.systemd.enableTpm2 = lib.mkDefault config.security.tpm2.enable;
+  # virtualisation.tpm.enable = lib.mkDefault config.security.tpm2.enable;
 }
diff --git a/nixos/profiles/modules/lanzaboote.nix b/nixos/profiles/modules/lanzaboote.nix
index 9f1f013a..6eec0ee2 100644
--- a/nixos/profiles/modules/lanzaboote.nix
+++ b/nixos/profiles/modules/lanzaboote.nix
@@ -1,36 +1,94 @@
 { inputs, config, lib, pkgs, user, ... }:
+#
+# https://github.com/nix-community/lanzaboote
+# https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md
+# https://wiki.archlinux.org/title/Secure_Boot#Booting_an_installation_medium
+#
+# TODO: impermanence: persist /etc/secureboot
+# TODO: Learn about `lib.extendModules`
+#
+# Process:
+#
+# 1. Create keys
+#   $ sudo sbctl create-keys
+#
+# 2. Configure NixOS secureboot (activate this profile)
+#
+# 3. Reboot into UEFI firmware settings
+#   $ sudo systemctl reboot --firmware-setup
+#
+# 4. Enable Secure Boot in UEFI firmware
+#   b. Select "Administrator Secure Boot"
+#   c. Select "Erase all Secure Boot Settings"
+#   d. Press "F10" to save and exit
+#
+# 4. Reboot
+#   $ sudo systemctl reboot
+#
+# 5. Enroll keys
+#   $ sudo sbctl enroll-keys --microsoft
+#
+# 6. Reboot
+#   $ sudo systemctl reboot --firmware-setup
+#
+# 7. Enable Secure Boot
+#    a. Select "Administrator Secure Boot"
+#    b. Enable "Enforce Secure Boot"
+#
+# 7. Test
+#   $ bootctl status
+#
+# TODO: TPM2.0 authenticated boot
+# TODO: Boot counting
+# TODO: sops-nix enrollment of Secure Boot keys
+# TODO: impermanence persist /etc/secureboot
+# TODO: generators.install-iso add secure boot setup script.
 let
-  scripts = {
-    check-generations =  "sudo sbctl verify /boot/EFI/Linux/nixos-generation-*.efi";
-  };
+  inherit (lib) mkDefault mkForce;
+  sbctl = lib.getExe pkgs.sbctl;
 in
 {
-  # https://github.com/nix-community/lanzaboote
-  imports = [ 
-    inputs.lanzaboote.nixosModules.lanzaboote
-    # inputs.lanzaboote.nixosModules.uki
-  ];
-
+  imports = with inputs.lanzaboote.nixosModules; [lanzaboote uki];
   boot = {
-    lanzaboote = {
-      enable = lib.mkDefault true;
-      pkiBundle = lib.mkDefault "/etc/secureboot";
-      # pkiBundle = lib.mkDefault config.skjkjops.secrets.secureboot-keys.path;
+    lanzaboote = mkDefault {
+      enable =  true;
+      enrollKeys = true;
+      configurationLimit = config.boot.loader.systemd-boot.configurationLimit or 20;
+      pkiBundle = "/etc/secureboot"; #config.sops.secrets.secureboot-keys.path;
+      # publicKeyFile  = config.sops.secrets.secureboot-pubkey.path;
+      # privateKeyFile = config.sops.secrets.secureboot-privkey.path;
+    };
+    loader = {
+      grub.enable = mkForce false;
+      systemd-boot.enable = mkForce false;  #mkForce (!lanzaboote.enable);
+      #uki = { enable = mkDefault false; stub = "path-to-uki-stub"; };
     };
-    loader.systemd-boot.enable = lib.mkForce false;  #lib.mkForce (!lanzaboote.enable);
   };
 
-  # For debugging and troubleshooting Secure Boot.
-  environment.systemPackages = [ pkgs.sbctl ];
-
   # sops.secrets.secureboot = lib.mkIf config.boot.lanzaboote.enable {
   #   sopsFile = ../../hosts/${config.networking.hostName}/secrets/secureboot.yaml;
   #   path = "/etc/secureboot";
   #   owner = "root";
   #   group = "root";
   # };
+  # sops.secrets = lib.mkIf config.boot.lanzaboote.enable {
+  #   secureboot-pubkey  = { path = "/etc/secureboot/db/db.pem"; owner="root"; group="root"; };
+  #   secureboot-privkey = { path = "/etc/secureboot/db/db.key"; owner="root"; group="root"; };
+  #};
 
-
-  # TODO: impermanence: persist /etc/secureboot
-  # TODO: Learn about `lib.extendModules`
+  environment.systemPackages = [ 
+    # sbctl: Secure Boot - debug & troubleshoot
+    pkgs.sbctl
+    # (pkgs.writeShellScript "secureboot-enroll.sh" ''
+    #     echo 'Creating keys...'
+    #     echo '> sbctl create-keys'
+    #     ${sbctl} create-keys
+    #       \ && echo 'Created keys.'
+    #       \ || echo 'Failed to create keys.'
+    #     ${sbctl} verify
+    # '')
+    # (pkgs.writeShellScript "secureboot-check-generations.sh" ''
+    #   sbctl verify /boot/EFI/Linux/nixos-generation-*.efi
+    # '')
+  ];
 }