{ den, inputs, lib, config, ... }: {
  den.aspects.work-specific.nixos = { pkgs, config, ... }: {
    imports = [
      ./_hardware/work-hardware.nix
      ./_hardware/notebook-disko.nix
      inputs.disko.nixosModules.disko
    ];

    hardware.graphics = {
      enable      = true;
      enable32Bit = true;
    };

    hardware.nvidia = {
      modesetting.enable          = true;
      open                        = false;
      nvidiaSettings              = true;
      # Fine-grained power management is required for PRIME offload mode.
      powerManagement.enable      = true;
      powerManagement.finegrained = true;
      package = config.boot.kernelPackages.nvidiaPackages.stable;
    };

    # amdgpu drives the display; nvidia is available for offloaded rendering.
    services.xserver.videoDrivers = [ "amdgpu" "nvidia" ];

    environment.sessionVariables = {
      GBM_BACKEND               = "nvidia-drm";
      __GLX_VENDOR_LIBRARY_NAME = "nvidia";
    };

    security.sudo.wheelNeedsPassword = lib.mkForce true;

    networking.firewall = {
      enable          = true;
      allowedTCPPorts = [];
      allowedUDPPorts = [];
    };

    services.thermald.enable = true;
    powerManagement.enable   = true;

    services.tlp = {
      enable   = true;
      settings = {
        CPU_SCALING_GOVERNOR_ON_AC  = "performance";
        CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
      };
    };

    boot = {
      initrd.kernelModules = [ "dm-crypt" "amdgpu" ];
      initrd.compressor    = "zstd";
      kernelParams         = [ "nvidia.NVreg_PreserveVideoMemoryAllocations=1" ];

      loader = {
        grub = {
          enable             = true;
          device             = "nodev";
          efiSupport         = true;
          configurationLimit = 2;
          enableCryptodisk   = true;
        };
        efi.canTouchEfiVariables = true;
      };
    };
  };
}