{pkgs, ...}: {
  security = {
    # Enable Soteria, a GTK-based Polkit authentication agent.
    soteria.enable = true;
    apparmor = {
      enable = true;
      killUnconfinedConfinables = true;
      packages = [pkgs.apparmor-profiles];
    };

    pam.services = {
      login.kwallet = {
        enable = true;
        # package = pkgs.kdePackages.kwallet-pam;
      };
      niri = {
        allowNullPassword = true;
        kwallet = {
          enable = true;
          package = pkgs.kdePackages.kwallet-pam;
        };
      };
    };
  };
  environment.systemPackages = with pkgs.kdePackages; [
    kwallet # provides helper service
    kwallet-pam # provides helper service
    kwalletmanager # provides KCMs and stuff
  ];
}