diff --git a/modules/nixos/services/service-docker.ulu.nix b/modules/nixos/services/service-docker.ulu.nix
index 19c1b18..31a4383 100644
--- a/modules/nixos/services/service-docker.ulu.nix
+++ b/modules/nixos/services/service-docker.ulu.nix
@@ -3,6 +3,12 @@
   flake.nixosModules.service-docker =
     { ... }:
     {
-      virtualisation.docker.enable = true;
+      # Rootless: the daemon runs as the user, so access to it isn't root
+      # (membership in the `docker` group of a rootful daemon would be).
+      # setSocketVariable points DOCKER_HOST at the user's socket.
+      virtualisation.docker.rootless = {
+        enable = true;
+        setSocketVariable = true;
+      };
     };
 }
diff --git a/modules/nixos/services/service-security.ulu.nix b/modules/nixos/services/service-security.ulu.nix
index 2ec205a..b9ba3c7 100644
--- a/modules/nixos/services/service-security.ulu.nix
+++ b/modules/nixos/services/service-security.ulu.nix
@@ -1,22 +1,13 @@
 { ... }:
 {
   flake.nixosModules.service-security =
-    { pkgs, ... }:
+    { ... }:
     {
       programs.gnupg.agent = {
         enable = true;
         enableSSHSupport = false;
       };
 
-      security.wrappers = {
-        gsr-kms-server = {
-          source = "${pkgs.gpu-screen-recorder}/bin/gsr-kms-server";
-          owner = "root";
-          group = "root";
-          permissions = "u+rx,g+rx,o+rx";
-        };
-      };
-
       services.gnome.gnome-keyring.enable = true;
     };
 }
diff --git a/modules/nixos/services/service-usbmuxd.ulu.nix b/modules/nixos/services/service-usbmuxd.ulu.nix
new file mode 100644
index 0000000..d325c9b
--- /dev/null
+++ b/modules/nixos/services/service-usbmuxd.ulu.nix
@@ -0,0 +1,10 @@
+{ ... }:
+{
+  flake.nixosModules.service-usbmuxd =
+    { ... }:
+    {
+      # iOS device multiplexer: libimobiledevice, ifuse and xtool talk to an
+      # iPhone over USB through this daemon (started by udev on plug-in).
+      services.usbmuxd.enable = true;
+    };
+}