diff --git a/modules/nixos/hw/hw-graphics.ulu.nix b/modules/nixos/hw/hw-graphics.ulu.nix
index 3a82d16..b1b2579 100644
--- a/modules/nixos/hw/hw-graphics.ulu.nix
+++ b/modules/nixos/hw/hw-graphics.ulu.nix
@@ -94,6 +94,10 @@
             enable = true;
             enable32Bit = true;
           };
+
+          # Through PAM, so every program of the session gets it; the cache
+          # stays in its default, persistent ~/.cache/mesa_shader_cache_db.
+          environment.sessionVariables.MESA_SHADER_CACHE_MAX_SIZE = "2G";
         }
 
         (lib.mkIf (driver == "intel") intel)
diff --git a/modules/nixos/hw/hw-ivb-drivers.ulu.nix b/modules/nixos/hw/hw-ivb-drivers.ulu.nix
index 1360134..c66aa32 100644
--- a/modules/nixos/hw/hw-ivb-drivers.ulu.nix
+++ b/modules/nixos/hw/hw-ivb-drivers.ulu.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ inputs, ... }:
 {
   flake.nixosModules.hw-ivb-drivers =
     { pkgs, ... }:
@@ -8,7 +8,7 @@
         p.stdenv.mkDerivation {
           pname = "ivb-drivers";
           version = "fork";
-          src = ../../../drivers/ivb + "/${arch}";
+          src = inputs.ivb-drivers + "/ivb/${arch}";
 
           nativeBuildInputs = [ p.autoPatchelfHook ];
           buildInputs = with p; [
@@ -65,12 +65,12 @@
         };
 
       # pocl with the gen7 device (OpenCL on the HD 4000) and the host CPU
-      # device, from Drivers/pocl-gen7/release.sh. The gen7 device finds
+      # device, from pocl-gen7/release.sh. The gen7 device finds
       # libgbe and beignet's library in lib/beignet next to itself.
       pocl-gen7 = pkgs.stdenv.mkDerivation {
         pname = "pocl-gen7";
         version = "release";
-        src = ../../../drivers/pocl-gen7;
+        src = inputs.ivb-drivers + "/pocl-gen7";
 
         nativeBuildInputs = [ pkgs.autoPatchelfHook ];
         buildInputs = with pkgs; [
diff --git a/modules/nixos/hw/hw-udev.ulu.nix b/modules/nixos/hw/hw-udev.ulu.nix
index d0d1222..704d397 100644
--- a/modules/nixos/hw/hw-udev.ulu.nix
+++ b/modules/nixos/hw/hw-udev.ulu.nix
@@ -6,10 +6,25 @@
       programs.gpu-screen-recorder.enable = true;
       services.udisks2.enable = true;
       services.gvfs.enable = true;
+      # Passwordless mount/unlock/eject for wheel in the local active session
+      # only; formatting, partitioning, secure erase etc. still ask.
       security.polkit.extraConfig = ''
         polkit.addRule(function(action, subject) {
-            if (action.id.match("org.freedesktop.udisks2.") &&
-                subject.isInGroup("wheel")) {
+            var allowed = [
+                "org.freedesktop.udisks2.filesystem-mount",
+                "org.freedesktop.udisks2.filesystem-mount-system",
+                "org.freedesktop.udisks2.filesystem-unmount-others",
+                "org.freedesktop.udisks2.encrypted-unlock",
+                "org.freedesktop.udisks2.encrypted-unlock-system",
+                "org.freedesktop.udisks2.eject-media",
+                "org.freedesktop.udisks2.eject-media-system",
+                "org.freedesktop.udisks2.power-off-drive",
+                "org.freedesktop.udisks2.power-off-drive-system",
+                "org.freedesktop.udisks2.loop-setup",
+                "org.freedesktop.udisks2.rescan"
+            ];
+            if (allowed.indexOf(action.id) >= 0 &&
+                subject.isInGroup("wheel") && subject.local && subject.active) {
                 return polkit.Result.YES;
             }
         });