diff --git a/hosts/live-cd/base.nix b/hosts/live-cd/base.nix
index f466f30..32e3399 100644
--- a/hosts/live-cd/base.nix
+++ b/hosts/live-cd/base.nix
@@ -80,4 +80,4 @@
     nixops-config.secretOps.gnupg.enable = lib.mkDefault true;
     nixops-config.secretOps.agenix.enable = lib.mkForce false;
   };
-}
\ No newline at end of file
+}
diff --git a/misc/nix/nix.custom.conf b/misc/nix/nix.custom.conf
index 207f8ba..ce9acad 100644
--- a/misc/nix/nix.custom.conf
+++ b/misc/nix/nix.custom.conf
@@ -1,7 +1,8 @@
 # Technically shared/meta-configs.nix but as a seperate conf file since we use Determinate Nix
 # on our systems. This can be also used on user-wide nix.conf files too, just nuke the trsuted-users
 # and allowed-users part.
-experimental-features = nix-command flakes auto-allocate-uids ca-derivations cgroups configurable-impure-env daemon-trust-override dynamic-derivations fetch-closure fetch-tree git-hashing impure-derivations local-overlay-store mounted-ssh-store no-url-literals parse-toml-timestamps read-only-local-store recursive-nix verified-fetches
+experimental-features = nix-command flakes auto-allocate-uids ca-derivations cgroups configurable-impure-env daemon-trust-override dynamic-derivations fetch-closure fetch-tree git-hashing impure-derivations local-overlay-store mounted-ssh-store parse-toml-timestamps read-only-local-store recursive-nix verified-fetches
+lint-url-literals = fatal
 
 # this is how it will going to work atm
 trusted-users = @wheel root nixos gildedguy ajhalili2006
@@ -19,4 +20,4 @@ trusted-substituters = https://cache.nixos.org https://cache.flakehub.com https:
 trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM= cache.flakehub.com-4:Asi8qIv291s0aYLyH6IOnr5Kf6+OF14WVjkE6t3xMio= cache.flakehub.com-5:zB96CRlL7tiPtzA9/WKyPkp3A2vqxqgdgyTVNGShPDU= cache.flakehub.com-6:W4EGFwAGgBj3he7c5fNh9NkOXw0PUVaxygCVKeuvaqU= cache.flakehub.com-7:mvxJ2DZVHn/kRxlIaxYNMuDG1OvMckZu32um1TadOR8= cache.flakehub.com-8:moO+OVS0mnTjBTcOUh2kYLQEd59ExzyoW1QgQ8XAARQ= cache.flakehub.com-9:wChaSeTI6TeCuV/Sg2513ZIM9i0qJaYsF+lZCXg0J6o= cache.flakehub.com-10:2GqeNlIp6AKp4EF2MVbE1kBOp9iBSyo0UPR9KoR0o1Y= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw= ajhalili2006-nixos-builds.cachix.org-1:fA8HXvGR1i792D+CxL2iW/TQzUcyoW7zPUmC9Q4mQLg= andreijiroh-dev.cachix.org-1:7Jd0STdBOLiNu5fiA+AKwcMqQD2PA1j9zLDGyDkuyBo= recaptime-dev.cachix.org-1:b0UBO1zONf6ceTIoR06AKhgid4ZOl5kxB/gOIdZ9J6g=
 
 # instead of using nixpkgs-weekly at flakehub, we'll go straight to the source
-extra-nix-path = nixpkgs=https://flakehub.com/f/DeterminateSystems/nixpkgs-weekly/*.tar.gz home-manager=flake:github:nix-community/home-manager nur=flake:github:nix-community/NUR
\ No newline at end of file
+extra-nix-path = nixpkgs=https://flakehub.com/f/DeterminateSystems/nixpkgs-weekly/*.tar.gz home-manager=flake:github:nix-community/home-manager nur=flake:github:nix-community/NUR
diff --git a/misc/nix/nix.user.conf b/misc/nix/nix.user.conf
index 179f52d..062ad05 100644
--- a/misc/nix/nix.user.conf
+++ b/misc/nix/nix.user.conf
@@ -1,6 +1,7 @@
 # Technically shared/meta-configs.nix but as a user-wise config, to be used on home-manager.
-extra-experimental-features = nix-command flakes auto-allocate-uids blake3-hashes ca-derivations cgroups configurable-impure-env dynamic-derivations external-builders fetch-closure fetch-tree git-hashing impure-derivations local-overlay-store mounted-ssh-store no-url-literals pipe-operators read-only-local-store verified-fetches
+extra-experimental-features = nix-command flakes auto-allocate-uids blake3-hashes ca-derivations cgroups configurable-impure-env dynamic-derivations external-builders fetch-closure fetch-tree git-hashing impure-derivations local-overlay-store mounted-ssh-store pipe-operators read-only-local-store verified-fetches
 extra-platforms = aarch64-linux x86_64-linux
+lint-url-literals = fatal
 
 # adjust based on CPU cores
 max-jobs = auto
diff --git a/shared/server/ssh.nix b/shared/server/ssh.nix
index b9d612c..1ccce80 100644
--- a/shared/server/ssh.nix
+++ b/shared/server/ssh.nix
@@ -32,13 +32,21 @@ in
           "hmac-sha2-512-etm@openssh.com"
           "hmac-sha2-256-etm@openssh.com"
           "umac-128-etm@openssh.com"
-          "hmac-sha2-256" # required for Cloudflare Access SSH via Browser Rendering
+
+          # required for Cloudflare Access SSH via Browser Rendering
+          "curve25519-sha256@libssh.org"
+          "curve25519-sha256"
+          "ecdh-sha2-nistp256"
+          "ecdh-sha2-nistp384"
+          "ecdh-sha2-nistp521"
+          "hmac-sha2-256"
+
         ];
 
-        TrustedUserCAKeys = pkgs.writeText "cloudflare-ca.pub" ''
+        TrustedUserCAKeys = "${pkgs.writeText "cloudflare-ca.pub" ''
           ${caCerts.cfAccessForInfra.ajhalili2006}
           ${caCerts.cfAccessForInfra.recaptime-dev}
-        '';
+        ''}";
       };
     };
     # Enable OpenSSH agent on login