diff --git a/nix/config.nix b/nix/config.nix
index 062443e..a54daae 100755
--- a/nix/config.nix
+++ b/nix/config.nix
@@ -24,16 +24,17 @@
   # swap sitting at 100% never triggered it.
   systemd.oomd.enable = true;
 
-  # The wall is sized for wisteria (30 GiB): a build may use half of RAM
-  # plus 2 GiB of swap before it dies. Peak rustc/linker memory above this
-  # is a lost compile (rerun it), not a lost session. If dahlia ships less
-  # RAM, lower it there.
+  # The wall is a share of physical RAM, so it scales per host: a build may
+  # use 85% of RAM plus 2 GiB of swap before it dies, leaving the rest for
+  # the desktop (whose footprint is roughly fixed, not proportional). Peak
+  # rustc/linker memory above this is a lost compile (rerun it), not a lost
+  # session.
   systemd.user.slices.builds = {
     description = "Resource-capped slice for heavy local builds";
     sliceConfig = {
       CPUWeight = 20;
       IOWeight = 20;
-      MemoryMax = "16G";
+      MemoryMax = "85%";
       MemorySwapMax = "2G";
       ManagedOOMMemoryPressure = "kill";
       ManagedOOMMemoryPressureLimit = "50%";
diff --git a/nix/flake.lock b/nix/flake.lock
index 9243f08..f018b02 100755
--- a/nix/flake.lock
+++ b/nix/flake.lock
@@ -6,11 +6,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1790798517,
-        "narHash": "sha256-KUudJ87dsfhnM2LVa4QXJdrLSjCNbuWOLFZGtiDDrtE=",
+        "lastModified": 1791313301,
+        "narHash": "sha256-6wQM1lQAb3q0hVIZ48KsrFlLGwu6W2HCmLDqnoyqvvU=",
         "owner": "sadjow",
         "repo": "claude-code-nix",
-        "rev": "cf73bd2bece41565ca483050a3a7385ef3663aec",
+        "rev": "13f3032e7a46582bbd3ed749e25817c7ac584b77",
         "type": "github"
       },
       "original": {
@@ -44,11 +44,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790742243,
-        "narHash": "sha256-kaNo6xHiL31AbNNEreG0OTKf4j6Cxlo5bPawjX7lnbQ=",
+        "lastModified": 1790996401,
+        "narHash": "sha256-f+kOxEmOUnQazVAmGg0i8hzwgd1kX/geY+k/Dpheye8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e5fcd298a00f08b6e8390baf04aa8edb62203070",
+        "rev": "db7d5e2332710f5abb088f6b5de927d7f9511b35",
         "type": "github"
       },
       "original": {
@@ -63,11 +63,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1790722812,
-        "narHash": "sha256-XwFt1uLyaBCQU1/nUeGqeBnqNXPVgGRnz20YVYdmF6Y=",
+        "lastModified": 1791373788,
+        "narHash": "sha256-c3oMt0QoE+4yiRk6u1m2L9ogjaUw0uTGn9yk808KkgE=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "06f9ecaea5f64b6ff61cf42cb32f21621c4fa14a",
+        "rev": "4bc63156b109ee7b4103e3ec30565c8c92bde435",
         "type": "github"
       },
       "original": {
@@ -79,11 +79,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1790652569,
-        "narHash": "sha256-641r7xrlSOHYoktL9/aArPIYNgZJ9eM5URzSEOtPJDY=",
+        "lastModified": 1791191277,
+        "narHash": "sha256-i8KuaINOYLvB2oQikGvtRmdZRxATRxsI9Yad2pp7dEA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b6c8664de9b6cc07fe5666a29f91884ba81197c4",
+        "rev": "aa48d347080940b8a2b8d2f48228674e280a3514",
         "type": "github"
       },
       "original": {
@@ -123,11 +123,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1790750587,
-        "narHash": "sha256-VfjaoJ1Uyb7JZTrBgE5Jf2nhjtQPmD9KOd19HJwmZwM=",
+        "lastModified": 1791353474,
+        "narHash": "sha256-v72qr4LsSz61tQki/41nHKZKPY6NSeZavtGlAInOCng=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "78e9c786dc08cd4f3420c2395cd977206a9b1da2",
+        "rev": "2efa67fd26b6df417c33e4603185c701f260dd83",
         "type": "github"
       },
       "original": {
@@ -217,11 +217,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790498116,
-        "narHash": "sha256-rs9meAYxW3zzrh43yaW7htrqCD+X9+pupDPHN86fumI=",
+        "lastModified": 1791103873,
+        "narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5efb5a6f4f5ab192817d28557dd4d650fa14d866",
+        "rev": "dcd241ba97088c22569d1573286e1b9daad340c0",
         "type": "github"
       },
       "original": {
@@ -232,11 +232,11 @@
     },
     "systems": {
       "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "lastModified": 1791244623,
+        "narHash": "sha256-uuanbkFk8a313Zfrxdcz8Us/yQtaxNnKJtX8v0ZPpd8=",
         "owner": "nix-systems",
         "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "d36eeed142f88b5a636f2e3856a53c61654cf29b",
         "type": "github"
       },
       "original": {
@@ -265,11 +265,11 @@
     },
     "unstable-pkgs": {
       "locked": {
-        "lastModified": 1790652569,
-        "narHash": "sha256-641r7xrlSOHYoktL9/aArPIYNgZJ9eM5URzSEOtPJDY=",
+        "lastModified": 1791336361,
+        "narHash": "sha256-o9ZUW4SlEAvFPIyJWnqChhOT/VHpHg8TAvEgmqK1fSI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b6c8664de9b6cc07fe5666a29f91884ba81197c4",
+        "rev": "7dd199b0e2993e37b4775ed66b1c291699608c9f",
         "type": "github"
       },
       "original": {
@@ -286,11 +286,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790843023,
-        "narHash": "sha256-vO6WFunNqHCjEaQc3ytshsGhHMqAIeW+5/rEJRLQLxQ=",
+        "lastModified": 1791109428,
+        "narHash": "sha256-9Wlecihq1JF26Le4xw1q75pQ4z0Pw88rRmUjeHzQXjY=",
         "owner": "youwen5",
         "repo": "zen-browser-flake",
-        "rev": "710bb85c6cb4f186de8a710615be5b93b5f98885",
+        "rev": "4bbcd79d8104040a2e510f81199210070900ebcd",
         "type": "github"
       },
       "original": {
diff --git a/nix/modules/home/default.nix b/nix/modules/home/default.nix
index c165a51..81519d7 100755
--- a/nix/modules/home/default.nix
+++ b/nix/modules/home/default.nix
@@ -13,6 +13,7 @@ in
     ./rust.nix
     ./scratch.nix
     ./shell.nix
+    ./ssh-agent.nix
   ] ++ lib.optionals (builtins.pathExists hostConfig) [
     hostConfig
   ];
diff --git a/nix/modules/home/ssh-agent.nix b/nix/modules/home/ssh-agent.nix
new file mode 100644
index 0000000..995a7c1
--- /dev/null
+++ b/nix/modules/home/ssh-agent.nix
@@ -0,0 +1,19 @@
+# SSH agent wiring for the whole graphical session, not just fish.
+#
+# The agent is GNOME's gcr-ssh-agent; KeePassXC loads keys into it while
+# the vault is unlocked. Setting SSH_AUTH_SOCK in the systemd user
+# environment (environment.d) means the Emacs daemon, KeePassXC, and
+# anything niri launches see the same socket as fish. Doom deliberately
+# doesn't snapshot SSH_AUTH_SOCK in its env file, so Magit uses this too.
+#
+# SSH_ASKPASS gives tty-less callers (Magit signing or pushing) a graphical
+# prompt for passphrases and, later, YubiKey PINs. In a terminal, OpenSSH
+# still prompts on the tty, since SSH_ASKPASS_REQUIRE is left unset.
+{ lib, pkgs, isServer ? false, ... }:
+
+lib.mkIf (pkgs.stdenv.isLinux && !isServer) {
+  systemd.user.sessionVariables = {
+    SSH_ASKPASS   = "${pkgs.kdePackages.ksshaskpass}/bin/ksshaskpass";
+    SSH_AUTH_SOCK = "\${XDG_RUNTIME_DIR}/gcr/ssh";
+  };
+}
diff --git a/nix/nixos/hosts/wisteria/default.nix b/nix/nixos/hosts/wisteria/default.nix
index f7b7dda..57d820a 100755
--- a/nix/nixos/hosts/wisteria/default.nix
+++ b/nix/nixos/hosts/wisteria/default.nix
@@ -12,6 +12,8 @@
   # Bootloader
   boot.loader.systemd-boot.enable = true;
   boot.loader.systemd-boot.configurationLimit = 20;
+  # Memtest86+ as a boot-menu entry, for testing RAM without a USB stick.
+  boot.loader.systemd-boot.memtest86.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
   powerManagement.enable = true;