diff --git a/common.nix b/common.nix
index d683b59..a06de74 100644
--- a/common.nix
+++ b/common.nix
@@ -9,14 +9,17 @@
     extraGroups = [ "wheel" "networkmanager" ];
     shell = pkgs.zsh;
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZpkPVhzi1zG5JI9hWyUgdyvNIQbp4ts4jw3idpMhhN erik@laptop"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILD5K6AQ0wYYHbNGzC4PyunUQsXbaD0iu1eaadLtv+Xp darman@terra"
     ];
   };
-  # Costs a password prompt on every `./scripts/deploy switch` (nixos-rebuild
-  # --use-remote-sudo). Worth it: darman's key is the only thing between the
-  # public internet and root on neptun. The password is darman_password from
-  # each host's sops file.
-  security.sudo.wheelNeedsPassword = true;
+
+  security.sudo = {
+    enable = true;
+    wheelNeedsPassword = true;
+    extraConfig = ''
+      Defaults timestamp_timeout=20
+    '';
+  };
 
   # ---- SSH (key-only) ----
   services.openssh = {
@@ -48,7 +51,7 @@
     options = "--delete-older-than 30d";
   };
 
-  environment.systemPackages = with pkgs; [ vim git htop tmux curl wget zsh-powerlevel10k ];
+  environment.systemPackages = with pkgs; [ git btop tmux curl wget zsh-powerlevel10k lsd ];
 
   # ---- zsh / oh-my-zsh / powerlevel10k ----
   programs.zsh = {
@@ -57,15 +60,36 @@
       enable = true;
       theme = "robbyrussell"; # prompt itself replaced by p10k below
     };
+    shellAliases = {
+      ls = "lsd";
+    };
     interactiveShellInit = ''
       source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme
       source ${./dotfiles/p10k.zsh}
     '';
   };
 
+  # ---- Boot generations ----
+  # Cap every host at 5 generations so none of them can quietly repeat
+  # jupiter's 34-generations-on-a-29G-eMMC incident. Both loader options are
+  # set unconditionally since only one is ever enabled per host (systemd-boot
+  # everywhere except mercury's generic-extlinux-compatible RPi image) — the
+  # other one is simply inert.
+  boot.loader.systemd-boot.configurationLimit = 5;
+  boot.loader.generic-extlinux-compatible.configurationLimit = 5;
+
+  # Stock journald defaults to ~10% of the filesystem (up to 4G) before it
+  # rotates — no scheduled vacuum, just a ceiling it grows into. On jupiter's
+  # 29G eMMC that's ~2.9G it could silently accumulate. Cap it well below that
+  # everywhere instead of only noticing when a disk fills up again.
+  services.journald.extraConfig = ''
+    SystemMaxUse=200M
+  '';
+
   # ---- Locale / firewall base ----
   time.timeZone = "Europe/Berlin";
   i18n.defaultLocale = "en_US.UTF-8";
+  console.keyMap = "de";
 
   # Firewall on, ssh always allowed. Service modules add their own ports
   # (samba via openFirewall, caddy 80/443, tailscale trusts tailscale0).