diff --git a/hosts/nixos-laptop/default.nix b/hosts/nixos-laptop/default.nix
index 87ed2be..987c719 100644
--- a/hosts/nixos-laptop/default.nix
+++ b/hosts/nixos-laptop/default.nix
@@ -20,8 +20,10 @@
       webis.enable = true;
       impermanence.enable = true;
     };
-    programs.hyprland.enable = true;
-    programs.gitbutler.enable = true;
+    programs.hyprland = {
+      enable = true;
+      monitors.DP-3.scale = "auto";
+    };
     programs.exercism.enable = true;
   };
 
diff --git a/modules/programs/fish.nix b/modules/programs/fish.nix
index 8934508..d96f9b0 100644
--- a/modules/programs/fish.nix
+++ b/modules/programs/fish.nix
@@ -31,7 +31,7 @@ in
           enable = true;
           shellAbbrs = shellConfig.abbreviations;
           shellAliases = shellConfig.aliases;
-          shellInit = ''
+          shellInit = /* fish */ ''
             # Vi Mode
             fish_vi_key_bindings
 
@@ -62,7 +62,7 @@ in
             end
             abbr --add dotdot --regex '^\.\.+$' --function multicd
 
-            abbr -a P --position anywhere --set-cursor "% | $PAGER"
+            abbr -a .P --position anywhere --set-cursor "% | $PAGER"
 
             function editor_edit
               echo $EDITOR $argv
diff --git a/modules/programs/git.nix b/modules/programs/git.nix
index 0dbd586..12171e0 100644
--- a/modules/programs/git.nix
+++ b/modules/programs/git.nix
@@ -29,18 +29,24 @@ in
 
   config = mkIf cfg.enable {
     my.shell.abbreviations = {
+      g = "git";
+      gC = "git clone";
+      gF = "git pull";
+      gS = "git switch";
       ga = "git add";
       gap = "git add --patch";
-      gr = "git restore";
-      grp = "git restore --patch";
       gb = "git branch";
       gc = "git commit";
       gco = "git checkout";
       gd = "git diff";
       gds = "git diff --staged";
-      gp = "git push";
       gf = "git fetch";
-      gF = "git pull";
+      gp = "git push";
+      gr = "git restore";
+      grm = "git rm --cached";
+      grp = "git restore --patch";
+      grps = "git restore --patch --staged";
+      grs = "git restore --staged";
       gs = "git status";
     };
     home-manager.users.moritz = {
diff --git a/modules/programs/hyprland/_config.nix b/modules/programs/hyprland/_config.nix
index 5d210e5..18a6c5b 100644
--- a/modules/programs/hyprland/_config.nix
+++ b/modules/programs/hyprland/_config.nix
@@ -3,10 +3,18 @@
 , ...
 }:
 
-with lib;
 let
+  inherit (lib) concatStringsSep flip boolToString mapAttrsToList;
   cfg = config.my.programs.hyprland;
 
+  mkMonitor = { name, resolution, position, scale, disabled, extra }:
+    if disabled
+    then "monitor=${name},disabled"
+    else "monitor=${name},${resolution},${position},${scale},${extra}";
+
+  monitorsList = mapAttrsToList (name: value: { name = name; } // value) cfg.monitors;
+  monitors = map mkMonitor monitorsList;
+
   mkRule = rule: windowRegexes: "windowrulev2 = ${rule},${concatStringsSep "," windowRegexes}";
   mkRules = rules: windowRegexes: concatStringsSep "\n" (map (flip mkRule windowRegexes) rules);
 in
@@ -17,7 +25,7 @@ in
   #
 
   # See https://wiki.hyprland.org/Configuring/Monitors/
-  ${concatLines (map (x: "monitor=${x}") cfg.monitors)}
+  ${concatStringsSep "\n" monitors}
 
   # See https://wiki.hyprland.org/Configuring/Keywords/ for more
 
@@ -226,7 +234,7 @@ in
 
   # Lid open/close
   bindl=,switch:on:Lid Switch,exec,monitors="$(hyprctl monitors | grep -c '^Monitor')" && hyprctl keyword monitor "eDP-1, disable" && [ "$monitors" = 1 ] && loginctl lock-session
-  bindl=,switch:off:Lid Switch,exec, hyprctl keyword monitor "eDP-1, prefered, auto"
+  bindl=,switch:off:Lid Switch,exec, hyprctl keyword monitor "eDP-1, preferred, auto"
 
   # Extra Config
   ${cfg.extraConfig}
diff --git a/modules/programs/hyprland/default.nix b/modules/programs/hyprland/default.nix
index 4c6bed1..76caa5c 100644
--- a/modules/programs/hyprland/default.nix
+++ b/modules/programs/hyprland/default.nix
@@ -5,8 +5,8 @@
 , ...
 } @ args:
 
-with lib;
 let
+  inherit (lib) mkOption mkEnableOption mkIf types getExe genAttrs optionalAttrs optional;
   cfg = config.my.programs.hyprland;
 
   hyprland = inputs.hyprland.packages.${pkgs.system}.default;
@@ -31,9 +31,38 @@ in
       default = [ "de" "us" ];
     };
     monitors = mkOption {
-      type = types.listOf types.str;
-      description = "monitor settings";
-      default = [ ",preferred,auto,1" ];
+      type = types.attrsOf (
+        let
+          sub = types.submodule {
+            options = {
+              resolution = mkOption {
+                type = types.strMatching "\(preferred\)|\([[:digit:]]+x[[:digit:]]+\(@[[:digit:]]+\)\?\)";
+                default = "preferred";
+              };
+              position = mkOption {
+                type = types.strMatching "\(auto\)|\(-\?[[:digit:]]+x-?[[:digit:]]+\)";
+                default = "auto";
+              };
+              disabled = mkEnableOption "disabled";
+              scale = mkOption {
+                type = types.oneOf [ types.float (types.strMatching "auto") ];
+                default = 1.0;
+                apply = x: if lib.isFloat x then lib.strings.floatToString x else x;
+              };
+              extra = mkOption {
+                type = types.listOf types.str;
+                default = [ ];
+                apply = lib.concatStringsSep ",";
+              };
+            };
+          };
+        in
+        sub
+      );
+      description = "monitor setting";
+      default = {
+        "" = { };
+      };
     };
     extraConfig = mkOption {
       type = types.str;
@@ -51,6 +80,7 @@ in
         # foot.enable = true;
         kitty.enable = true;
         rofi.enable = true;
+        hyprland.monitors."" = lib.mkDefault { };
       };
       wallpapers.enable = true;
       services = {
diff --git a/modules/programs/nix.nix b/modules/programs/nix.nix
index bc4eba8..c0807ce 100644
--- a/modules/programs/nix.nix
+++ b/modules/programs/nix.nix
@@ -73,6 +73,7 @@ in
         stable.flake = inputs.stable;
         dotfiles.flake = self;
         default.flake = self;
+        d.flake = self;
       };
 
       settings = {
diff --git a/modules/programs/nvim/plugins/lua/nvim-lspconfig.lua b/modules/programs/nvim/plugins/lua/nvim-lspconfig.lua
index 3a822ec..b7959d1 100644
--- a/modules/programs/nvim/plugins/lua/nvim-lspconfig.lua
+++ b/modules/programs/nvim/plugins/lua/nvim-lspconfig.lua
@@ -127,7 +127,6 @@ local servers = {
   "bashls",
   "gleam",
   "gopls",
-  "nil_ls",
   "pylsp",
   "ruff",
   "templ",
@@ -141,6 +140,16 @@ lspconfig_setup("elixirls", {
   cmd = { "elixir-ls" },
 })
 
+lspconfig_setup("nil_ls", {
+  settings = {
+    flake = {
+      autoArchive = true,
+      autoEvalInputs = true,
+      nixpkgsInputName = "nixpkgs",
+    },
+  },
+})
+
 lspconfig_setup("nixd", {
   settings = {
     nixd = {
diff --git a/modules/security/default.nix b/modules/security/default.nix
index 3fcd4fb..e7b42fe 100644
--- a/modules/security/default.nix
+++ b/modules/security/default.nix
@@ -1,5 +1,6 @@
 { config
 , lib
+, pkgs
 , ...
 }: {
   ## System security tweaks
@@ -69,6 +70,7 @@
 
   # SSH
   services.openssh = {
+    package = pkgs.master.openssh; # HACK: to fix CVE-2024-6387
     settings = {
       # Disable ssh password login
       PasswordAuthentication = lib.mkDefault false;