diff --git a/flake.nix b/flake.nix
index 7845ed0..bd88547 100644
--- a/flake.nix
+++ b/flake.nix
@@ -68,6 +68,10 @@
       ];
 
       hosts.nixos-laptop.modules = [ ./hosts/nixos-laptop ];
-      hosts.nixos-desktop.modules = [ ./hosts/nixos-desktop ./modules/gaming ];
+      hosts.nixos-desktop.modules = [
+        ./hosts/nixos-desktop
+        ./modules/gaming
+        ./modules/darling-erasure.nix
+      ];
     };
 }
diff --git a/modules/darling-erasure.nix b/modules/darling-erasure.nix
new file mode 100644
index 0000000..e9ed79c
--- /dev/null
+++ b/modules/darling-erasure.nix
@@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }:
+
+{
+  environment.etc = {
+    nixos.source = "/persist/etc/nixos";
+    "NetworkManager/system-connections".source =
+      "/persist/etc/NetworkManager/system-connections";
+    adjtime.source = "/persist/etc/adjtime";
+    NIXOS.source = "/persist/etc/NIXOS";
+    machine-id.source = "/persist/etc/machine-id";
+  };
+  systemd.tmpfiles.rules = [
+    "L /var/lib/NetworkManager/secret_key - - - - /persist/var/lib/NetworkManager/secret_key"
+    "L /var/lib/NetworkManager/seen-bssids - - - - /persist/var/lib/NetworkManager/seen-bssids"
+    "L /var/lib/NetworkManager/timestamps - - - - /persist/var/lib/NetworkManager/timestamps"
+  ];
+  security.sudo.extraConfig = ''
+    # rollback results in sudo lectures after each reboot
+    Defaults lecture = never
+  '';
+
+  # Note `lib.mkBefore` is used instead of `lib.mkAfter` here.
+  boot.initrd.postDeviceCommands = pkgs.lib.mkBefore ''
+    mkdir -p /mnt
+
+    # We first mount the btrfs root to /mnt
+    # so we can manipulate btrfs subvolumes.
+    mount -o subvol=/ /dev/mapper/enc /mnt
+
+    # While we're tempted to just delete /root and create
+    # a new snapshot from /root-blank, /root is already
+    # populated at this point with a number of subvolumes,
+    # which makes `btrfs subvolume delete` fail.
+    # So, we remove them first.
+    #
+    # /root contains subvolumes:
+    # - /root/var/lib/portables
+    # - /root/var/lib/machines
+    #
+    # I suspect these are related to systemd-nspawn, but
+    # since I don't use it I'm not 100% sure.
+    # Anyhow, deleting these subvolumes hasn't resulted
+    # in any issues so far, except for fairly
+    # benign-looking errors from systemd-tmpfiles.
+    btrfs subvolume list -o /mnt/root |
+    cut -f9 -d' ' |
+    while read subvolume; do
+      echo "deleting /$subvolume subvolume..."
+      btrfs subvolume delete "/mnt/$subvolume"
+    done &&
+    echo "deleting /root subvolume..." &&
+    btrfs subvolume delete /mnt/root
+
+    echo "restoring blank /root subvolume..."
+    btrfs subvolume snapshot /mnt/root-blank /mnt/root
+
+    # Once we're done rolling back to a blank snapshot,
+    # we can unmount /mnt and continue on the boot process.
+    umount /mnt
+  '';
+}