diff --git a/features/bootloader.nix b/features/bootloader.nix
new file mode 100644
index 0000000..ae145e8
--- /dev/null
+++ b/features/bootloader.nix
@@ -0,0 +1,40 @@
+{
+  nixos =
+    { config, lib, inputs, ... }:
+    let
+      cfg = config.features.bootloader;
+    in
+    {
+      imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];
+
+      options.features.bootloader = {
+        enable = lib.mkEnableOption "bootloader";
+
+        mode = lib.mkOption {
+          type = lib.types.enum [
+            "systemd-boot"
+            "lanzaboote"
+          ];
+          default = "systemd-boot";
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
+          boot.loader.efi.canTouchEfiVariables = true;
+        }
+
+        (lib.mkIf (cfg.mode == "systemd-boot") {
+          boot.loader.systemd-boot.enable = true;
+        })
+
+        (lib.mkIf (cfg.mode == "lanzaboote") {
+          boot.loader.systemd-boot.enable = lib.mkForce false;
+          boot.lanzaboote = {
+            enable = true;
+            pkiBundle = "/var/lib/sbctl";
+          };
+        })
+      ]);
+    };
+}
diff --git a/features/onepassword.nix b/features/onepassword.nix
new file mode 100644
index 0000000..d1e5b50
--- /dev/null
+++ b/features/onepassword.nix
@@ -0,0 +1,18 @@
+{
+  nixos =
+    { config, lib, user, ... }:
+    let
+      cfg = config.features.onepassword;
+    in
+    {
+      options.features.onepassword.enable = lib.mkEnableOption "1password";
+
+      config = lib.mkIf cfg.enable {
+        programs._1password.enable = true;
+        programs._1password-gui = {
+          enable = true;
+          polkitPolicyOwners = [ user ];
+        };
+      };
+    };
+}
diff --git a/features/power.nix b/features/power.nix
new file mode 100644
index 0000000..bd580e1
--- /dev/null
+++ b/features/power.nix
@@ -0,0 +1,57 @@
+{
+  nixos =
+    { config, lib, ... }:
+    let
+      cfg = config.features.power;
+    in
+    {
+      options.features.power = {
+        enable = lib.mkEnableOption "laptop power management";
+
+        resumeDevice = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+
+        lidSwitch = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        powerKey = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleAction = lib.mkOption {
+          type = lib.types.str;
+          default = "suspend-then-hibernate";
+        };
+
+        idleActionSec = lib.mkOption {
+          type = lib.types.str;
+          default = "15min";
+        };
+
+        hibernateDelaySec = lib.mkOption {
+          type = lib.types.str;
+          default = "30min";
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        boot.resumeDevice = lib.mkIf (cfg.resumeDevice != null) cfg.resumeDevice;
+
+        services.logind.settings.Login = {
+          HandleLidSwitch = cfg.lidSwitch;
+          HandlePowerKey = cfg.powerKey;
+          IdleAction = cfg.idleAction;
+          IdleActionSec = cfg.idleActionSec;
+        };
+
+        systemd.sleep.settings.Sleep = {
+          HibernateDelaySec = cfg.hibernateDelaySec;
+        };
+      };
+    };
+}
diff --git a/features/udev.nix b/features/udev.nix
new file mode 100644
index 0000000..5e3764e
--- /dev/null
+++ b/features/udev.nix
@@ -0,0 +1,52 @@
+{
+  nixos =
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.features.udev;
+    in
+    {
+      options.features.udev = {
+        enable = lib.mkEnableOption "custom udev rules";
+
+        kindle.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        ledger.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+
+        keyboard-zsa.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        (lib.mkIf cfg.kindle.enable {
+          # NOTE:(@janezicmatej) uses services.udev.packages instead of extraRules
+          # because extraRules writes to 99-local.rules which is too late for uaccess
+          services.udev.packages = [
+            pkgs.libmtp
+            (pkgs.writeTextFile {
+              name = "kindle-udev-rules";
+              text = ''
+                ACTION!="remove", SUBSYSTEM=="usb", ATTRS{idVendor}=="1949", TAG+="uaccess"
+              '';
+              destination = "/etc/udev/rules.d/70-kindle.rules";
+            })
+          ];
+        })
+
+        (lib.mkIf cfg.ledger.enable {
+          hardware.ledger.enable = true;
+        })
+
+        (lib.mkIf cfg.keyboard-zsa.enable {
+          hardware.keyboard.zsa.enable = true;
+        })
+      ]);
+    };
+}