diff --git a/features/greeter.nix b/features/greeter.nix
deleted file mode 100644
index 54bddb6..0000000
--- a/features/greeter.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  nixos =
-    { lib, inputs, ... }:
-    {
-      programs.regreet = {
-        enable = true;
-        # single output to avoid stretching across monitors
-        cageArgs = [
-          "-s"
-          "-m"
-          "last"
-        ];
-        font = {
-          name = lib.mkForce "JetBrainsMono Nerd Font";
-          size = lib.mkForce 14;
-        };
-        settings = {
-          background = {
-            path = lib.mkForce "${inputs.assets}/wallpaper.png";
-            fit = lib.mkForce "Cover";
-          };
-          GTK = {
-            application_prefer_dark_theme = lib.mkForce true;
-          };
-        };
-      };
-    };
-}
diff --git a/features/sway.nix b/features/sway.nix
index 6c8a94c..1bfae7f 100644
--- a/features/sway.nix
+++ b/features/sway.nix
@@ -1,38 +1,91 @@
 {
   nixos =
-    { pkgs, ... }:
+    { config, lib, pkgs, ... }:
+    let
+      cfg = config.features.sway;
+      desktopCfg = config.features.desktop;
+    in
     {
-      programs.sway = {
-        enable = true;
-        package = pkgs.swayfx;
-        wrapperFeatures.gtk = true;
-        extraSessionCommands = ''
-          # fix for java awt apps not rendering
-          export _JAVA_AWT_WM_NONREPARENTING=1
-        '';
+      options.features.sway = {
+        enable = lib.mkEnableOption "sway window manager";
+
+        greeter.enable = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
       };
 
-      environment.systemPackages = with pkgs; [
-        waybar
-        mako
-        wob
-        playerctl
-        brightnessctl
-        foot
-        grim
-        pulseaudio
-        swayidle
-        swaylock-effects
-        jq
-        slurp
-        wl-clipboard
-        pamixer
-        wlsunset
-        satty
-        wayland-pipewire-idle-inhibit
-        fuzzel
-        cliphist
-        zenity
-      ];
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
+          # soft dependency
+          features.desktop.enable = lib.mkDefault true;
+
+          # hard dependency
+          assertions = [
+            {
+              assertion = desktopCfg.enable;
+              message = "features.sway requires features.desktop";
+            }
+          ];
+
+          programs.sway = {
+            enable = true;
+            package = pkgs.swayfx;
+            wrapperFeatures.gtk = true;
+            extraSessionCommands = ''
+              # fix for java awt apps not rendering
+              export _JAVA_AWT_WM_NONREPARENTING=1
+            '';
+          };
+
+          environment.systemPackages = with pkgs; [
+            waybar
+            mako
+            wob
+            playerctl
+            brightnessctl
+            foot
+            grim
+            pulseaudio
+            swayidle
+            swaylock-effects
+            jq
+            slurp
+            wl-clipboard
+            pamixer
+            wlsunset
+            satty
+            wayland-pipewire-idle-inhibit
+            fuzzel
+            cliphist
+            zenity
+          ];
+        }
+
+        # greeter
+        (lib.mkIf cfg.greeter.enable {
+          programs.regreet = {
+            enable = true;
+            cageArgs = [
+              "-s"
+              "-m"
+              "last"
+            ];
+            font = {
+              name = lib.mkForce "JetBrainsMono Nerd Font";
+              size = lib.mkForce 14;
+            };
+            settings = {
+              background = {
+                path = lib.mkForce (toString desktopCfg.theme.wallpaper);
+                fit = lib.mkForce "Cover";
+              };
+              GTK = {
+                application_prefer_dark_theme = lib.mkForce true;
+              };
+            };
+          };
+        })
+      ]);
     };
 }
diff --git a/features/vm-9p-automount.nix b/features/vm-9p-automount.nix
deleted file mode 100644
index bfc9751..0000000
--- a/features/vm-9p-automount.nix
+++ /dev/null
@@ -1,72 +0,0 @@
-{
-  nixos =
-    {
-      pkgs,
-      lib,
-      config,
-      ...
-    }:
-    let
-      inherit (config.vm-9p-automount) user;
-      inherit (config.users.users.${user}) home group;
-    in
-    {
-      options = {
-        vm-9p-automount = {
-          user = lib.mkOption {
-            type = lib.types.str;
-          };
-
-          prefix = lib.mkOption {
-            type = lib.types.str;
-            default = "m_";
-          };
-
-          basePath = lib.mkOption {
-            type = lib.types.str;
-            default = "${home}/mnt";
-          };
-        };
-      };
-
-      config = {
-        systemd.services.vm-9p-automount = {
-          description = "Auto-discover and mount 9p shares";
-          after = [
-            "local-fs.target"
-            "nss-user-lookup.target"
-            "systemd-modules-load.service"
-          ];
-          wants = [ "systemd-modules-load.service" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-            ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
-              BASE="${config.vm-9p-automount.basePath}"
-              PREFIX="${config.vm-9p-automount.prefix}"
-              mkdir -p "$BASE"
-              chown ${user}:${group} "$BASE"
-
-              for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
-                [ -f "$tagfile" ] || continue
-                tag=$(tr -d '\0' < "$tagfile")
-
-                case "$tag" in
-                  "$PREFIX"*) ;;
-                  *) continue ;;
-                esac
-
-                name="''${tag#"$PREFIX"}"
-                target="$BASE/$name"
-
-                mkdir -p "$target"
-                ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
-                  -o trans=virtio,version=9p2000.L || continue
-              done
-            '';
-          };
-        };
-      };
-    };
-}
diff --git a/features/vm-guest.nix b/features/vm-guest.nix
index 0d6e7af..8014528 100644
--- a/features/vm-guest.nix
+++ b/features/vm-guest.nix
@@ -6,42 +6,110 @@
       config,
       ...
     }:
+    let
+      cfg = config.features.vm-guest;
+      autoUser = cfg.automount.user;
+      autoHome = config.users.users.${autoUser}.home;
+      autoGroup = config.users.users.${autoUser}.group;
+    in
     {
-      options = {
-        vm-guest.headless = lib.mkOption {
+      options.features.vm-guest = {
+        enable = lib.mkEnableOption "qemu vm guest";
+
+        headless = lib.mkOption {
           type = lib.types.bool;
           default = false;
         };
-      };
 
-      config = {
-        services.qemuGuest.enable = true;
-        services.spice-vdagentd.enable = lib.mkIf (!config.vm-guest.headless) true;
+        automount = {
+          enable = lib.mkEnableOption "9p share automount";
 
-        boot.kernelParams = lib.mkIf config.vm-guest.headless [ "console=ttyS0,115200" ];
+          user = lib.mkOption {
+            type = lib.types.str;
+          };
 
-        boot.initrd.availableKernelModules = [
-          "9p"
-          "9pnet_virtio"
-        ];
-        boot.kernelModules = [
-          "9p"
-          "9pnet_virtio"
-        ];
+          prefix = lib.mkOption {
+            type = lib.types.str;
+            default = "m_";
+          };
 
-        networking = {
-          useDHCP = true;
-          firewall.allowedTCPPorts = [ 22 ];
+          basePath = lib.mkOption {
+            type = lib.types.str;
+            default = "${autoHome}/mnt";
+          };
         };
-
-        security.sudo.wheelNeedsPassword = false;
-
-        environment.systemPackages = with pkgs; [
-          curl
-          wget
-          htop
-          sshfs
-        ];
       };
+
+      config = lib.mkIf cfg.enable (lib.mkMerge [
+        {
+          services.qemuGuest.enable = true;
+          services.spice-vdagentd.enable = lib.mkIf (!cfg.headless) true;
+
+          boot.kernelParams = lib.mkIf cfg.headless [ "console=ttyS0,115200" ];
+
+          boot.initrd.availableKernelModules = [
+            "9p"
+            "9pnet_virtio"
+          ];
+          boot.kernelModules = [
+            "9p"
+            "9pnet_virtio"
+          ];
+
+          networking = {
+            useDHCP = true;
+            firewall.allowedTCPPorts = [ 22 ];
+          };
+
+          security.sudo.wheelNeedsPassword = false;
+
+          environment.systemPackages = with pkgs; [
+            curl
+            wget
+            htop
+            sshfs
+          ];
+        }
+
+        (lib.mkIf cfg.automount.enable {
+          systemd.services.vm-9p-automount = {
+            description = "Auto-discover and mount 9p shares";
+            after = [
+              "local-fs.target"
+              "nss-user-lookup.target"
+              "systemd-modules-load.service"
+            ];
+            wants = [ "systemd-modules-load.service" ];
+            wantedBy = [ "multi-user.target" ];
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+              ExecStart = pkgs.writeShellScript "vm-9p-automount" ''
+                BASE="${cfg.automount.basePath}"
+                PREFIX="${cfg.automount.prefix}"
+                mkdir -p "$BASE"
+                chown ${autoUser}:${autoGroup} "$BASE"
+
+                for tagfile in $(find /sys/devices -name mount_tag 2>/dev/null); do
+                  [ -f "$tagfile" ] || continue
+                  tag=$(tr -d '\0' < "$tagfile")
+
+                  case "$tag" in
+                    "$PREFIX"*) ;;
+                    *) continue ;;
+                  esac
+
+                  name="''${tag#"$PREFIX"}"
+                  target="$BASE/$name"
+
+                  mkdir -p "$target"
+                  ${pkgs.util-linux}/bin/mount -t 9p "$tag" "$target" \
+                    -o trans=virtio,version=9p2000.L || continue
+                done
+              '';
+            };
+          };
+        })
+      ]);
     };
 }
diff --git a/features/yubikey.nix b/features/yubikey.nix
deleted file mode 100644
index 966a1aa..0000000
--- a/features/yubikey.nix
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  nixos =
-    { pkgs, ... }:
-    {
-      environment.systemPackages = with pkgs; [
-        yubikey-personalization
-        yubikey-manager
-      ];
-
-      services.pcscd.enable = true;
-    };
-}