diff --git a/install/config/hardware/apple/fix-spi-keyboard.sh b/install/config/hardware/apple/fix-spi-keyboard.sh
index d2aa6c4b..29d359d8 100644
--- a/install/config/hardware/apple/fix-spi-keyboard.sh
+++ b/install/config/hardware/apple/fix-spi-keyboard.sh
@@ -4,9 +4,12 @@ if [[ $product_name =~ MacBook[89],1|MacBook1[02],1|MacBookPro13,[123]|MacBookPr
   echo "Detected MacBook with SPI keyboard"
 
   omarchy-pkg-add macbook12-spi-driver-dkms
+  mkdir -p /etc/mkinitcpio.conf.d
   if [[ $product_name == "MacBook8,1" ]]; then
-    echo "MODULES=(applespi spi_pxa2xx_platform spi_pxa2xx_pci)" | sudo tee /etc/mkinitcpio.conf.d/macbook_spi_modules.conf >/dev/null
+    echo "MODULES=(applespi spi_pxa2xx_platform spi_pxa2xx_pci)" > \
+      /etc/mkinitcpio.conf.d/macbook_spi_modules.conf
   else
-    echo "MODULES=(applespi intel_lpss_pci spi_pxa2xx_platform)" | sudo tee /etc/mkinitcpio.conf.d/macbook_spi_modules.conf >/dev/null
+    echo "MODULES=(applespi intel_lpss_pci spi_pxa2xx_platform)" > \
+      /etc/mkinitcpio.conf.d/macbook_spi_modules.conf
   fi
 fi
diff --git a/install/config/hardware/apple/fix-suspend-nvme.sh b/install/config/hardware/apple/fix-suspend-nvme.sh
index 863242a1..d761bd01 100644
--- a/install/config/hardware/apple/fix-suspend-nvme.sh
+++ b/install/config/hardware/apple/fix-suspend-nvme.sh
@@ -10,7 +10,8 @@ if [[ $MACBOOK_MODEL =~ MacBook(8,1|9,1|10,1)|MacBookPro13,[123]|MacBookPro14,[1
   if [[ -f $NVME_DEVICE ]]; then
     echo "Applying NVMe suspend fix..."
 
-    cat <<EOF | sudo tee /etc/systemd/system/omarchy-nvme-suspend-fix.service >/dev/null
+    mkdir -p /etc/systemd/system
+    cat > /etc/systemd/system/omarchy-nvme-suspend-fix.service <<'EOF'
 [Unit]
 Description=Omarchy NVMe Suspend Fix for MacBook
 
@@ -21,8 +22,7 @@ ExecStart=/bin/bash -c 'echo 0 > /sys/bus/pci/devices/0000\:01\:00.0/d3cold_allo
 WantedBy=multi-user.target
 EOF
 
-    chrootable_systemctl_enable omarchy-nvme-suspend-fix.service
-    sudo systemctl daemon-reload
+    systemctl enable omarchy-nvme-suspend-fix.service
   else
     echo "Warning: NVMe device not found at expected PCI address (0000:01:00.0)"
     echo "This fix may not be needed for this MacBook model"
diff --git a/install/config/hardware/apple/fix-t2.sh b/install/config/hardware/apple/fix-t2.sh
index 815ed72f..ef0103d5 100644
--- a/install/config/hardware/apple/fix-t2.sh
+++ b/install/config/hardware/apple/fix-t2.sh
@@ -12,29 +12,35 @@ if lspci -nn | grep -q "106b:180[12]"; then
     tiny-dfr
 
   # Add user to video group (required for tiny-dfr to access /dev/dri devices)
-  sudo usermod -aG video ${USER}
+  usermod -aG video "${OMARCHY_INSTALL_USER:-${USER:-}}"
 
   # Enable T2 services
-  sudo systemctl enable t2fanrd.service
-  sudo systemctl enable tiny-dfr.service
+  systemctl enable t2fanrd.service
+  systemctl enable tiny-dfr.service
 
-  echo "apple-bce" | sudo tee /etc/modules-load.d/t2.conf >/dev/null
-  echo "hci_bcm4377" | sudo tee -a /etc/modules-load.d/t2.conf >/dev/null
+  mkdir -p /etc/modules-load.d
+  {
+    echo "apple-bce"
+    echo "hci_bcm4377"
+  } > /etc/modules-load.d/t2.conf
 
-  echo "MODULES+=(apple-bce usbhid hid_apple hid_generic xhci_pci xhci_hcd)" | sudo tee /etc/mkinitcpio.conf.d/apple-t2.conf >/dev/null
+  mkdir -p /etc/mkinitcpio.conf.d
+  echo "MODULES+=(apple-bce usbhid hid_apple hid_generic xhci_pci xhci_hcd)" > \
+    /etc/mkinitcpio.conf.d/apple-t2.conf
 
-  cat <<EOF | sudo tee /etc/modprobe.d/brcmfmac.conf >/dev/null
+  mkdir -p /etc/modprobe.d
+  cat > /etc/modprobe.d/brcmfmac.conf <<'EOF'
 # Fix for T2 MacBook WiFi connectivity issues
 options brcmfmac feature_disable=0x82000
 EOF
 
-  sudo mkdir -p /etc/limine-entry-tool.d
-  cat <<EOF | sudo tee /etc/limine-entry-tool.d/t2-mac.conf >/dev/null
+  mkdir -p /etc/limine-entry-tool.d
+  cat > /etc/limine-entry-tool.d/t2-mac.conf <<'EOF'
 # Generated by Omarchy installer for T2 Mac support
 KERNEL_CMDLINE[default]+=" intel_iommu=on iommu=pt pcie_ports=compat"
 EOF
 
-  cat <<EOF | sudo tee /etc/t2fand.conf >/dev/null
+  cat > /etc/t2fand.conf <<'EOF'
 [Fan1]
 low_temp=55
 high_temp=75
diff --git a/install/config/hardware/asus/fix-asus-ptl-b9406-display.sh b/install/config/hardware/asus/fix-asus-ptl-b9406-display.sh
index b77a45c4..7c6cb23a 100644
--- a/install/config/hardware/asus/fix-asus-ptl-b9406-display.sh
+++ b/install/config/hardware/asus/fix-asus-ptl-b9406-display.sh
@@ -7,8 +7,8 @@
 # xe.enable_psr=0 knob does not cover Panel Replay.
 
 if omarchy-hw-asus-expertbook-b9406; then
-  sudo mkdir -p /etc/limine-entry-tool.d
-  cat <<EOF | sudo tee /etc/limine-entry-tool.d/asus-expertbook-b9406-display.conf >/dev/null
+  mkdir -p /etc/limine-entry-tool.d
+  cat > /etc/limine-entry-tool.d/asus-expertbook-b9406-display.conf <<'EOF'
 # ASUS ExpertBook B9406 (Panther Lake / Xe3) display workaround
 KERNEL_CMDLINE[default]+=" xe.enable_panel_replay=0"
 EOF
diff --git a/install/config/hardware/asus/fix-asus-ptl-b9406-touchpad.sh b/install/config/hardware/asus/fix-asus-ptl-b9406-touchpad.sh
index d39da070..265e8114 100644
--- a/install/config/hardware/asus/fix-asus-ptl-b9406-touchpad.sh
+++ b/install/config/hardware/asus/fix-asus-ptl-b9406-touchpad.sh
@@ -10,8 +10,8 @@
 # Asus UX302LA entry in libinput's shipped 50-system-asus.quirks.
 
 if omarchy-hw-asus-expertbook-b9406; then
-  sudo mkdir -p /etc/libinput
-  sudo tee /etc/libinput/asus-expertbook-b9406.quirks >/dev/null <<EOF
+  mkdir -p /etc/libinput
+  cat > /etc/libinput/asus-expertbook-b9406.quirks <<'EOF'
 [ASUS ExpertBook B9406 Touchpad]
 MatchBus=i2c
 MatchUdevType=touchpad
diff --git a/install/config/hardware/asus/fix-asus-ptl-display-backlight.sh b/install/config/hardware/asus/fix-asus-ptl-display-backlight.sh
index cc851061..252a1c61 100644
--- a/install/config/hardware/asus/fix-asus-ptl-display-backlight.sh
+++ b/install/config/hardware/asus/fix-asus-ptl-display-backlight.sh
@@ -8,8 +8,8 @@
 # but produce no visible change; brightness is effectively binary.
 
 if omarchy-hw-asus-expertbook-b9406 || omarchy-hw-asus-zenbook-ux5406aa; then
-  sudo mkdir -p /etc/limine-entry-tool.d
-  cat <<EOF | sudo tee /etc/limine-entry-tool.d/asus-ptl-display-backlight.conf >/dev/null
+  mkdir -p /etc/limine-entry-tool.d
+  cat > /etc/limine-entry-tool.d/asus-ptl-display-backlight.conf <<'EOF'
 # ASUS Panther Lake display backlight fix
 KERNEL_CMDLINE[default]+=" xe.enable_dpcd_backlight=1"
 EOF
diff --git a/install/config/hardware/asus/fix-audio-mixer.sh b/install/config/hardware/asus/fix-audio-mixer.sh
index 7380721f..dd30c496 100644
--- a/install/config/hardware/asus/fix-audio-mixer.sh
+++ b/install/config/hardware/asus/fix-audio-mixer.sh
@@ -2,7 +2,7 @@
 
 if omarchy-hw-asus-rog; then
   mkdir -p ~/.config/wireplumber/wireplumber.conf.d/
-  cp $OMARCHY_PATH/default/wireplumber/wireplumber.conf.d/alsa-soft-mixer.conf ~/.config/wireplumber/wireplumber.conf.d/
+  cp "$OMARCHY_PATH/default/wireplumber/wireplumber.conf.d/alsa-soft-mixer.conf" ~/.config/wireplumber/wireplumber.conf.d/
   rm -rf ~/.local/state/wireplumber/default-routes
 
   # Unmute the Master control on the ALC285 card (often muted by default)
diff --git a/install/config/hardware/asus/fix-z13-touchpad.sh b/install/config/hardware/asus/fix-z13-touchpad.sh
index 0df729ff..4db3970f 100644
--- a/install/config/hardware/asus/fix-z13-touchpad.sh
+++ b/install/config/hardware/asus/fix-z13-touchpad.sh
@@ -11,8 +11,8 @@
 # so dwt can properly pair it with the keyboard.
 
 if omarchy-hw-asus-rog && omarchy-hw-match "GZ302"; then
-  sudo tee /etc/udev/rules.d/99-omarchy-asus-z13-touchpad.rules > /dev/null <<'EOF'
+  mkdir -p /etc/udev/rules.d
+  cat > /etc/udev/rules.d/99-omarchy-asus-z13-touchpad.rules <<'EOF'
 ACTION=="add|change", KERNEL=="event*", ATTRS{idVendor}=="0b05", ATTRS{idProduct}=="1a30", ENV{ID_INPUT_TOUCHPAD}=="1", ENV{ID_INPUT_TOUCHPAD_INTEGRATION}="internal"
 EOF
-  sudo udevadm control --reload-rules
 fi
diff --git a/install/config/hardware/bluetooth.sh b/install/config/hardware/bluetooth.sh
index 68776e0b..d78cad49 100644
--- a/install/config/hardware/bluetooth.sh
+++ b/install/config/hardware/bluetooth.sh
@@ -1,12 +1,4 @@
 # Persist last power state across reboots (default AutoEnable=true overrides it)
-sudo sed -i 's/^#\?AutoEnable=.*/AutoEnable=false/' /etc/bluetooth/main.conf
-
-mkdir -p ~/.config/wireplumber/wireplumber.conf.d/
-cp "$OMARCHY_PATH/default/wireplumber/wireplumber.conf.d/bluetooth-a2dp-autoconnect.conf" ~/.config/wireplumber/wireplumber.conf.d/
-
-# Quickshell.Bluetooth has no Agent API, so the omarchy.bluetooth plugin
-# can't answer the auth prompts bluez issues during pair(). bt-agent registers
-# a NoInputNoOutput agent on the system bus so pair() actually completes.
-mkdir -p ~/.config/systemd/user/
-cp "$OMARCHY_PATH/config/systemd/user/bt-agent.service" ~/.config/systemd/user/
-systemctl --user enable bt-agent.service
+if [[ -f /etc/bluetooth/main.conf ]]; then
+  sed -i 's/^#\?AutoEnable=.*/AutoEnable=false/' /etc/bluetooth/main.conf
+fi
diff --git a/install/config/hardware/fix-fkeys.sh b/install/config/hardware/fix-fkeys.sh
index d0b43154..73b107f9 100644
--- a/install/config/hardware/fix-fkeys.sh
+++ b/install/config/hardware/fix-fkeys.sh
@@ -1,4 +1,5 @@
 # Ensure that F-keys on Apple-like keyboards (such as Lofree Flow84) are always F-keys
 if [[ ! -f /etc/modprobe.d/hid_apple.conf ]]; then
-  echo "options hid_apple fnmode=2" | sudo tee /etc/modprobe.d/hid_apple.conf
+  mkdir -p /etc/modprobe.d
+  echo "options hid_apple fnmode=2" > /etc/modprobe.d/hid_apple.conf
 fi
diff --git a/install/config/hardware/fix-surface-keyboard.sh b/install/config/hardware/fix-surface-keyboard.sh
index 2211db62..8f71c9be 100644
--- a/install/config/hardware/fix-surface-keyboard.sh
+++ b/install/config/hardware/fix-surface-keyboard.sh
@@ -11,13 +11,13 @@ if omarchy-hw-surface; then
   fi
 
   echo "Attempting to autodetect required pinctrl module"
-  pinctrl_module=$(lsmod | grep pinctrl_ | cut -f 1 -d" ")
+  pinctrl_module=$(lsmod | grep pinctrl_ | cut -f 1 -d" " || true)
   if [[ -z $pinctrl_module ]]; then
     echo "Failed to autodetect pinctrl module."
   else
     echo "Detected pinctrl module: $pinctrl_module"
+    mkdir -p /etc/mkinitcpio.conf.d
+    echo "MODULES=(${pinctrl_module} surface_aggregator surface_aggregator_registry surface_aggregator_hub surface_hid_core surface_hid surface_kbd intel_lpss_pci 8250_dw)" > \
+      /etc/mkinitcpio.conf.d/surface_device_modules.conf
   fi
-
-  echo "MODULES=(${pinctrl_module} surface_aggregator surface_aggregator_registry surface_aggregator_hub surface_hid_core surface_hid surface_kbd intel_lpss_pci 8250_dw)" | sudo tee /etc/mkinitcpio.conf.d/surface_device_modules.conf >/dev/null
-
 fi
diff --git a/install/config/hardware/fix-synaptic-touchpad.sh b/install/config/hardware/fix-synaptic-touchpad.sh
index cc726520..d30dd271 100644
--- a/install/config/hardware/fix-synaptic-touchpad.sh
+++ b/install/config/hardware/fix-synaptic-touchpad.sh
@@ -2,5 +2,5 @@
 
 if grep -qi synaptics /proc/bus/input/devices \
    && ! lsmod | grep -q '^psmouse'; then
-    modprobe psmouse synaptics_intertouch=1
-fi
\ No newline at end of file
+  modprobe psmouse synaptics_intertouch=1
+fi
diff --git a/install/config/hardware/fix-tuxedo-backlight.sh b/install/config/hardware/fix-tuxedo-backlight.sh
index 87440873..caf9803b 100644
--- a/install/config/hardware/fix-tuxedo-backlight.sh
+++ b/install/config/hardware/fix-tuxedo-backlight.sh
@@ -6,10 +6,11 @@ if cat /sys/class/dmi/id/sys_vendor 2>/dev/null | grep -qi "TUXEDO\|Slimbook"; t
   # Blacklist the legacy clevo_xsm_wmi module which conflicts with the tuxedo-drivers
   # clevo_wmi module. When clevo_xsm_wmi loads first, it grabs the Clevo WMI GUIDs,
   # preventing tuxedo-drivers from initializing the keyboard backlight properly.
-  echo "blacklist clevo_xsm_wmi" | sudo tee /etc/modprobe.d/blacklist-clevo-xsm-wmi.conf > /dev/null
+  mkdir -p /etc/modprobe.d
+  echo "blacklist clevo_xsm_wmi" > /etc/modprobe.d/blacklist-clevo-xsm-wmi.conf
 
   # Remove any orphaned clevo_xsm_wmi module files not managed by a package
   for f in /lib/modules/*/extra/clevo-xsm-wmi.ko; do
-    [ -f "$f" ] && sudo rm "$f"
+    [ -f "$f" ] && rm "$f"
   done
 fi
diff --git a/install/config/hardware/framework/qmk-hid.sh b/install/config/hardware/framework/qmk-hid.sh
index 5fb46847..8e0a67a8 100644
--- a/install/config/hardware/framework/qmk-hid.sh
+++ b/install/config/hardware/framework/qmk-hid.sh
@@ -1,9 +1,8 @@
 # Allow unprivileged access to the Framework 16 keyboard for RGB control via qmk_hid.
 
 if omarchy-hw-framework16; then
+  mkdir -p /etc/udev/rules.d
   if [[ ! -f /etc/udev/rules.d/50-framework16-qmk-hid.rules ]]; then
-    sudo cp "$OMARCHY_PATH/default/udev/framework16-qmk-hid.rules" /etc/udev/rules.d/50-framework16-qmk-hid.rules
-    sudo udevadm control --reload-rules
-    sudo udevadm trigger
+    cp -f "$OMARCHY_PATH/default/udev/framework16-qmk-hid.rules" /etc/udev/rules.d/50-framework16-qmk-hid.rules
   fi
 fi
diff --git a/install/config/hardware/intel/fix-wifi7-eht.sh b/install/config/hardware/intel/fix-wifi7-eht.sh
index 9ca048cb..8d73095c 100644
--- a/install/config/hardware/intel/fix-wifi7-eht.sh
+++ b/install/config/hardware/intel/fix-wifi7-eht.sh
@@ -6,7 +6,8 @@
 # This should be removed when Intel fixes the firmware/driver.
 
 if lspci -nn | grep -qE '\[8086:(e440|272b)\]'; then
-  sudo tee /etc/modprobe.d/iwlwifi-disable-eht.conf <<'EOF'
+  mkdir -p /etc/modprobe.d
+  cat > /etc/modprobe.d/iwlwifi-disable-eht.conf <<'EOF'
 # Temporary fix Dell XPS 14/16 on Panther lake
 # Disable WiFi 7 (EHT) on Intel BE200/BE211 — broken RX rate adaptation
 # Remove this file when fixes land in the iwlwifi EHT data path
diff --git a/install/config/hardware/intel/fred.sh b/install/config/hardware/intel/fred.sh
index c25e4c79..fcc4d3c2 100644
--- a/install/config/hardware/intel/fred.sh
+++ b/install/config/hardware/intel/fred.sh
@@ -4,15 +4,15 @@ DROP_IN="/etc/limine-entry-tool.d/intel-panther-lake-fred.conf"
 DEFAULT_LIMINE="/etc/default/limine"
 
 if omarchy-hw-intel-ptl; then
-  if [[ ! -f $DROP_IN ]] || ! grep -q 'fred=on' "$DROP_IN"; then
-    sudo mkdir -p /etc/limine-entry-tool.d
-    cat <<EOF | sudo tee "$DROP_IN" >/dev/null
+  if [[ ! -f "$DROP_IN" ]] || ! grep -q 'fred=on' "$DROP_IN"; then
+    mkdir -p /etc/limine-entry-tool.d
+    cat > "$DROP_IN" <<EOF
 # Intel Panther Lake FRED support
 KERNEL_CMDLINE[default]+=" fred=on"
 EOF
   fi
 
-  if [[ -f $DEFAULT_LIMINE ]] && ! grep -q 'fred=on' "$DEFAULT_LIMINE"; then
-    sudo tee -a "$DEFAULT_LIMINE" < "$DROP_IN" >/dev/null
+  if [[ -f "$DEFAULT_LIMINE" ]] && ! grep -q 'fred=on' "$DEFAULT_LIMINE"; then
+    cat "$DROP_IN" >> "$DEFAULT_LIMINE"
   fi
 fi
diff --git a/install/config/hardware/intel/lpmd.sh b/install/config/hardware/intel/lpmd.sh
index ad8cf374..0073593b 100644
--- a/install/config/hardware/intel/lpmd.sh
+++ b/install/config/hardware/intel/lpmd.sh
@@ -6,6 +6,6 @@ if omarchy-hw-intel && omarchy-battery-present; then
   cpu_model=$(grep -m1 "^model\s*:" /proc/cpuinfo 2>/dev/null | cut -d: -f2 | tr -d ' ')
   if [[ "$cpu_model" =~ ^(151|154|170|172|183|186|189|191|204)$ ]]; then
     omarchy-pkg-add intel-lpmd
-    sudo systemctl enable intel_lpmd.service
+    systemctl enable intel_lpmd.service
   fi
 fi
diff --git a/install/config/hardware/intel/ptl-kernel.sh b/install/config/hardware/intel/ptl-kernel.sh
index d914cf25..65de3c3b 100644
--- a/install/config/hardware/intel/ptl-kernel.sh
+++ b/install/config/hardware/intel/ptl-kernel.sh
@@ -5,12 +5,10 @@ if omarchy-hw-match "XPS" && omarchy-hw-intel-ptl; then
   echo "Detected Dell XPS Panther Lake, installing PTL kernel..."
 
   omarchy-pkg-add linux-ptl linux-ptl-headers
-  for pkg in linux linux-headers; do
-    sudo pacman -Rdd --noconfirm "$pkg" 2>/dev/null || true
-  done
+  pacman -Rdd --noconfirm linux linux-headers 2>/dev/null || true
 
-  sudo mkdir -p /etc/limine-entry-tool.d
-  cat <<EOF | sudo tee /etc/limine-entry-tool.d/dell-xps-panther-lake.conf >/dev/null
+  mkdir -p /etc/limine-entry-tool.d
+  cat > /etc/limine-entry-tool.d/dell-xps-panther-lake.conf <<'EOF'
 # Only show Panther Lake kernel in boot menu on Dell XPS Panther Lake
 BOOT_ORDER="linux-ptl*, *fallback, Snapshots"
 EOF
diff --git a/install/config/hardware/intel/thermald.sh b/install/config/hardware/intel/thermald.sh
index af771bbc..6a901d60 100644
--- a/install/config/hardware/intel/thermald.sh
+++ b/install/config/hardware/intel/thermald.sh
@@ -4,8 +4,9 @@
 if omarchy-hw-intel; then
   # Check if Sandy Bridge or newer (model >= 42). Sandy Bridge: model 42 (mobile), 45 (desktop)
   cpu_model=$(grep -m1 "^model\s*:" /proc/cpuinfo 2>/dev/null | cut -d: -f2 | tr -d ' ')
+  cpu_model=${cpu_model:-0}
   if ((cpu_model >= 42)) && omarchy-battery-present; then
     omarchy-pkg-add thermald
-    sudo systemctl enable thermald
+    systemctl enable thermald.service
   fi
 fi
diff --git a/install/config/hardware/lenovo/fix-yoga-pro7-bass-speakers.sh b/install/config/hardware/lenovo/fix-yoga-pro7-bass-speakers.sh
index 4459f0ae..d46c6331 100644
--- a/install/config/hardware/lenovo/fix-yoga-pro7-bass-speakers.sh
+++ b/install/config/hardware/lenovo/fix-yoga-pro7-bass-speakers.sh
@@ -4,7 +4,8 @@
 # Reference: https://wiki.archlinux.org/title/Lenovo_Yoga_9i_2022_(14AiPI7)
 
 if omarchy-hw-match "Yoga Pro 7 14IAH10"; then
-  sudo tee /etc/modprobe.d/lenovo-yoga-pro7-bass.conf <<'EOF'
+  mkdir -p /etc/modprobe.d
+  cat > /etc/modprobe.d/lenovo-yoga-pro7-bass.conf <<'EOF'
 options snd-sof-intel-hda-generic hda_model=alc287-yoga9-bass-spk-pin
 EOF
 fi
diff --git a/install/config/hardware/nvidia.sh b/install/config/hardware/nvidia.sh
index c38f8e98..b10985cf 100644
--- a/install/config/hardware/nvidia.sh
+++ b/install/config/hardware/nvidia.sh
@@ -1,49 +1,33 @@
 if lspci | grep -qi 'nvidia'; then
   # Check which kernel is installed and set appropriate headers package
-  KERNEL_HEADERS="$(pacman -Qqs '^linux(-zen|-lts|-hardened)?$' | head -1)-headers"
+  KERNEL_PACKAGE=$(pacman -Qqs '^linux(-zen|-lts|-hardened|-t2|-ptl)?$' | head -1 || true)
+  [[ -n $KERNEL_PACKAGE ]] && omarchy-pkg-add "$KERNEL_PACKAGE-headers"
 
   if omarchy-hw-nvidia-gsp; then
     PACKAGES=(nvidia-open-dkms nvidia-utils lib32-nvidia-utils libva-nvidia-driver)
-    GPU_ARCH="turing_plus"
   elif omarchy-hw-nvidia-without-gsp; then
     PACKAGES=(nvidia-580xx-dkms nvidia-580xx-utils lib32-nvidia-580xx-utils)
-    GPU_ARCH="maxwell_pascal_volta"
   fi
+
   # Bail if no supported GPU
   if [[ -z ${PACKAGES+x} ]]; then
     echo "No compatible driver for your NVIDIA GPU. See: https://wiki.archlinux.org/title/NVIDIA"
     exit 0
   fi
 
-  omarchy-pkg-add "$KERNEL_HEADERS" "${PACKAGES[@]}"
+  omarchy-pkg-add "${PACKAGES[@]}"
+
+  # Per-user Hyprland NVIDIA env vars are handled by nvidia-user.sh.
 
   # Configure modprobe for early KMS
-  sudo tee /etc/modprobe.d/nvidia.conf <<EOF >/dev/null
+  mkdir -p /etc/modprobe.d
+  cat > /etc/modprobe.d/nvidia.conf <<'EOF'
 options nvidia_drm modeset=1
 EOF
 
   # Configure mkinitcpio for early loading
-  sudo tee /etc/mkinitcpio.conf.d/nvidia.conf <<EOF >/dev/null
+  mkdir -p /etc/mkinitcpio.conf.d
+  cat > /etc/mkinitcpio.conf.d/nvidia.conf <<'EOF'
 MODULES+=(nvidia nvidia_modeset nvidia_uvm nvidia_drm)
 EOF
-
-  # Add NVIDIA environment variables based on GPU architecture
-  if [[ $GPU_ARCH = "turing_plus" ]]; then
-    # Turing+ (RTX 20xx, GTX 16xx, and newer) with GSP firmware support
-    cat >>"$HOME/.config/hypr/envs.lua" <<'EOF'
-
--- NVIDIA (Turing+ with GSP firmware)
-hl.env("NVD_BACKEND", "direct")
-hl.env("LIBVA_DRIVER_NAME", "nvidia")
-hl.env("__GLX_VENDOR_LIBRARY_NAME", "nvidia")
-EOF
-  elif [[ $GPU_ARCH = "maxwell_pascal_volta" ]]; then
-    # Maxwell/Pascal/Volta (GTX 9xx/10xx, GT 10xx, Quadro P/M/GV, MX series, Titan X/Xp/V) lack GSP firmware
-    cat >>"$HOME/.config/hypr/envs.lua" <<'EOF'
-
--- NVIDIA (Maxwell/Pascal/Volta without GSP firmware)
-hl.env("NVD_BACKEND", "egl")
-hl.env("__GLX_VENDOR_LIBRARY_NAME", "nvidia")
-EOF
-  fi
 fi
diff --git a/install/config/hardware/set-wireless-regdom.sh b/install/config/hardware/set-wireless-regdom.sh
index 8524f2d3..7a9fdd12 100644
--- a/install/config/hardware/set-wireless-regdom.sh
+++ b/install/config/hardware/set-wireless-regdom.sh
@@ -1,33 +1,24 @@
-# First check that wireless-regdb is there
-if [[ -f "/etc/conf.d/wireless-regdom" ]]; then
-  unset WIRELESS_REGDOM
-  . /etc/conf.d/wireless-regdom
+# Persist wireless regulatory domain based on the target timezone. Install is
+# followed by reboot, so don't mutate live Wi-Fi state with `iw reg set`.
+regdom_file=/etc/conf.d/wireless-regdom
+[[ -f $regdom_file ]] || exit 0
+
+if grep -q '^WIRELESS_REGDOM=' "$regdom_file"; then
+  exit 0
 fi
 
-# If the region is already set, we're done
-if [[ ! -n ${WIRELESS_REGDOM} ]]; then
-  # Get the current timezone
-  if [[ -e "/etc/localtime" ]]; then
-    TIMEZONE=$(readlink -f /etc/localtime)
-    TIMEZONE=${TIMEZONE#/usr/share/zoneinfo/}
-
-    # Some timezones are formatted with the two letter country code at the start
-    COUNTRY="${TIMEZONE%%/*}"
-
-    # If we don't have a two letter country, get it from the timezone table
-    if [[ ! $COUNTRY =~ ^[A-Z]{2}$ ]] && [[ -f /usr/share/zoneinfo/zone.tab ]]; then
-      COUNTRY=$(awk -v tz="$TIMEZONE" '$3 == tz {print $1; exit}' /usr/share/zoneinfo/zone.tab)
-    fi
-
-    # Check if we have a two letter country code
-    if [[ $COUNTRY =~ ^[A-Z]{2}$ ]]; then
-      # Append it to the wireless-regdom conf file that is used at boot
-      echo "WIRELESS_REGDOM=\"$COUNTRY\"" | sudo tee -a /etc/conf.d/wireless-regdom >/dev/null
-
-      # Also set it one off now
-      if command -v iw &>/dev/null; then
-        sudo iw reg set ${COUNTRY}
-      fi
-    fi
-  fi
+timezone=""
+if [[ -e /etc/localtime ]]; then
+  timezone=$(readlink -f /etc/localtime || true)
+  timezone=${timezone#/usr/share/zoneinfo/}
+fi
+
+country="${timezone%%/*}"
+zone_tab=/usr/share/zoneinfo/zone.tab
+if [[ ! $country =~ ^[A-Z]{2}$ && -n $timezone && -f $zone_tab ]]; then
+  country=$(awk -v tz="$timezone" '$3 == tz {print $1; exit}' "$zone_tab")
+fi
+
+if [[ $country =~ ^[A-Z]{2}$ ]]; then
+  echo "WIRELESS_REGDOM=\"$country\"" >> "$regdom_file"
 fi