diff --git a/hosts/idols-ai/preservation.nix b/hosts/idols-ai/preservation.nix
index 84e5c992..53126554 100644
--- a/hosts/idols-ai/preservation.nix
+++ b/hosts/idols-ai/preservation.nix
@@ -49,6 +49,8 @@ in
       "/etc/agenix/"
 
       "/var/log"
+      # system caches (e.g. restic, plocate; slow to rebuild)
+      "/var/cache"
 
       # system-core
       "/var/lib/nixos"
diff --git a/modules/nixos/base/locate.nix b/modules/nixos/base/locate.nix
new file mode 100644
index 00000000..3a6f4741
--- /dev/null
+++ b/modules/nixos/base/locate.nix
@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+{
+  # Whole-filesystem filename search (`locate`), backed by plocate. It complements
+  # `nix-index`/`nix-locate`, which only index the nix store.
+  #
+  # The database lives at /var/cache/locatedb. Hosts with an ephemeral root must
+  # persist /var/cache as a directory (see hosts/idols-ai/preservation.nix): plocate
+  # replaces the DB via a temp file + rename, which fails on a bind-mounted file.
+  services.locate = {
+    enable = true;
+    package = pkgs.plocate;
+  };
+}
diff --git a/modules/nixos/desktop/containers.nix b/modules/nixos/desktop/containers.nix
index 3f12e63f..5e949bd4 100644
--- a/modules/nixos/desktop/containers.nix
+++ b/modules/nixos/desktop/containers.nix
@@ -20,5 +20,10 @@
         flags = [ "--all" ];
       };
     };
+
+    # Bound container log growth. Podman uses journald when the journal is
+    # writable, but rootless sessions can fall back to a file driver
+    # (k8s-file / json-file), which otherwise grows without limit.
+    containers.containersConf.settings.containers.log_size_max = 10 * 1024 * 1024;
   };
 }