diff --git a/hosts/12kingdoms-shoryu/default.nix b/hosts/12kingdoms-shoryu/default.nix
index d1d00f00..dc513c8d 100644
--- a/hosts/12kingdoms-shoryu/default.nix
+++ b/hosts/12kingdoms-shoryu/default.nix
@@ -30,12 +30,4 @@ in
   # node_exporter's drm collector exposes its utilization/VRAM.
   modules.btop.package = pkgs.btop-rocm;
   services.prometheus.exporters.node.enabledCollectors = [ "drm" ];
-
-  boot.kernelParams = [
-    # Use transparent huge pages on demand (madvise) instead of a fixed 1G hugetlb
-    # pool. The static pool cannot be overcommitted or shared with the host /
-    # other VMs, which stranded memory and blocked scheduling; the VMs now use
-    # ordinary memory (see the instancetypes in k8s-gitops).
-    "transparent_hugepage=madvise"
-  ];
 }
diff --git a/hosts/12kingdoms-shoryu/hardware-configuration.nix b/hosts/12kingdoms-shoryu/hardware-configuration.nix
index d69566d0..c7365731 100644
--- a/hosts/12kingdoms-shoryu/hardware-configuration.nix
+++ b/hosts/12kingdoms-shoryu/hardware-configuration.nix
@@ -53,5 +53,5 @@
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }
diff --git a/hosts/12kingdoms-shushou/default.nix b/hosts/12kingdoms-shushou/default.nix
index c23902a9..1957e286 100644
--- a/hosts/12kingdoms-shushou/default.nix
+++ b/hosts/12kingdoms-shushou/default.nix
@@ -29,12 +29,4 @@ in
   # node_exporter's drm collector exposes its utilization/VRAM.
   modules.btop.package = pkgs.btop-rocm;
   services.prometheus.exporters.node.enabledCollectors = [ "drm" ];
-
-  boot.kernelParams = [
-    # Use transparent huge pages on demand (madvise) instead of a fixed 1G hugetlb
-    # pool. The static pool cannot be overcommitted or shared with the host /
-    # other VMs, which stranded memory and blocked scheduling; the VMs now use
-    # ordinary memory (see the instancetypes in k8s-gitops).
-    "transparent_hugepage=madvise"
-  ];
 }
diff --git a/hosts/12kingdoms-youko/default.nix b/hosts/12kingdoms-youko/default.nix
index 34fab148..f33ec3c0 100644
--- a/hosts/12kingdoms-youko/default.nix
+++ b/hosts/12kingdoms-youko/default.nix
@@ -91,13 +91,10 @@ in
   systemd.services.restic-rest-server.unitConfig.RequiresMountsFor = "/data/backups";
 
   boot.kernelParams = [
-    # Use transparent huge pages on demand (madvise) instead of a fixed 1G hugetlb
-    # pool (cannot be overcommitted/shared; it stranded memory and blocked
-    # scheduling). The VMs now use ordinary memory.
-    "transparent_hugepage=madvise"
-
     # --- mitigations for the flaky USB-SATA bridge the two 4TB HDDs sit behind.
     # It is a JMicron JMS567 that resets and throws link (UDMA-CRC) + I/O errors.
+    # Keep until the bridge/controller is replaced; smartctl_exporter now tracks
+    # the drives' CRC/media errors, which is the signal to re-evaluate.
     "usbcore.autosuspend=-1" # no USB autosuspend
     "usb-storage.delay_use=10" # give the bridge time to settle after probing
   ];
diff --git a/hosts/idols-ai/default.nix b/hosts/idols-ai/default.nix
index 426a108a..c1aa93bb 100644
--- a/hosts/idols-ai/default.nix
+++ b/hosts/idols-ai/default.nix
@@ -78,6 +78,7 @@ in
   # QEMU/KVM(HostCpuOnly) for local VMs.
   environment.systemPackages = [ pkgs.qemu_kvm ];
 
+  # Re-evaluate after the Insta360 Link firmware or the kernel's uvcvideo changes.
   powerManagement.resumeCommands = ''
     # Insta360 Link may stay enumerated with a stalled UVC endpoint after S3 resume.
     ${pkgs.coreutils}/bin/sleep 1
diff --git a/hosts/idols-ai/hardware-intel.nix b/hosts/idols-ai/hardware-intel.nix
index 9dae829c..ed7c1ad6 100644
--- a/hosts/idols-ai/hardware-intel.nix
+++ b/hosts/idols-ai/hardware-intel.nix
@@ -50,7 +50,11 @@
 
   # May help if FFmpeg/VAAPI/QSV init fails (esp. on Arc with i915):
   hardware.enableRedistributableFirmware = true;
-  boot.kernelParams = [ "i915.enable_guc=3" ];
+  # (dropped) `i915.enable_guc=3`: i915's `enable_guc` is a "dangerous" option
+  # (it taints the kernel), and since Alder Lake the driver already auto-enables
+  # HuC + GuC submission on non-TGL/RKL Gen12+ platforms -- including this Arrow
+  # Lake-S iGPU, where auto = `HuC | GuC submission` = 3. Re-add only if
+  # VAAPI/QSV init regresses.
 
   # May help services that have trouble accessing /dev/dri (e.g., jellyfin/plex):
   # users.users.<service>.extraGroups = [ "video" "render" ];
diff --git a/modules/darwin/nix-core.nix b/modules/darwin/nix-core.nix
index 502e0d0c..8b64bd47 100644
--- a/modules/darwin/nix-core.nix
+++ b/modules/darwin/nix-core.nix
@@ -17,11 +17,6 @@
   # conflicts with nix-darwin's native Nix management. so we should disable this option.
   nix.enable = false;
 
-  # Disable auto-optimise-store because of this issue:
-  #   https://github.com/NixOS/nix/issues/7273
-  # "error: cannot link '/nix/store/.tmp-link-xxxxx-xxxxx' to '/nix/store/.links/xxxx': File exists"
-  nix.settings.auto-optimise-store = false;
-
   nix.gc.automatic = false;
 
   system.stateVersion = 5;
diff --git a/modules/nixos/base/kernel-hardening.nix b/modules/nixos/base/kernel-hardening.nix
index 7f05ac51..034856de 100644
--- a/modules/nixos/base/kernel-hardening.nix
+++ b/modules/nixos/base/kernel-hardening.nix
@@ -5,7 +5,10 @@
   ...
 }:
 {
-  # Kernel module blacklisting to mitigate Dirty Frag LPE (Local Privilege Escalation) vulnerabilities.
+  # Blacklist unused kernel modules to shrink the attack surface. esp4/esp6/rxrpc
+  # were the vectors for the Dirty Frag LPE (CVE-2026-43284 / CVE-2026-43500);
+  # kept as defence in depth even though the upstream fix has long landed, since
+  # nothing here uses them.
   boot.blacklistedKernelModules = [
     "esp4"
     "esp6"