diff --git a/homes/common.nix b/homes/common.nix
index 4f55d6f..73bee89 100644
--- a/homes/common.nix
+++ b/homes/common.nix
@@ -41,6 +41,7 @@
       NXF_HOME = "${config.xdg.dataHome}/nextflow";
       NXF_CACHE = "${config.xdg.cacheHome}/nextflow";
       NXF_CONDA_CACHEDIR = "${config.xdg.cacheHome}/nextflow/conda";
+      NXF_APPTAINER_CACHEDIR = "${config.xdg.cacheHome}/nextflow/singularity";
       NXF_SINGULARITY_CACHEDIR = "${config.xdg.cacheHome}/nextflow/singularity";
       JULIA_DEPOT_PATH = "${config.xdg.dataHome}/julia:";
       JULIA_PKG_USE_CLI_GIT = "true";
diff --git a/homes/odyssey.nix b/homes/odyssey.nix
index fd1c201..822d220 100644
--- a/homes/odyssey.nix
+++ b/homes/odyssey.nix
@@ -39,18 +39,24 @@
             config_profile_contact     = 'Thomas A. Christensen II <25492070+MillironX@users.noreply.github.com>'
             config_profile_url         = null
 
-            max_memory = 30.GB
-            max_cpus   = 12
+            max_memory = 90.GB
+            max_cpus   = 32
             max_time   = 7.d
         }
 
         apptainer {
             enabled    = true
             autoMounts = true
+            runOptions = "--bind /nix/store:/nix/store:ro"
         }
 
         process {
             executor = 'local'
+            resourceLimits = [
+                memory: 90.GB,
+                cpus: 32,
+                time: 7.d
+            ]
         }
       '';
     };
diff --git a/programs/plasma.nix b/programs/plasma.nix
index c2db348..9aa9783 100644
--- a/programs/plasma.nix
+++ b/programs/plasma.nix
@@ -25,6 +25,9 @@
         PreviewSettings.Plugins =
           "audiothumbnail,avif,blenderthumbnail,comicbookthumbnail,cursorthumbnail,djvuthumbnail,ebookthumbnail,exrthumbnail,directorythumbnail,fontthumbnail,imagethumbnail,jpegthumbnail,jxl,kraorathumbnail,windowsexethumbnail,windowsimagethumbnail,mobithumbnail,opendocumentthumbnail,gsthumbnail,rawthumbnail,svgthumbnail,gdk-pixbuf-thumbnailer,ffmpegthumbs,gsf-office";
       };
+
+      # Disable hot corner
+      kwinrc = { Effect-overview.BorderActivate = 9; };
     };
     input.mice = [{
       enable = true;
@@ -171,6 +174,19 @@
       }
     ];
     powerdevil.AC.autoSuspend.action = "nothing";
+    window-rules = [{
+      description = "Firefox picture-in-picture";
+      match = {
+        window-class = {
+          value = "org.mozilla.firefox";
+          type = "exact";
+        };
+      };
+      apply = {
+        above = true;
+        aboverule = 2;
+      };
+    }];
     workspace = {
       lookAndFeel = "org.kde.breezedark.desktop";
       wallpaperFillMode = "preserveAspectCrop";
diff --git a/services/navidrome.nix b/services/navidrome.nix
index 9db322a..1ee575f 100644
--- a/services/navidrome.nix
+++ b/services/navidrome.nix
@@ -62,29 +62,6 @@ in {
        copy_headers X-Authentik-Username>Remote-User
     }
 
-    # Authentik uses the Authorization header if present, so should be able to
-    # authenticate subsonic clients that support BasicAuth. Requests from the
-    # Navidrome Web App will be authenticated via the existing session cookie.
-    # If you want to have Navidrome authenticate subsonic requests, remove this
-    # forward_auth block.
-    @subsonic path /rest/*
-    forward_auth @subsonic http://127.0.0.1:${authentikPort} {
-      uri /outpost.goauthentik.io/auth/caddy
-      copy_headers X-Authentik-Username>Remote-User
-
-      # Some clients that claim to support basicauth still expect a subsonic
-      # response in case of authentication failure instead of a proper basicauth
-      # response.
-      @error status 1xx 3xx 4xx 5xx
-      handle_response @error {
-        respond <<SUBSONICERR
-          <subsonic-response xmlns="http://subsonic.org/restapi" status="failed" version="1.16.1" type="proxy-auth" serverVersion="n/a" openSubsonic="true">
-            <error code="40" message="Invalid credentials or unsupported client"></error>
-          </subsonic-response>
-          SUBSONICERR 200
-      }
-    }
-
     # Forward everything to Navidrome
     reverse_proxy http://127.0.0.1:${port}
   '';