diff --git a/homes/common.nix b/homes/common.nix
index 73bee89..4f55d6f 100644
--- a/homes/common.nix
+++ b/homes/common.nix
@@ -41,7 +41,6 @@
       NXF_HOME = "${config.xdg.dataHome}/nextflow";
       NXF_CACHE = "${config.xdg.cacheHome}/nextflow";
       NXF_CONDA_CACHEDIR = "${config.xdg.cacheHome}/nextflow/conda";
-      NXF_APPTAINER_CACHEDIR = "${config.xdg.cacheHome}/nextflow/singularity";
       NXF_SINGULARITY_CACHEDIR = "${config.xdg.cacheHome}/nextflow/singularity";
       JULIA_DEPOT_PATH = "${config.xdg.dataHome}/julia:";
       JULIA_PKG_USE_CLI_GIT = "true";
diff --git a/homes/odyssey.nix b/homes/odyssey.nix
index 822d220..fd1c201 100644
--- a/homes/odyssey.nix
+++ b/homes/odyssey.nix
@@ -39,24 +39,18 @@
             config_profile_contact     = 'Thomas A. Christensen II <25492070+MillironX@users.noreply.github.com>'
             config_profile_url         = null
 
-            max_memory = 90.GB
-            max_cpus   = 32
+            max_memory = 30.GB
+            max_cpus   = 12
             max_time   = 7.d
         }
 
         apptainer {
             enabled    = true
             autoMounts = true
-            runOptions = "--bind /nix/store:/nix/store:ro"
         }
 
         process {
             executor = 'local'
-            resourceLimits = [
-                memory: 90.GB,
-                cpus: 32,
-                time: 7.d
-            ]
         }
       '';
     };
diff --git a/programs/plasma.nix b/programs/plasma.nix
index 9aa9783..c2db348 100644
--- a/programs/plasma.nix
+++ b/programs/plasma.nix
@@ -25,9 +25,6 @@
         PreviewSettings.Plugins =
           "audiothumbnail,avif,blenderthumbnail,comicbookthumbnail,cursorthumbnail,djvuthumbnail,ebookthumbnail,exrthumbnail,directorythumbnail,fontthumbnail,imagethumbnail,jpegthumbnail,jxl,kraorathumbnail,windowsexethumbnail,windowsimagethumbnail,mobithumbnail,opendocumentthumbnail,gsthumbnail,rawthumbnail,svgthumbnail,gdk-pixbuf-thumbnailer,ffmpegthumbs,gsf-office";
       };
-
-      # Disable hot corner
-      kwinrc = { Effect-overview.BorderActivate = 9; };
     };
     input.mice = [{
       enable = true;
@@ -174,19 +171,6 @@
       }
     ];
     powerdevil.AC.autoSuspend.action = "nothing";
-    window-rules = [{
-      description = "Firefox picture-in-picture";
-      match = {
-        window-class = {
-          value = "org.mozilla.firefox";
-          type = "exact";
-        };
-      };
-      apply = {
-        above = true;
-        aboverule = 2;
-      };
-    }];
     workspace = {
       lookAndFeel = "org.kde.breezedark.desktop";
       wallpaperFillMode = "preserveAspectCrop";
diff --git a/services/navidrome.nix b/services/navidrome.nix
index 1ee575f..9db322a 100644
--- a/services/navidrome.nix
+++ b/services/navidrome.nix
@@ -62,6 +62,29 @@ in {
        copy_headers X-Authentik-Username>Remote-User
     }
 
+    # Authentik uses the Authorization header if present, so should be able to
+    # authenticate subsonic clients that support BasicAuth. Requests from the
+    # Navidrome Web App will be authenticated via the existing session cookie.
+    # If you want to have Navidrome authenticate subsonic requests, remove this
+    # forward_auth block.
+    @subsonic path /rest/*
+    forward_auth @subsonic http://127.0.0.1:${authentikPort} {
+      uri /outpost.goauthentik.io/auth/caddy
+      copy_headers X-Authentik-Username>Remote-User
+
+      # Some clients that claim to support basicauth still expect a subsonic
+      # response in case of authentication failure instead of a proper basicauth
+      # response.
+      @error status 1xx 3xx 4xx 5xx
+      handle_response @error {
+        respond <<SUBSONICERR
+          <subsonic-response xmlns="http://subsonic.org/restapi" status="failed" version="1.16.1" type="proxy-auth" serverVersion="n/a" openSubsonic="true">
+            <error code="40" message="Invalid credentials or unsupported client"></error>
+          </subsonic-response>
+          SUBSONICERR 200
+      }
+    }
+
     # Forward everything to Navidrome
     reverse_proxy http://127.0.0.1:${port}
   '';