{ self, inputs, ... }: {

  flake.nixosModules.t2mbpConfiguration =
    { self, config, pkgs, ... }:
    {
      imports = [
        self.nixosModules.t2mbpHardware
        self.nixosModules.t2linux
        inputs.t2fanrd.nixosModules.t2fanrd #TODO[epic=Moderate] Convert to flake parts module
        inputs.home-manager.nixosModules.home-manager
        inputs.sops-nix.nixosModules.sops

        self.nixosModules.system
        self.nixosModules.desktop
        self.nixosModules.users

        self.nixosModules."client-services"
        ./_private/platform.nix
        ./_private/firmware.nix
      ];

      sops.secrets."tailscale/auth-key" = {
        mode = "0400";
      };

      chiasson.system.librepods.enable = true;
      chiasson.system.palera1n.enable = true;

      # T2 SMC fans: without a daemon they sit near minimum while thermald only throttles CPU —
      # https://wiki.t2linux.org/guides/fan/
      services.t2fanrd = {
        enable = true;
        # Upstream averages 50 samples (~5s); peak tracks spikes so fans hit sysfs max sooner
        # under bursty browser/GPU load (see patches/t2fanrd-use-peak-temperature.patch).
        package = inputs.t2fanrd.packages.x86_64-linux.default.overrideAttrs (old: {
          patches = (old.patches or [ ]) ++ [ ../../../patches/t2fanrd-use-peak-temperature.patch ]; #TODO[epic=Moderate] Move patch file to host's directory.
        });
        config = {
          Fan1 = {
            low_temp = 40;
            high_temp = 65;
            speed_curve = "exponential";
            always_full_speed = false;
          };
          Fan2 = {
            low_temp = 40;
            high_temp = 65;
            speed_curve = "exponential";
            always_full_speed = false;
          };
        };
      };

      # Dynamic function row on the Touch Bar (`tiny-dfr`; needs `DRM_APPLETBDRM` — see t2linux kernel opts).
      hardware.apple.touchBar.enable = true;

      # ─────────────────────── Display Server & Desktop ──────────────────────────
      chiasson.desktop = {
        niri = {
          enable = true;
          # Hybrid T2 + `apple-gmux force_igd` + blacklisted amdgpu: a TB/DP encoder often stays
          # "connected" with junk EDID → niri sees a second head (`Unknown-1`, absurd mode). Off.
          extraSettings.extraConfig = ''
            output "Unknown-1" {
                off
            }
          '';
        };
        defaultSession = "niri";
        shell = "dms";
      };

      chiasson.system = {
        audio.enable = true;
        extraPackages = [ pkgs.sops ];
        networking = {
          hostName = "t2mbp";
          networkManager.enable = true;
          tailscale = {
            enable = true;
            authKeyFile = config.sops.secrets."tailscale/auth-key".path;
            acceptRoutes = true;
          };
        };
      };

      chiasson.users.enabled = [ "olivier" ];
    };

}