{ ... }: {
  #TODO[epic=Moderate] Clean this up, move to host's configuration.nix.
  # Native Raspberry Pi boot flow.
  boot.loader.raspberry-pi.bootloader = "kernel";
  boot.loader.grub.enable = false;
  boot.consoleLogLevel = 7;
  boot.kernelModules = [ "nvme" ];

  # Root device for kernel cmdline (NVMe boot).
  boot.kernelParams = [
    "root=PARTUUID=4d44c78a-ee3c-4e3e-9eee-0f2eb10347b6"
    "rootfstype=ext4"
  ];

  console = {
    earlySetup = true;
    font = "ter-v32n";
  };

  # Enable PCIe x1 for CM5 NVMe adapter.
  hardware.raspberry-pi.config.cm5.base-dt-params.pciex1 = {
    enable = true;
    value = "on";
  };

  powerManagement.cpuFreqGovernor = "powersave";

  # Root + firmware as boot-critical mounts.
  fileSystems."/".neededForBoot = true;
  fileSystems."/boot/firmware".neededForBoot = true;

  # Pi generational boot expects boot-firmware.mount to exist.
  systemd.mounts = [
    {
      what = "/dev/disk/by-label/FIRMWARE";
      where = "/boot/firmware";
      type = "vfat";
      options = "noatime,fmask=0022,dmask=0022";
      wantedBy = [ "local-fs.target" ];
      after = [ "local-fs-pre.target" ];
    }
  ];

  # There is no serial console on uConsole CM5 by default.
  systemd.services."serial-getty@ttyS0".enable = false;

  system.stateVersion = "25.11";
}