diff --git a/home/default.nix b/home/default.nix
index 9db75b97..e7bffee1 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -52,29 +52,12 @@
       unzip
     ];
     guiApps = [cinny-desktop code-cursor];
-    darwinApps = [
-      chatgpt
-      claude-desktop
-      daisydisk
-      github-desktop
-      gitify
-      iina
-      m-cli
-      mas
-      mochi
-      slack
-      soundsource
-      the-unarchiver
-      whatsapp-for-mac
-      zoom-us
-    ];
   in
     development
     ++ nixSpecific
     ++ tuiApps
     ++ utilities
-    ++ lib.optionals enableGuiPackages guiApps
-    ++ lib.optionals stdenv.isDarwin darwinApps;
+    ++ lib.optionals enableGuiPackages guiApps;
   home.sessionPath = [
     "$HOME/.local/bin"
   ];
diff --git a/hosts/Rhizome/default.nix b/hosts/Rhizome/default.nix
index 2f43656e..3a33cae5 100644
--- a/hosts/Rhizome/default.nix
+++ b/hosts/Rhizome/default.nix
@@ -6,5 +6,13 @@
   imports = [
     ./dock.nix
     ./hardware.nix
+    ./programs.nix
   ];
+
+  rc.darwin.defaults = {
+    fonts = true;
+    homebrew = true;
+    security = true;
+    system = true;
+  };
 }
diff --git a/hosts/Rhizome/programs.nix b/hosts/Rhizome/programs.nix
new file mode 100644
index 00000000..47f7eecf
--- /dev/null
+++ b/hosts/Rhizome/programs.nix
@@ -0,0 +1,91 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  homebrew = {
+    enable = true;
+    casks = [
+      "legcord"
+      "plex"
+      "textual"
+    ];
+    # N.B.: Removed entries in `masApps` require manual uninstallation
+    masApps = {
+      "Copilot" = 1447330651;
+      "Folder Quick Look" = 6753110395;
+      "GoodLinks" = 1474335294;
+      "Hand Mirror" = 1502839586;
+      "Hush" = 1544743900;
+      "Mapper" = 1589391989;
+      "Mela" = 1568924476;
+      "MusicBox" = 1614730313;
+      "Numbers" = 409203825;
+      "Noir" = 1592917505;
+      "Pages" = 409201541;
+      "Paku" = 1534130193;
+      "Parcel" = 375589283;
+      "Pixea" = 1507782672;
+      "Play" = 1596506190;
+      "Prompt" = 1594420480;
+      "Reeder" = 1529448980;
+      "Timery" = 1425368544;
+      "Things" = 904280696;
+      "Wipr" = 1320666476;
+    };
+  };
+
+  programs.craft = {
+    enable = true;
+  };
+
+  programs.daisydisk = {
+    enable = true;
+  };
+
+  programs.fastscripts = {
+    enable = true;
+    startOnActivation = true;
+  };
+  rc.darwin.defaults.fastscripts = true;
+
+  programs.iina = {
+    enable = true;
+  };
+
+  programs.little-snitch = {
+    enable = true;
+  };
+
+  programs.nova-editor = {
+    enable = true;
+  };
+
+  programs.popclip = {
+    enable = true;
+    startOnActivation = true;
+  };
+
+  programs.postico = {
+    enable = true;
+  };
+
+  programs.roon = {
+    enable = true;
+  };
+
+  programs.scroll-reverser = {
+    enable = true;
+    startOnActivation = true;
+  };
+
+  programs.soundsource = {
+    enable = true;
+    startOnActivation = true;
+  };
+
+  programs.tailscale = {
+    enable = true;
+    startOnActivation = true;
+  };
+}
diff --git a/modules/darwin/default.nix b/modules/darwin/default.nix
index ca3dbd7a..fa1e2c0e 100644
--- a/modules/darwin/default.nix
+++ b/modules/darwin/default.nix
@@ -3,86 +3,21 @@
   config,
   pkgs,
   lib,
+  username,
   ...
 }: {
   imports = [
-    ./disable-updates.nix
-    ./fastscripts.nix
-    ./fonts.nix
-    ./homebrew.nix
-    ./popclip.nix
-    ./scroll-reverser.nix
-    ./security.nix
-    ./start-on-activation.nix
-    ./startup-apps.nix
-    ./system-defaults.nix
+    ./programs
+    ./system
+    ./rc.nix
   ];
 
-  programs.fastscripts = {
-    enable = true;
-    userScripts = {
-      SafariQuitWithConfirmation = {
-        source = pkgs.writeText "safari-quit-with-confirmation.applescript" (builtins.readFile ./fastscripts/safari-quit-with-confirmation.applescript);
-        target = "Applications/Safari/Quit With Confirmation.applescript";
-      };
-    };
-    plistFile = pkgs.writeText "fastscripts-keybindings.plist" (builtins.readFile ./fastscripts/keybindings.plist);
-  };
-
-  # TODO: Ideally this would be in a Darwin-specific home-manager module
-  programs.popclip = {
-    enable = true;
-  };
-
-  programs.scroll-reverser = {
-    enable = true;
+  home-manager.users.${username} = {...}: {
+    imports = [./home.nix];
   };
 
   system.configurationRevision = self.rev or self.dirtyRev or null;
 
-  # TODO: Keyboard shortcuts, see nix-darwin/nix-darwin#699
-  # system.keyboard.shortcuts = let
-  #   cmdOptLeft = {
-  #     mods = {
-  #       option = true;
-  #       command = true;
-  #     };
-  #     key = "left";
-  #   };
-  #   cmdOptRight = {
-  #     mods = {
-  #       option = true;
-  #       command = true;
-  #     };
-  #     key = "right";
-  #   };
-  # in {
-  #   enable = true;
-  #   appShortcuts = {
-  #     "Preview.app" = {
-  #       "Show Previous Tab" = cmdOptLeft;
-  #       "Show Next Tab" = cmdOptRight
-  #     };
-  #     "Finder.app" = {
-  #       "Show Previous Tab" = cmdOptLeft;
-  #       "Show Next Tab" = cmdOptRight
-  #     };
-  #     "Prompt.app" = {
-  #       "Show Previous Tab" = cmdOptLeft;
-  #       "Show Next Tab" = cmdOptRight
-  #     };
-  #     "Mail.app" = {
-  #       "Archive" = {
-  #         key = "right";
-  #       };
-  #     };
-  #     "Nova.app" = {
-  #       "Show Previous Tab" = cmdOptLeft;
-  #       "Show Next Tab" = cmdOptRight
-  #     };
-  #   };
-  # };
-
   # Auto upgrade nix package and the daemon service.
   nix.enable = true;
   nix.package = pkgs.nix;
diff --git a/modules/darwin/disable-updates.nix b/modules/darwin/disable-updates.nix
deleted file mode 100644
index f291c9c1..00000000
--- a/modules/darwin/disable-updates.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.system.disableUpdates;
-in {
-  options.system.disableUpdates = mkOption {
-    type = types.listOf types.str;
-    default = [];
-    example = literalExpression ''
-      [
-        "com.panic.Nova"
-      ]
-    '';
-    description = ''
-      List of domains to write defaults that attempt to disable automatic software updates and associated prompts.
-
-      Keys are set according to [constants](https://github.com/sparkle-project/Sparkle/blob/2.x/Sparkle/SUConstants.m)
-      in the Sparkle project, a popular software update framework, as well as some that have been determined
-      experimentally.
-    '';
-  };
-
-  config = mkIf (length cfg > 0) {
-    system.defaults.CustomUserPreferences = builtins.listToAttrs (map
-      (domain: {
-        name = domain;
-        value = {
-          SUEnableAutomaticChecks = false;
-          SUAutomaticallyUpdate = false;
-        };
-      })
-      cfg);
-  };
-}
diff --git a/modules/darwin/fonts.nix b/modules/darwin/fonts.nix
deleted file mode 100644
index fa6f9fbd..00000000
--- a/modules/darwin/fonts.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  fonts.packages = [
-    pkgs.nerd-fonts.meslo-lg # Supplies MesloLGSDZ: Line Gap Small, Dotted Zero
-  ];
-}
diff --git a/modules/darwin/home.nix b/modules/darwin/home.nix
new file mode 100644
index 00000000..363be09a
--- /dev/null
+++ b/modules/darwin/home.nix
@@ -0,0 +1,21 @@
+{
+  self,
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  home.packages = with pkgs; [
+    chatgpt
+    claude-desktop
+    github-desktop
+    gitify
+    m-cli
+    mas
+    mochi
+    slack
+    the-unarchiver
+    whatsapp-for-mac
+    zoom-us
+  ];
+}
diff --git a/modules/darwin/homebrew.nix b/modules/darwin/homebrew.nix
deleted file mode 100644
index 1956beb1..00000000
--- a/modules/darwin/homebrew.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  homebrew = {
-    enable = true;
-    caskArgs.no_quarantine = true;
-    onActivation = {
-      cleanup = "zap";
-      upgrade = true;
-    };
-    taps = builtins.attrNames config.nix-homebrew.taps; # See: zhaofengli/nix-homebrew#5
-    # N.B.: Apps marked auto_updates will not be updated by homebrew. These apps should
-    # have their updates disabled and then marked `greedy` to force homebrew to update.
-    casks = let
-      greedyApps =
-        map (name: {
-          inherit name;
-          greedy = true;
-        }) [
-          "craft"
-          "nova"
-          "postico"
-          "roon"
-          "tailscale-app"
-        ];
-      otherApps = [
-        "legcord"
-        "plex" # auto_updates
-        "textual"
-      ];
-    in
-      lib.concatLists [
-        greedyApps
-        otherApps
-      ];
-    # N.B.: Removed entries in `masApps` require manual uninstallation
-    masApps = {
-      "Copilot" = 1447330651;
-      "Folder Quick Look" = 6753110395;
-      "GoodLinks" = 1474335294;
-      "Hand Mirror" = 1502839586;
-      "Hush" = 1544743900;
-      "Mapper" = 1589391989;
-      "Mela" = 1568924476;
-      "MusicBox" = 1614730313;
-      "Numbers" = 409203825;
-      "Noir" = 1592917505;
-      "Pages" = 409201541;
-      "Paku" = 1534130193;
-      "Parcel" = 375589283;
-      "Pixea" = 1507782672;
-      "Play" = 1596506190;
-      "Prompt" = 1594420480;
-      "Reeder" = 1529448980;
-      "Timery" = 1425368544;
-      "Things" = 904280696;
-      "Wipr" = 1320666476;
-    };
-  };
-}
diff --git a/modules/darwin/programs/craft.nix b/modules/darwin/programs/craft.nix
new file mode 100644
index 00000000..e3be2002
--- /dev/null
+++ b/modules/darwin/programs/craft.nix
@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.programs.craft;
+in {
+  options.programs.craft = {
+    enable = mkEnableOption "Craft";
+
+    startOnActivation = mkEnableOption "starting Craft on activation";
+  };
+
+  config = mkIf cfg.enable {
+    homebrew.casks = [
+      {
+        name = "craft";
+        greedy = true;
+      }
+    ];
+    system.disableUpdates = ["com.lukilabs.lukiapp"];
+    system.startOnActivation = mkIf cfg.startOnActivation {
+      "Craft" = "/Applications/Craft.app/";
+    };
+  };
+}
diff --git a/modules/darwin/programs/daisydisk.nix b/modules/darwin/programs/daisydisk.nix
new file mode 100644
index 00000000..de98596a
--- /dev/null
+++ b/modules/darwin/programs/daisydisk.nix
@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  ...
+}:
+with lib; let
+  cfg = config.programs.daisydisk;
+in {
+  options.programs.daisydisk = {
+    enable = mkEnableOption "DaisyDisk";
+  };
+
+  config = mkIf cfg.enable {
+    home-manager.users.${username}.home.packages = [pkgs.daisydisk];
+    system.disableUpdates = ["com.daisydiskapp.DaisyDiskStandAlone"];
+  };
+}
diff --git a/modules/darwin/programs/default.nix b/modules/darwin/programs/default.nix
new file mode 100644
index 00000000..79628486
--- /dev/null
+++ b/modules/darwin/programs/default.nix
@@ -0,0 +1,16 @@
+{
+  imports = [
+    ./craft.nix
+    ./daisydisk.nix
+    ./fastscripts.nix
+    ./iina.nix
+    ./little-snitch.nix
+    ./nova-editor.nix
+    ./popclip.nix
+    ./postico.nix
+    ./roon.nix
+    ./scroll-reverser.nix
+    ./soundsource.nix
+    ./tailscale.nix
+  ];
+}
diff --git a/modules/darwin/fastscripts.nix b/modules/darwin/programs/fastscripts.nix
similarity index 87%
rename from modules/darwin/fastscripts.nix
rename to modules/darwin/programs/fastscripts.nix
index 88480c35..7d5e475d 100644
--- a/modules/darwin/fastscripts.nix
+++ b/modules/darwin/programs/fastscripts.nix
@@ -3,6 +3,7 @@
   lib,
   pkgs,
   nixDarwin,
+  username,
   ...
 }:
 with lib; let
@@ -28,7 +29,8 @@ with lib; let
   plistFile = config.programs.fastscripts.plistFile;
 in {
   options.programs.fastscripts = {
-    enable = mkEnableOption "Whether to enable FastScripts";
+    enable = mkEnableOption "FastScripts";
+
     userScripts = mkOption {
       type = types.attrsOf (types.submodule text);
       default = {};
@@ -36,6 +38,7 @@ in {
         Set of files that have to be linked in {file}`~/Library/Scripts`.
       '';
     };
+
     plistFile = mkOption {
       type = types.nullOr types.path;
       default = null;
@@ -46,10 +49,12 @@ in {
         This file can be obtained using: `plutil -convert xml1 -o - ~/Library/Preferences/com.red-sweater.fastscripts.plist > fastscripts.xml`.
       '';
     };
+
+    startOnActivation = mkEnableOption "starting FastScripts on activation";
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [pkgs.fastscripts];
+    home-manager.users.${username}.home.packages = [pkgs.fastscripts];
     system.build.fastscripts =
       pkgs.runCommand "fastscripts"
       {preferLocalBuild = true;}
@@ -62,6 +67,10 @@ in {
           '')
           userScripts}
       '';
+    system.disableUpdates = ["com.red-sweater.fastscripts"];
+    system.startOnActivation = mkIf cfg.startOnActivation {
+      "FastScripts" = "${pkgs.fastscripts}/Applications/FastScripts.app/";
+    };
     system.activationScripts.postActivation.text = let
       user = lib.escapeShellArg config.system.primaryUser;
     in
diff --git a/modules/darwin/programs/iina.nix b/modules/darwin/programs/iina.nix
new file mode 100644
index 00000000..6472672b
--- /dev/null
+++ b/modules/darwin/programs/iina.nix
@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  ...
+}:
+with lib; let
+  cfg = config.programs.iina;
+in {
+  options.programs.iina = {
+    enable = mkEnableOption "iina";
+  };
+
+  config = mkIf cfg.enable {
+    home-manager.users.${username}.home.packages = [pkgs.iina];
+    system.disableUpdates = ["com.colliderli.iina"];
+  };
+}
diff --git a/modules/darwin/programs/little-snitch.nix b/modules/darwin/programs/little-snitch.nix
new file mode 100644
index 00000000..40d903d2
--- /dev/null
+++ b/modules/darwin/programs/little-snitch.nix
@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.programs.little-snitch;
+in {
+  options.programs.little-snitch = {
+    enable = mkEnableOption "Little Snitch";
+  };
+
+  config = mkIf cfg.enable {
+    homebrew.casks = [
+      {
+        name = "little-snitch";
+        greedy = true;
+      }
+    ];
+    system.disableUpdates = [
+      {
+        domain = "at.obdev.littlesnitch.softwareupdate";
+        keys = ["SoftwareUpdateCheckAutomatically"];
+      }
+    ];
+  };
+}
diff --git a/modules/darwin/programs/nova-editor.nix b/modules/darwin/programs/nova-editor.nix
new file mode 100644
index 00000000..4dccb8a0
--- /dev/null
+++ b/modules/darwin/programs/nova-editor.nix
@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.programs.nova-editor;
+in {
+  options.programs.nova-editor = {
+    enable = mkEnableOption "Nova";
+
+    startOnActivation = mkEnableOption "starting Nova on activation";
+  };
+
+  config = mkIf cfg.enable {
+    homebrew.casks = [
+      {
+        name = "nova";
+        greedy = true;
+      }
+    ];
+    system.disableUpdates = ["com.panic.Nova"];
+    system.startOnActivation = mkIf cfg.startOnActivation {
+      "Nova" = "/Applications/Nova.app/";
+    };
+  };
+}
diff --git a/modules/darwin/popclip.nix b/modules/darwin/programs/popclip.nix
similarity index 87%
rename from modules/darwin/popclip.nix
rename to modules/darwin/programs/popclip.nix
index 677be1ef..bb1e5e56 100644
--- a/modules/darwin/popclip.nix
+++ b/modules/darwin/programs/popclip.nix
@@ -8,7 +8,9 @@ with lib; let
   cfg = config.programs.popclip;
 in {
   options.programs.popclip = {
-    enable = mkEnableOption "Whether to enable PopClip";
+    enable = mkEnableOption "PopClip";
+
+    startOnActivation = mkEnableOption "starting PopClip on activation";
   };
 
   config = mkIf cfg.enable {
@@ -37,6 +39,9 @@ in {
       };
     };
     system.disableUpdates = ["com.pilotmoon.popclip"];
+    system.startOnActivation = mkIf cfg.startOnActivation {
+      PopClip = "/Applications/PopClip.app/";
+    };
     system.activationScripts.popclipExtensions.text = ''
       popclipExtPlist=~/Library/Application\ Support/PopClip/Extensions/Extensions.plist
       if test -f "$popclipExtPlist"; then
diff --git a/modules/darwin/programs/postico.nix b/modules/darwin/programs/postico.nix
new file mode 100644
index 00000000..0f65a057
--- /dev/null
+++ b/modules/darwin/programs/postico.nix
@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.programs.postico;
+in {
+  options.programs.postico = {
+    enable = mkEnableOption "Postico";
+
+    startOnActivation = mkEnableOption "starting Postico on activation";
+  };
+
+  config = mkIf cfg.enable {
+    homebrew.casks = [
+      {
+        name = "postico";
+        greedy = true;
+      }
+    ];
+    system.disableUpdates = ["at.eggerapps.Postico"];
+    system.startOnActivation = mkIf cfg.startOnActivation {
+      "Postico" = "/Applications/Postico\ 2.app/";
+    };
+  };
+}
diff --git a/modules/darwin/programs/roon.nix b/modules/darwin/programs/roon.nix
new file mode 100644
index 00000000..1f916ec5
--- /dev/null
+++ b/modules/darwin/programs/roon.nix
@@ -0,0 +1,27 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.programs.roon;
+in {
+  options.programs.roon = {
+    enable = mkEnableOption "Roon client";
+
+    startOnActivation = mkEnableOption "starting Roon on activation";
+  };
+
+  config = mkIf cfg.enable {
+    homebrew.casks = [
+      {
+        name = "roon";
+        greedy = true;
+      }
+    ];
+    system.startOnActivation = mkIf cfg.startOnActivation {
+      "Roon" = "/Applications/Roon.app/";
+    };
+  };
+}
diff --git a/modules/darwin/scroll-reverser.nix b/modules/darwin/programs/scroll-reverser.nix
similarity index 53%
rename from modules/darwin/scroll-reverser.nix
rename to modules/darwin/programs/scroll-reverser.nix
index 20a9798a..2b6cb956 100644
--- a/modules/darwin/scroll-reverser.nix
+++ b/modules/darwin/programs/scroll-reverser.nix
@@ -2,17 +2,20 @@
   config,
   lib,
   pkgs,
+  username,
   ...
 }:
 with lib; let
   cfg = config.programs.scroll-reverser;
 in {
   options.programs.scroll-reverser = {
-    enable = mkEnableOption "Whether to enable Scroll Reverser";
+    enable = mkEnableOption "Scroll Reverser";
+
+    startOnActivation = mkEnableOption "starting Scroll Reverser on activation";
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [pkgs.scroll-reverser];
+    home-manager.users.${username}.home.packages = [pkgs.scroll-reverser];
     system.defaults.CustomUserPreferences = {
       "com.pilotmoon.scroll-reverser" = {
         InvertScrollingOn = true;
@@ -22,5 +25,8 @@ in {
         StartAtLogin = true;
       };
     };
+    system.startOnActivation = mkIf cfg.startOnActivation {
+      "Scroll Reverser" = "${pkgs.scroll-reverser}/Applications/Scroll\ Reverser.app/";
+    };
   };
 }
diff --git a/modules/darwin/programs/soundsource.nix b/modules/darwin/programs/soundsource.nix
new file mode 100644
index 00000000..33bdd496
--- /dev/null
+++ b/modules/darwin/programs/soundsource.nix
@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  username,
+  ...
+}:
+with lib; let
+  cfg = config.programs.soundsource;
+in {
+  options.programs.soundsource = {
+    enable = mkEnableOption "SoundSource";
+
+    startOnActivation = mkEnableOption "starting SoundSource on activation";
+  };
+
+  config = mkIf cfg.enable {
+    home-manager.users.${username}.home.packages = [pkgs.soundsource];
+    system.disableUpdates = ["com.rogueamoeba.soundsource"];
+    system.startOnActivation = mkIf cfg.startOnActivation {
+      "SoundSource" = "${pkgs.soundsource}/Applications/SoundSource.app/";
+    };
+  };
+}
diff --git a/modules/darwin/programs/tailscale.nix b/modules/darwin/programs/tailscale.nix
new file mode 100644
index 00000000..568a40d4
--- /dev/null
+++ b/modules/darwin/programs/tailscale.nix
@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.programs.tailscale;
+in {
+  options.programs.tailscale = {
+    enable = mkEnableOption "Tailscale";
+
+    startOnActivation = mkEnableOption "starting Tailscale on activation";
+  };
+
+  config = mkIf cfg.enable {
+    homebrew.casks = [
+      {
+        name = "tailscale-app";
+        greedy = true;
+      }
+    ];
+    system.disableUpdates = ["io.tailscale.ipn.macsys"];
+    system.startOnActivation = mkIf cfg.startOnActivation {
+      "Tailscale" = "/Applications/Tailscale.app/";
+    };
+  };
+}
diff --git a/modules/darwin/rc.nix b/modules/darwin/rc.nix
new file mode 100644
index 00000000..f5c61a55
--- /dev/null
+++ b/modules/darwin/rc.nix
@@ -0,0 +1,133 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.rc.darwin.defaults;
+in {
+  options.rc.darwin.defaults = {
+    fonts = mkEnableOption "Font defaults";
+
+    homebrew = mkEnableOption "Homebrew defaults";
+
+    fastscripts = mkEnableOption "FastScripts default userscripts";
+
+    security = mkEnableOption "Security defaults";
+
+    system = mkEnableOption "System defaults";
+  };
+
+  config = {
+    fonts.packages = mkIf cfg.fonts [
+      pkgs.nerd-fonts.meslo-lg # Supplies MesloLGSDZ: Line Gap Small, Dotted Zero
+    ];
+
+    homebrew = mkIf cfg.homebrew {
+      caskArgs.no_quarantine = true;
+      onActivation = {
+        cleanup = "zap";
+        upgrade = true;
+      };
+      taps = builtins.attrNames config.nix-homebrew.taps; # See: zhaofengli/nix-homebrew#5
+    };
+
+    programs.fastscripts = mkIf cfg.fastscripts {
+      userScripts = {
+        SafariQuitWithConfirmation = {
+          source = pkgs.writeText "safari-quit-with-confirmation.applescript" (builtins.readFile ./fastscripts/safari-quit-with-confirmation.applescript);
+          target = "Applications/Safari/Quit With Confirmation.applescript";
+        };
+      };
+      plistFile = pkgs.writeText "fastscripts-keybindings.plist" (builtins.readFile ./fastscripts/keybindings.plist);
+    };
+
+    security.pam.services.sudo_local = mkIf cfg.security {
+      reattach = true;
+      touchIdAuth = true;
+    };
+
+    system.defaults = mkIf cfg.system {
+      ".GlobalPreferences"."com.apple.mouse.scaling" = 1.5;
+      LaunchServices.LSQuarantine = false;
+      NSGlobalDomain = {
+        AppleScrollerPagingBehavior = true; # Jump to spot on scroll bar when clicked
+        NSAutomaticCapitalizationEnabled = false;
+        NSAutomaticDashSubstitutionEnabled = false;
+        NSAutomaticPeriodSubstitutionEnabled = false;
+        NSAutomaticQuoteSubstitutionEnabled = false; # Disable smart quoting
+        NSAutomaticSpellingCorrectionEnabled = false;
+        "com.apple.springing.enabled" = true;
+        "com.apple.springing.delay" = 0.5;
+        # "com.apple.trackpad.forceClick" = 1; # TODO
+        "com.apple.trackpad.scaling" = 1.0;
+
+        # Always use expanded save panel
+        NSNavPanelExpandedStateForSaveMode = true;
+        NSNavPanelExpandedStateForSaveMode2 = true;
+
+        # Quickly repeat keys when held
+        InitialKeyRepeat = 15;
+        KeyRepeat = 2;
+      };
+      # TODO:
+      # showAppExposeGestureEnabled = 1;
+      # showMissionControlGestureEnabled = 1;
+      dock = {
+        appswitcher-all-displays = false;
+        autohide = false;
+        mineffect = "scale";
+        minimize-to-application = false;
+        mru-spaces = false;
+        orientation = "bottom";
+        show-process-indicators = false;
+        showhidden = false;
+        show-recents = false;
+        static-only = false;
+        magnification = true;
+
+        # Disable hot corners
+        wvous-tl-corner = 1;
+        wvous-bl-corner = 1;
+        wvous-tr-corner = 1;
+        wvous-br-corner = 1;
+      };
+      finder = {
+        AppleShowAllFiles = false;
+        ShowStatusBar = false;
+        ShowPathbar = false;
+        FXDefaultSearchScope = "SCcf"; # Search current folder first when searching
+        FXPreferredViewStyle = "Nlsv"; # Prefer list view
+        AppleShowAllExtensions = true;
+        FXEnableExtensionChangeWarning = false; # Do not warn when changing file extensions
+      };
+      menuExtraClock = {
+        ShowAMPM = true;
+        ShowDayOfWeek = false;
+        ShowDate = 0; # Show full date
+      };
+      screencapture.location = "~/Downloads";
+      trackpad = {
+        Clicking = true; # tap to click
+        Dragging = true; # tap to drag
+        TrackpadThreeFingerDrag = true;
+      };
+
+      CustomUserPreferences = {
+        "com.apple.desktopservices" = {
+          DSDontWriteNetworkStores = true;
+        };
+
+        # N.B.: Terminal requires Full Disk Access to apply Safari defaults
+        "com.apple.Safari" = {
+          AutoOpenSafeDownloads = false; # Prevent opening "safe" files automatically
+          ShowFullURLInSmartSearchField = false;
+          "ShowFavoritesBar-v2" = false;
+          IncludeDevelopMenu = true;
+          WebKitDeveloperExtrasEnabledPreferenceKey = true;
+        };
+      };
+    };
+  };
+}
diff --git a/modules/darwin/security.nix b/modules/darwin/security.nix
deleted file mode 100644
index 70768056..00000000
--- a/modules/darwin/security.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  security.pam.services.sudo_local = {
-    reattach = true;
-    touchIdAuth = true;
-  };
-
-  system.disableUpdates = [
-    "at.eggerapps.Postico"
-    "com.colliderli.iina"
-    "com.daisydiskapp.DaisyDiskStandAlone"
-    "com.lukilabs.lukiapp" # Craft
-    "com.panic.Nova"
-    "com.red-sweater.fastscripts"
-    "com.rogueamoeba.soundsource"
-    "io.tailscale.ipn.macsys"
-    "org.sbarex.QLMarkdown"
-  ];
-}
diff --git a/modules/darwin/startup-apps.nix b/modules/darwin/startup-apps.nix
deleted file mode 100644
index e3c4e76f..00000000
--- a/modules/darwin/startup-apps.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  system.startOnActivation = {
-    "FastScripts" = "${pkgs.fastscripts}/Applications/FastScripts.app/";
-    "Hand Mirror" = "/Applications/Hand\ Mirror.app/";
-    "PopClip" = "/Applications/PopClip.app/";
-    "Scroll Reverser" = "${pkgs.scroll-reverser}/Applications/Scroll\ Reverser.app/";
-    "SoundSource" = "${pkgs.soundsource}/Applications/SoundSource.app/";
-    "Tailscale" = "/Applications/Tailscale.app/";
-  };
-}
diff --git a/modules/darwin/system-defaults.nix b/modules/darwin/system-defaults.nix
deleted file mode 100644
index 80103496..00000000
--- a/modules/darwin/system-defaults.nix
+++ /dev/null
@@ -1,99 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  system.defaults = {
-    ".GlobalPreferences"."com.apple.mouse.scaling" = 1.5;
-    LaunchServices.LSQuarantine = false;
-    NSGlobalDomain = {
-      AppleScrollerPagingBehavior = true; # Jump to spot on scroll bar when clicked
-      NSAutomaticCapitalizationEnabled = false;
-      NSAutomaticDashSubstitutionEnabled = false;
-      NSAutomaticPeriodSubstitutionEnabled = false;
-      NSAutomaticQuoteSubstitutionEnabled = false; # Disable smart quoting
-      NSAutomaticSpellingCorrectionEnabled = false;
-      "com.apple.springing.enabled" = true;
-      "com.apple.springing.delay" = 0.5;
-      # "com.apple.trackpad.forceClick" = 1; # TODO
-      "com.apple.trackpad.scaling" = 1.0;
-
-      # Always use expanded save panel
-      NSNavPanelExpandedStateForSaveMode = true;
-      NSNavPanelExpandedStateForSaveMode2 = true;
-
-      # Quickly repeat keys when held
-      InitialKeyRepeat = 15;
-      KeyRepeat = 2;
-    };
-    # TODO:
-    # showAppExposeGestureEnabled = 1;
-    # showMissionControlGestureEnabled = 1;
-    dock = {
-      appswitcher-all-displays = false;
-      autohide = false;
-      mineffect = "scale";
-      minimize-to-application = false;
-      mru-spaces = false;
-      orientation = "bottom";
-      show-process-indicators = false;
-      showhidden = false;
-      show-recents = false;
-      static-only = false;
-      magnification = true;
-
-      # Disable hot corners
-      wvous-tl-corner = 1;
-      wvous-bl-corner = 1;
-      wvous-tr-corner = 1;
-      wvous-br-corner = 1;
-    };
-    finder = {
-      AppleShowAllFiles = false;
-      ShowStatusBar = false;
-      ShowPathbar = false;
-      FXDefaultSearchScope = "SCcf"; # Search current folder first when searching
-      FXPreferredViewStyle = "Nlsv"; # Prefer list view
-      AppleShowAllExtensions = true;
-      FXEnableExtensionChangeWarning = false; # Do not warn when changing file extensions
-    };
-    menuExtraClock = {
-      ShowAMPM = true;
-      ShowDayOfWeek = false;
-      ShowDate = 0; # Show full date
-    };
-    screencapture.location = "~/Downloads";
-    trackpad = {
-      Clicking = true; # tap to click
-      Dragging = true; # tap to drag
-      TrackpadThreeFingerDrag = true;
-    };
-  };
-
-  system.defaults.CustomUserPreferences = {
-    "com.apple.desktopservices" = {
-      DSDontWriteNetworkStores = true;
-    };
-    # Requires disabling SIP?
-    # "com.apple.Safari" = {
-    #   AutoOpenSafeDownloads = false; # Prevent opening "safe" files automatically
-    #   ShowFullURLInSmartSearchField = false;
-    #   ShowFavoritesBar = false;
-    #   WebContinuousSpellCheckingEnabled = true;
-    #   WebAutomaticSpellingCorrectionEnabled = false;
-    #   WarnAboutFraudulentWebsites = true;
-    #   "com.apple.Safari.ContentPageGroupIdentifier.WebKit2BackspaceKeyNavigationEnabled" = false;
-
-    #   # Develop menu
-    #   IncludeDevelopMenu = true;
-    #   WebKitDeveloperExtrasEnabledPreferenceKey = true;
-    #   "com.apple.Safari.ContentPageGroupIdentifier.WebKit2DeveloperExtrasEnabled" = true;
-
-    #   # TODO: Set "compact" tab layout
-    # };
-
-    # TODO: Handle in disable-update module
-    "at.obdev.littlesnitch.softwareupdate".SoftwareUpdateCheckAutomatically = false;
-  };
-}
diff --git a/modules/darwin/system/default.nix b/modules/darwin/system/default.nix
new file mode 100644
index 00000000..38474371
--- /dev/null
+++ b/modules/darwin/system/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./disable-updates.nix
+    ./start-on-activation.nix
+  ];
+}
diff --git a/modules/darwin/system/disable-updates.nix b/modules/darwin/system/disable-updates.nix
new file mode 100644
index 00000000..8573c67e
--- /dev/null
+++ b/modules/darwin/system/disable-updates.nix
@@ -0,0 +1,75 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.system.disableUpdates;
+
+  updateOptions = {config, ...}: {
+    options = {
+      domain = mkOption {
+        type = types.str;
+        description = "Domain of application for which updates will be disabled";
+      };
+
+      keys = mkOption {
+        type = types.listOf types.str;
+        description = "Keys used for software update";
+      };
+    };
+  };
+
+  # Defaults from: https://github.com/sparkle-project/Sparkle/blob/2.x/Sparkle/SUConstants.m
+  defaultKeys = ["SUEnableAutomaticChecks" "SUAutomaticallyUpdate"];
+in {
+  options.system.disableUpdates = mkOption {
+    type = with types;
+      listOf (coercedTo str (domain: {
+        inherit domain;
+        keys = defaultKeys;
+      }) (submodule updateOptions));
+    default = [];
+    example = literalExpression ''
+      [
+        "com.example.App"
+        {
+          domain = "com.enterprise.App";
+          keys = ["CustomSoftwareUpdateFramework"]
+        }
+      ]
+    '';
+    description = let
+      quoteStr = k: "\"${k}\"";
+      defaultKeysStr = builtins.concatStringsSep " " (map quoteStr defaultKeys);
+    in ''
+      List of domains and associated keys to write defaults that attempt to disable
+      automatic software updates and associated prompts.
+
+      Domains defined as strings, e.g. "com.example.App", are shorthand for default keys:
+
+      `{ domain = "com.example.App"; keys = [${defaultKeysStr}]; }`
+
+      Default keys are from the Sparkle project, a popular software update framework.
+    '';
+  };
+
+  config = mkIf (length cfg > 0) {
+    system.defaults.CustomUserPreferences = let
+      mkDisabledValues = keys:
+        builtins.listToAttrs (map (key: {
+            name = key;
+            value = false;
+          })
+          keys);
+    in
+      builtins.listToAttrs (map
+        (
+          e: {
+            name = e.domain;
+            value = mkDisabledValues e.keys;
+          }
+        )
+        cfg);
+  };
+}
diff --git a/modules/darwin/start-on-activation.nix b/modules/darwin/system/start-on-activation.nix
similarity index 100%
rename from modules/darwin/start-on-activation.nix
rename to modules/darwin/system/start-on-activation.nix