{ ... }:

{
  boot.blacklistedKernelModules = [
    # copy.fail
    "af_alg"
    "algif_aead"
    "algif_hash"
    "algif_rng"
    "algif_skcipher"

    # dirtyfrag / Fragnesia
    "esp4"
    "esp6"
    "rxrpc"

    # PinTheft
    "rds"
  ];
}