diff --git a/hosts/FredOS-Kayla.nix b/hosts/FredOS-Kayla.nix
index ddf25d0..bf91e6b 100644
--- a/hosts/FredOS-Kayla.nix
+++ b/hosts/FredOS-Kayla.nix
@@ -31,9 +31,25 @@
 
     boot.loader.systemd-boot.configurationLimit = 5;
 
+    # Remote admin: fred's keys (settings/users.nix) already include the gaming
+    # PC, and fred has NOPASSWD sudo everywhere, so `ssh fred@FredOS-Kayla` +
+    # `update` rebuilds her box without touching it. Keys only, no root.
+    services.openssh = {
+      enable = true;
+      settings = {
+        PermitRootLogin = "no";
+        PasswordAuthentication = false;
+      };
+    };
+
     # stylix's qt target only speaks qtct and warns under Plasma; its kde
     # target already paints Qt apps via kdeglobals. Both HM users on this box.
-    home-manager.sharedModules = [ { stylix.targets.qt.enable = false; } ];
+    home-manager.sharedModules = [ {
+      stylix.targets.qt.enable = false;
+      # Colours yes, wallpaper no — she picks her own in Plasma's wallpaper
+      # settings and it survives rebuilds.
+      stylix.targets.kde.useWallpaper = false;
+    } ];
 
     home-manager.users.kayla = { ... }: {
       home.stateVersion = "25.11";