diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index 03ccd68..0433e72 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -50,6 +50,25 @@ in
     # `nixpkgs.config = lib.mkForce { allowUnfree = false; }`.
     nixpkgs.config.allowUnfree = true;
 
+    # ── One keyboard layout everywhere, incl. the LUKS prompt ────────
+    # services.xserver.xkb.layout is the single source of truth for the
+    # layout (the installer writes it; downstream sets it in system.nix).
+    # These bridge that one knob through to the encrypted-disk prompt —
+    # without them, setting only xkb.layout moves the graphical session
+    # but leaves the console keymap unset, so the initrd LUKS passphrase
+    # prompt falls back to US:
+    #   useXkbConfig    the virtual-console keymap follows xkb (TTYs)
+    #   earlySetup      bakes that keymap into the initrd
+    #   systemd initrd  loads it before cryptsetup asks for the passphrase
+    #                   (the legacy scripted initrd cannot; also what
+    #                   Plymouth needs — defaulted here so it no longer
+    #                   hinges on the splash being enabled).
+    # All mkDefault, so an explicit console.keyMap or a scripted initrd
+    # still wins.
+    console.useXkbConfig = lib.mkDefault true;
+    console.earlySetup = lib.mkDefault true;
+    boot.initrd.systemd.enable = lib.mkDefault true;
+
     # ── Wayland session: Hyprland ────────────────────────────────────
     # Installs the binary, registers the session, wires up
     # xdg-desktop-portal-hyprland. Configuration is Home Manager's job.
diff --git a/modules/nixos/plymouth.nix b/modules/nixos/plymouth.nix
index b57c262..91fb4b1 100644
--- a/modules/nixos/plymouth.nix
+++ b/modules/nixos/plymouth.nix
@@ -80,11 +80,12 @@ let
 in
 {
   config = lib.mkIf cfg.plymouth.enable {
-    # Plymouth wants the systemd initrd (also what applies the keyboard
-    # layout to the LUKS prompt) and a quiet console around it.
-    boot.initrd.systemd.enable = lib.mkDefault true;
+    # The systemd initrd (boot.initrd.systemd.enable) and console.earlySetup
+    # that Plymouth needs are now distro-wide defaults in ./default.nix
+    # (they also carry the keyboard layout to the LUKS prompt), so the
+    # splash no longer has to turn them on. Just keep the console quiet
+    # around the splash.
     boot.initrd.verbose = lib.mkDefault false;
-    console.earlySetup = lib.mkDefault true;
     boot.consoleLogLevel = lib.mkDefault 0;
 
     boot.plymouth = {