diff --git a/README.md b/README.md
index a639ef6..716171e 100644
--- a/README.md
+++ b/README.md
@@ -200,6 +200,18 @@ examples: **[docs/OVERRIDES.md](docs/OVERRIDES.md)**.
 | `nomarchy.system.greeter.enable` | `true` | greetd/tuigreet |
 | `nomarchy.system.audio.enable` | `true` | Pipewire stack |
 | `nomarchy.system.bluetooth.enable` | `true` | Bluetooth + blueman |
+| `nomarchy.system.power.enable` | `true` | Active power management (see below) |
+| `nomarchy.system.power.backend` | `"ppd"` | `"ppd"` (power-profiles-daemon + menu/Waybar switcher) or `"tlp"` (deeper battery tuning, no switcher) — mutually exclusive |
+| `nomarchy.system.power.laptop` | `false` | Marks a laptop, gating battery-only features; the installer sets it when a battery is present |
+| `nomarchy.system.power.thermal.enable` | `false` | thermald (Intel-only); the installer enables it on a GenuineIntel CPU |
+| `nomarchy.system.power.batteryChargeLimit` | `null` | Stop charging at this % (e.g. `80`) where the hardware supports it; needs `power.laptop` |
+
+Beyond the `nomarchy.*` surface, the system layer turns on the usual
+desktop services with `lib.mkDefault` (override natively). One worth
+calling out: **`services.fwupd.enable`** is on by default for firmware
+updates via LVFS — it only refreshes metadata, never flashes on its own,
+so run `fwupdmgr update` to apply. Disable with `services.fwupd.enable =
+false;` on machines without real firmware (VMs/headless).
 
 ## 4. How theming works
 
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index c3fb98a..ac4ab14 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -112,6 +112,15 @@ in
     services.gnome.gnome-keyring.enable = lib.mkDefault true;
     services.dbus.enable = lib.mkDefault true;
     services.upower.enable = lib.mkDefault true;
+
+    # Firmware updates via LVFS. Ships the daemon + its metadata-refresh
+    # timer only — it never flashes anything on its own; applying an update
+    # is an explicit `fwupdmgr update`. On by default as desktop security
+    # hygiene (BIOS/UEFI/Thunderbolt/SSD fixes land here); a clean no-op
+    # where LVFS sees no devices (VMs/headless). Disable natively with
+    # `services.fwupd.enable = false`.
+    services.fwupd.enable = lib.mkDefault true;
+
     networking.networkmanager.enable = lib.mkDefault true;
 
     # No double-unlock on hibernate. hypridle locks hyprlock before every