{...}: {
  flake.nixosModules.t480UsbWakeup = {...}: {
    services.udev.extraRules = ''
      # Wake the T480 from S3 suspend via a keyboard plugged into a built-in USB
      # port. The dock connects over the Thunderbolt-3 controller (3c:00.0), which
      # powers down in S3 and cannot detect a cold replug — so dock-connected input
      # cannot wake the machine after an unplug-triggered suspend. The built-in xHCI
      # (00:14.0) stays wake-capable in S3, so a keyboard on a built-in port works.
      #
      # Arm ONLY the keyboard itself (match by VID:PID — the USB bus path is
      # unstable across re-enumeration). Deliberately do NOT arm the built-in root
      # hubs: arming a whole root hub makes it wake on hub-level events (USB-C PD
      # negotiation, the SD card reader, internal peripherals), causing spurious
      # self-wakes. A leaf device's remote-wakeup propagates through the hub without
      # the hub's own wakeup flag being set.
      ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="320f", ATTR{idProduct}=="5055", ATTR{power/wakeup}="enabled"
    '';
  };
}