{...}: {
  # QMK/VIA keyboard tooling. QMK's uaccess rule lets the active local seat talk
  # to HID devices; remote and non-seat sessions intentionally get no access.
  flake.nixosModules.via = {pkgs, ...}: {
    environment.systemPackages = with pkgs; [
      via
      qmk
      vial
    ];

    # Do not add pkgs.via or pkgs.vial to services.udev.packages: both make
    # every hidraw device world-writable. QMK's rules use seat-scoped ACLs.
    hardware.keyboard.qmk.enable = true;
  };
}