{...}: {
  flake.nixosModules.t480UsbWakeup = {...}: {
    services.udev.extraRules = ''
      # Wake the T480 from S3 suspend via a keyboard plugged into a built-in USB
      # port. The dock connects over the Thunderbolt-3 controller (3c:00.0), which
      # powers down in S3 and cannot detect a cold replug — so dock-connected input
      # cannot wake the machine after an unplug-triggered suspend. The built-in xHCI
      # (00:14.0) stays wake-capable in S3, so a keyboard on a built-in port works.
      #
      # Arm the built-in xHCI root hubs (idVendor 1d6b = Linux Foundation root hub),
      # scoped to the built-in controller so the TB3 root hubs are left untouched.
      ACTION=="add", SUBSYSTEM=="usb", KERNELS=="0000:00:14.0", ATTR{idVendor}=="1d6b", ATTR{power/wakeup}="enabled"
      # Arm the IQUNIX MQ80 keyboard itself. Match by VID:PID — the USB bus path
      # is unstable across re-enumeration, so path-based matching is unreliable.
      ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="320f", ATTR{idProduct}=="5055", ATTR{power/wakeup}="enabled"
    '';
  };
}