diff --git a/home/cli.nix b/home/cli.nix
index 55bd085..88e0408 100644
--- a/home/cli.nix
+++ b/home/cli.nix
@@ -36,6 +36,7 @@
     trash-cli       # rm с корзиной
     texliveFull     # LaTeX (~4GB, для математики)
     gita            # manage multiple git repos
+    ffmpeg_7        # видео-конвертация (remux/перекодирование)
   ];
 
   # TODO: global npm/pnpm packages not managed by nix for now
diff --git a/home/server.nix b/home/server.nix
index f1fbf35..f385277 100644
--- a/home/server.nix
+++ b/home/server.nix
@@ -74,13 +74,15 @@
     enable = true;
     userName = "mikl";
     userEmail = "mikl@iscg.dev";
-    extraConfig = {
+    settings = {
       init.defaultBranch = "main";
       pull.rebase = true;
       push.autoSetupRemote = true;
-      diff.pager = "delta";
     };
-    delta.enable = true;
+  };
+  programs.delta = {
+    enable = true;
+    enableGitIntegration = true;
   };
 
   # --- Zsh: минимульный, без pure-prompt и fastfetch (это десктоп-флёр) ---
diff --git a/hosts/common/default.nix b/hosts/common/default.nix
index 0e9b6c6..6ea7f87 100644
--- a/hosts/common/default.nix
+++ b/hosts/common/default.nix
@@ -13,6 +13,16 @@
     isNormalUser = true;
     shell = pkgs.zsh;
     home = "/home/mikl";
+    extraGroups = [ "wheel" ];   # для passwordless sudo (см. ниже)
+  };
+
+  # Passwordless sudo для mikl на NixOS-серверах.
+  # На старых YC-боксах это приходило через cloud-config user-data
+  # (NOPASSWD:ALL); в NixOS задаём декларативно. Без этого админить
+  # сервер вслепую (kubectl, journalctl, nixos-rebuild) невозможно.
+  security.sudo = {
+    enable = true;
+    wheelNeedsPassword = false;
   };
 
   environment.systemPackages = [
diff --git a/hosts/heather/image.nix b/hosts/heather/image.nix
index 608808b..92b3fe8 100644
--- a/hosts/heather/image.nix
+++ b/hosts/heather/image.nix
@@ -43,7 +43,7 @@ with lib;
   boot.loader.grub.enable = mkDefault true;
   boot.loader.grub.device = "/dev/vda";
   boot.loader.grub.configurationLimit = 1;   # только текущее, но механизм выбора есть
-  boot.loader.grub.timeout = 0;
+  boot.loader.timeout = 0;
   boot.loader.systemd-boot.enable = mkForce false;
   boot.loader.efi.canTouchEfiVariables = mkForce false;
 
@@ -89,7 +89,7 @@ with lib;
   image.baseName = "heather";
   image.extension = "qcow2";
   system.nixos.tags = [ "yandex-cloud" ];
-  system.build.image = import (modulesPath + "/lib/make-disk-image.nix") {
+  system.build.image = import (modulesPath + "/../lib/make-disk-image.nix") {
     name = "heather-image";
     inherit (config.image) baseName;
     partitionTableType = "legacy";   # MBR + single ext4 root
diff --git a/hosts/poppy/apps.nix b/hosts/poppy/apps.nix
index e3d7989..2f0e4a8 100644
--- a/hosts/poppy/apps.nix
+++ b/hosts/poppy/apps.nix
@@ -36,6 +36,7 @@
       "amneziavpn"
       "element"
       "prismlauncher"
+      "losslesscut"    # lossless-нарезка/remux видео (GUI на базе ffmpeg)
     ];
   };