diff --git a/flake.nix b/flake.nix
index a89031e..aad7d75 100644
--- a/flake.nix
+++ b/flake.nix
@@ -75,8 +75,16 @@
             pipewire.pulse.enable = true;
           };
           security.rtkit.enable = true;
+          security.sudo.enable = false;
+          
+          security.doas.enable = true;
+          security.doas.extraRules = [{
+            groups = ["wheel"];
+            keepEnv = true;
+            persist = true;
+          }];
           environment.systemPackages = with pkgs; [
-            nh alejandra literate
+            nh alejandra literate git
             # system utils
             firmware-updater mtr gnupg ddate testdisk tree wget btop plocate traceroute
             rlwrap entr unzip ffmpeg imagemagick
@@ -84,6 +92,7 @@
             fd bat xh tlrc dysk dust hyperfine ripgrep fzf eza
           ];
           environment.shellAliases = {
+            sudo = "doas";
             l = "eza --grid --all";
             ll = "eza --long --all";
             ls = "eza --long";
@@ -118,6 +127,16 @@
               character.success_symbol = "[λ](bold green)";
               character.error_symbol = "[λ](bold red)";
             };
+            
+            git.enable = true;
+            git.config = {
+              init.defaultBranch = "main";
+              advice.defaultBranchName = false;
+              gpg.format = "ssh";
+              commit.gpgSign = true;
+              url."https://github.com/".insteadOf = ["github:"];
+            };
+            
             obs-studio.enableVirtualCamera = true;
             ssh.startAgent = true;
             nix-ld.enable = true;
@@ -327,14 +346,6 @@
                   '';
                 };
                 
-                git.enable = true;
-                git.settings = {
-                  init.defaultBranch = "main";
-                  advice.defaultBranchName = false;
-                  gpg.format = "ssh";
-                  commit.gpgSign = true;
-                };
-                
                 librewolf.enable = true;
                 librewolf.languagePacks = ["en-GB"];
                 librewolf.settings = {
diff --git a/nixos.html b/nixos.html
index 7047214..a01b16c 100644
--- a/nixos.html
+++ b/nixos.html
@@ -292,13 +292,21 @@ services = {
 
 
 </div>
-<p>basic security options.
+<p>basic security options and <code>doas</code> configuration.
 </p>
 
 <div class="codeblock">
 <span class="codeblock_name">{nixos-configuration-contents <a href="nixos.html#1:4">4</a>} +=</span>
 <pre class="prettyprint lang-nix">
 security.rtkit.enable = true;
+security.sudo.enable = false;
+
+security.doas.enable = true;
+security.doas.extraRules = [{
+  groups = ["wheel"];
+  keepEnv = true;
+  persist = true;
+}];
 </pre>
 
 
@@ -312,7 +320,7 @@ packages!
 <span class="codeblock_name">{nixos-configuration-contents <a href="nixos.html#1:4">4</a>} +=</span>
 <pre class="prettyprint lang-nix">
 environment.systemPackages = with pkgs; [
-  nh alejandra literate
+  nh alejandra literate git
   # system utils
   firmware-updater mtr gnupg ddate testdisk tree wget btop plocate traceroute
   rlwrap entr unzip ffmpeg imagemagick
@@ -337,6 +345,7 @@ globally maybe?)
 <span class="codeblock_name">{nixos-configuration-contents <a href="nixos.html#1:4">4</a>} +=</span>
 <pre class="prettyprint lang-nix">
 environment.shellAliases = {
+  sudo = "doas";
   l = "eza --grid --all";
   ll = "eza --long --all";
   ls = "eza --long";
@@ -412,6 +421,16 @@ starship.settings = {
   character.success_symbol = "[λ](bold green)";
   character.error_symbol = "[λ](bold red)";
 };
+
+git.enable = true;
+git.config = {
+  init.defaultBranch = "main";
+  advice.defaultBranchName = false;
+  gpg.format = "ssh";
+  commit.gpgSign = true;
+  url."https://github.com/".insteadOf = ["github:"];
+};
+
 </pre>
 
 
@@ -870,14 +889,6 @@ tmux = {
   '';
 };
 
-git.enable = true;
-git.settings = {
-  init.defaultBranch = "main";
-  advice.defaultBranchName = false;
-  gpg.format = "ssh";
-  commit.gpgSign = true;
-};
-
 librewolf.enable = true;
 librewolf.languagePacks = ["en-GB"];
 librewolf.settings = {
diff --git a/nixos.lit b/nixos.lit
index fab5052..fa3fc65 100644
--- a/nixos.lit
+++ b/nixos.lit
@@ -202,10 +202,18 @@ services = {
 };
 ---
 
-basic security options.
+basic security options and `doas` configuration.
 
 --- nixos-configuration-contents +=
 security.rtkit.enable = true;
+security.sudo.enable = false;
+
+security.doas.enable = true;
+security.doas.extraRules = [{
+  groups = ["wheel"];
+  keepEnv = true;
+  persist = true;
+}];
 ---
 
 and now we get into the fun (translation: less boring) stuff with system
@@ -213,7 +221,7 @@ packages!
 
 --- nixos-configuration-contents +=
 environment.systemPackages = with pkgs; [
-  nh alejandra literate
+  nh alejandra literate git
   # system utils
   firmware-updater mtr gnupg ddate testdisk tree wget btop plocate traceroute
   rlwrap entr unzip ffmpeg imagemagick
@@ -232,6 +240,7 @@ globally maybe?)
 
 --- nixos-configuration-contents +=
 environment.shellAliases = {
+  sudo = "doas";
   l = "eza --grid --all";
   ll = "eza --long --all";
   ls = "eza --long";
@@ -288,6 +297,16 @@ starship.settings = {
   character.success_symbol = "[λ](bold green)";
   character.error_symbol = "[λ](bold red)";
 };
+
+git.enable = true;
+git.config = {
+  init.defaultBranch = "main";
+  advice.defaultBranchName = false;
+  gpg.format = "ssh";
+  commit.gpgSign = true;
+  url."https://github.com/".insteadOf = ["github:"];
+};
+
 ---
 
 a few one-off options here. these settings would be in the Home Manager section
@@ -603,14 +622,6 @@ tmux = {
   '';
 };
 
-git.enable = true;
-git.settings = {
-  init.defaultBranch = "main";
-  advice.defaultBranchName = false;
-  gpg.format = "ssh";
-  commit.gpgSign = true;
-};
-
 librewolf.enable = true;
 librewolf.languagePacks = ["en-GB"];
 librewolf.settings = {