diff --git a/flake.nix b/flake.nix
index b690336..babac53 100644
--- a/flake.nix
+++ b/flake.nix
@@ -692,6 +692,16 @@
               # TODO: quirk: since git send-email requires perl support, which we don't seem to have on the pinephone, we're just disabling git for now
               # TODO: would likely be easier/better to somehow ignore the assertion? probably a way to do that...
               programs.git.enable = lib.mkForce false;
+
+              # this option is conflicted, presumably due to some assumption in my defaults/common config
+              # the sd-image module we're importing above has this set to true, so we better go with that?
+              # that said, I think the mobile-nixos bootloader module has this set to false, so...
+              # TODO: what does this mean?
+              boot.loader.generic-extlinux-compatible.enable = lib.mkForce true;
+
+              # another conflicting option since I think I default to NetworkManager and this conflicts with networking.wireless.enable
+              networking.networkmanager.enable = lib.mkForce false;
+              networking.wireless.enable = lib.mkForce true;
             }
           ];
         };
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index 4617883..624f43f 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -308,7 +308,7 @@
       settings = {
         PasswordAuthentication = false;
         KbdInteractiveAuthentication = false;
-        PermitRootLogin = "prohibit-password";
+        PermitRootLogin = lib.mkForce "prohibit-password";
       };
 
       openFirewall = lib.mkDefault true;
@@ -362,7 +362,7 @@
         modifications
         unstable-packages
       ];
-      config.allowUnfree = true;
+      # config.allowUnfree = true;
     };
 
     nix = {