diff --git a/etc/cups/cups-browsed.conf b/etc/cups/cups-browsed.conf
new file mode 100644
index 00000000..ed1bdbad
--- /dev/null
+++ b/etc/cups/cups-browsed.conf
@@ -0,0 +1,4 @@
+# Omarchy override of cups-browsed's shipped config. The only behavioural
+# change vs the upstream default (all-commented) is enabling auto-registration
+# of remote IPP printers discovered via Avahi/mDNS.
+CreateRemotePrinters Yes
diff --git a/etc/docker/daemon.json b/etc/docker/daemon.json
new file mode 100644
index 00000000..f1097647
--- /dev/null
+++ b/etc/docker/daemon.json
@@ -0,0 +1,6 @@
+{
+    "log-driver": "json-file",
+    "log-opts": { "max-size": "10m", "max-file": "5" },
+    "dns": ["172.17.0.1"],
+    "bip": "172.17.0.1/16"
+}
diff --git a/etc/gnupg/dirmngr.conf b/etc/gnupg/dirmngr.conf
new file mode 100644
index 00000000..8d327907
--- /dev/null
+++ b/etc/gnupg/dirmngr.conf
@@ -0,0 +1,7 @@
+keyserver hkps://keyserver.ubuntu.com
+keyserver hkps://pgp.surfnet.nl
+keyserver hkps://keys.mailvelope.com
+keyserver hkps://keyring.debian.org
+keyserver hkps://pgp.mit.edu
+
+connect-quick-timeout 4
diff --git a/etc/modprobe.d/omarchy-usb-autosuspend.conf b/etc/modprobe.d/omarchy-usb-autosuspend.conf
new file mode 100644
index 00000000..b66d637e
--- /dev/null
+++ b/etc/modprobe.d/omarchy-usb-autosuspend.conf
@@ -0,0 +1 @@
+options usbcore autosuspend=-1
diff --git a/etc/nsswitch.conf b/etc/nsswitch.conf
new file mode 100644
index 00000000..15b6555d
--- /dev/null
+++ b/etc/nsswitch.conf
@@ -0,0 +1,19 @@
+# Name Service Switch configuration file.
+# See nsswitch.conf(5) for details.
+
+passwd: files systemd
+group: files [SUCCESS=merge] systemd
+shadow: files systemd
+gshadow: files systemd
+
+publickey: files
+
+hosts: mymachines mdns_minimal [NOTFOUND=return] resolve files myhostname dns
+networks: files
+
+protocols: files
+services: files
+ethers: files
+rpc: files
+
+netgroup: files
diff --git a/etc/plymouth/plymouthd.conf b/etc/plymouth/plymouthd.conf
new file mode 100644
index 00000000..8bd07aed
--- /dev/null
+++ b/etc/plymouth/plymouthd.conf
@@ -0,0 +1,2 @@
+[Daemon]
+Theme=omarchy
diff --git a/etc/security/faillock.conf b/etc/security/faillock.conf
new file mode 100644
index 00000000..431f5e75
--- /dev/null
+++ b/etc/security/faillock.conf
@@ -0,0 +1,7 @@
+# Omarchy override of /etc/security/faillock.conf (upstream owned by `pam`).
+# The only behavioural change vs upstream defaults is raising `deny` from 3 to
+# 10 so users get more attempts before lockout.
+#
+# All other settings remain at upstream defaults (commented out). See
+# faillock.conf(5) for the full option list.
+deny = 10
diff --git a/etc/sudoers.d/omarchy-asdcontrol b/etc/sudoers.d/omarchy-asdcontrol
new file mode 100644
index 00000000..a8483b62
--- /dev/null
+++ b/etc/sudoers.d/omarchy-asdcontrol
@@ -0,0 +1 @@
+%wheel ALL=(ALL) NOPASSWD: /usr/bin/asdcontrol
diff --git a/etc/sudoers.d/omarchy-passwd-tries b/etc/sudoers.d/omarchy-passwd-tries
new file mode 100644
index 00000000..b87e3573
--- /dev/null
+++ b/etc/sudoers.d/omarchy-passwd-tries
@@ -0,0 +1 @@
+Defaults passwd_tries=10
diff --git a/etc/sudoers.d/omarchy-tzupdate b/etc/sudoers.d/omarchy-tzupdate
new file mode 100644
index 00000000..61e43d8b
--- /dev/null
+++ b/etc/sudoers.d/omarchy-tzupdate
@@ -0,0 +1 @@
+%wheel ALL=(root) NOPASSWD: /usr/bin/tzupdate, /usr/bin/timedatectl
diff --git a/etc/sysctl.d/90-omarchy-file-watchers.conf b/etc/sysctl.d/90-omarchy-file-watchers.conf
new file mode 100644
index 00000000..4d5e4e8a
--- /dev/null
+++ b/etc/sysctl.d/90-omarchy-file-watchers.conf
@@ -0,0 +1,3 @@
+# Raise inotify limits so VS Code, webpack, and similar dev tools don't hit the
+# default 8192 ceiling.
+fs.inotify.max_user_watches=524288
diff --git a/etc/sysctl.d/99-omarchy-sysctl.conf b/etc/sysctl.d/99-omarchy-sysctl.conf
new file mode 100644
index 00000000..b8845467
--- /dev/null
+++ b/etc/sysctl.d/99-omarchy-sysctl.conf
@@ -0,0 +1,2 @@
+# Solve common flakiness with SSH (MTU discovery on flaky links).
+net.ipv4.tcp_mtu_probing=1
diff --git a/etc/systemd/logind.conf.d/10-ignore-power-button.conf b/etc/systemd/logind.conf.d/10-ignore-power-button.conf
new file mode 100644
index 00000000..d86b8662
--- /dev/null
+++ b/etc/systemd/logind.conf.d/10-ignore-power-button.conf
@@ -0,0 +1,2 @@
+[Login]
+HandlePowerKey=ignore
diff --git a/etc/systemd/resolved.conf.d/10-disable-multicast.conf b/etc/systemd/resolved.conf.d/10-disable-multicast.conf
new file mode 100644
index 00000000..523ed7c9
--- /dev/null
+++ b/etc/systemd/resolved.conf.d/10-disable-multicast.conf
@@ -0,0 +1,2 @@
+[Resolve]
+MulticastDNS=no
diff --git a/etc/systemd/resolved.conf.d/20-docker-dns.conf b/etc/systemd/resolved.conf.d/20-docker-dns.conf
new file mode 100644
index 00000000..2c7f5276
--- /dev/null
+++ b/etc/systemd/resolved.conf.d/20-docker-dns.conf
@@ -0,0 +1,2 @@
+[Resolve]
+DNSStubListenerExtra=172.17.0.1
diff --git a/etc/systemd/system.conf.d/10-faster-shutdown.conf b/etc/systemd/system.conf.d/10-faster-shutdown.conf
new file mode 100644
index 00000000..90dce4f6
--- /dev/null
+++ b/etc/systemd/system.conf.d/10-faster-shutdown.conf
@@ -0,0 +1,2 @@
+[Manager]
+DefaultTimeoutStopSec=5s
diff --git a/etc/systemd/system/docker.service.d/no-block-boot.conf b/etc/systemd/system/docker.service.d/no-block-boot.conf
new file mode 100644
index 00000000..911bbfa0
--- /dev/null
+++ b/etc/systemd/system/docker.service.d/no-block-boot.conf
@@ -0,0 +1,2 @@
+[Unit]
+DefaultDependencies=no
diff --git a/etc/systemd/system/user@.service.d/10-faster-shutdown.conf b/etc/systemd/system/user@.service.d/10-faster-shutdown.conf
new file mode 100644
index 00000000..449242ce
--- /dev/null
+++ b/etc/systemd/system/user@.service.d/10-faster-shutdown.conf
@@ -0,0 +1,2 @@
+[Service]
+TimeoutStopSec=5s