diff --git a/flake.nix b/flake.nix
index 48e73e5..0f0e4ba 100644
--- a/flake.nix
+++ b/flake.nix
@@ -162,5 +162,9 @@
 
       checks = import ./checks.nix { inherit inputs forEachSystem formatter; };
       devShells = import ./shell.nix { inherit inputs forEachSystem checks; };
+
+      packages.bitwarden-rofi =
+        inputs.nixpkgs.legacyPackages.x86-64_linux.callPackage ./pkgs/bitwarden-rofi
+          { };
     };
 }
diff --git a/pkgs/bitwarden-rofi/default.nix b/pkgs/bitwarden-rofi/default.nix
new file mode 100644
index 0000000..c99fdc8
--- /dev/null
+++ b/pkgs/bitwarden-rofi/default.nix
@@ -0,0 +1,70 @@
+# source: https://github.com/kylesferrazza/nix/blob/288edcd1d34884b9b7083c6d718fbe10febe0623/overlay/bitwarden-rofi.nix
+# TODO https://github.com/mattydebie/bitwarden-rofi/issues/34
+
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  makeWrapper,
+  unixtools,
+  xsel,
+  xclip,
+  wl-clipboard,
+  xdotool,
+  ydotool,
+  bitwarden-cli,
+  rofi,
+  jq,
+  keyutils,
+  libnotify,
+}:
+let
+  bins = [
+    jq
+    bitwarden-cli
+    unixtools.getopt
+    rofi
+    xsel
+    xclip
+    wl-clipboard
+    xdotool
+    ydotool
+    keyutils
+    libnotify
+  ];
+in
+stdenv.mkDerivation {
+  pname = "bitwarden-rofi";
+  version = "git-2024-08-22";
+
+  src = fetchFromGitHub {
+    owner = "mattydebie";
+    repo = "bitwarden-rofi";
+    rev = "8be76fdd647c2bdee064e52603331d8e6ed5e8e2";
+    sha256 = "";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    mkdir -p "$out/bin"
+    install -Dm755 "bwmenu" "$out/bin/bwmenu"
+    install -Dm755 "lib-bwmenu" "$out/bin/lib-bwmenu" # TODO don't put this in bin
+
+    install -Dm755 -d "$out/usr/share/doc/bitwarden-rofi"
+    install -Dm755 -d "$out/usr/share/doc/bitwarden-rofi/img"
+
+    install -Dm644 "README.md" "$out/usr/share/doc/bitwarden-rofi/README.md"
+    install -Dm644 img/* "$out/usr/share/doc/bitwarden-rofi/img/"
+
+    wrapProgram "$out/bin/bwmenu" --prefix PATH : ${lib.makeBinPath bins}
+  '';
+
+  meta = with lib; {
+    description = "Wrapper for Bitwarden and Rofi";
+    homepage = "https://github.com/mattydebie/bitwarden-rofi";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+  };
+
+}
diff --git a/systems/palatine-hill/hardware-changes.nix b/systems/palatine-hill/hardware-changes.nix
index cc820bc..94b099b 100644
--- a/systems/palatine-hill/hardware-changes.nix
+++ b/systems/palatine-hill/hardware-changes.nix
@@ -28,6 +28,8 @@
       "noatime"
       "nodiratime"
       "discard"
+      "fmask=0077"
+      "dmask=0077"
     ];
 
     "/nix".depends = [
diff --git a/users/alice/home/hypr/hyprland.conf b/users/alice/home/hypr/hyprland.conf
index 0d18f6e..d1381a6 100644
--- a/users/alice/home/hypr/hyprland.conf
+++ b/users/alice/home/hypr/hyprland.conf
@@ -200,4 +200,4 @@ bind = $mainMod, K, exec, pkill zoom; zoom
 bind = $mainMod, escape, exec, hyprctl reload
 
 # open bwm
-bind = $mainMod, O, exec, bwm
+bind = $mainMod, P, exec, bwm
diff --git a/users/alice/non-server.nix b/users/alice/non-server.nix
index f2bbcb8..b171b2d 100644
--- a/users/alice/non-server.nix
+++ b/users/alice/non-server.nix
@@ -57,5 +57,6 @@
     nextcloud-client
     bitwarden-cli
     bitwarden-menu
+    wtype
   ];
 }