diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml
index 4045263..f743596 100644
--- a/.forgejo/workflows/test.yml
+++ b/.forgejo/workflows/test.yml
@@ -17,6 +17,7 @@ jobs:
       #     authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
       - run: nix flake check
         continue-on-error: true
+      - run: nix build .#brlaser
       - run: nix build .#deconz
       - run: nix build .#nixosConfigurations.home-server.config.system.build.toplevel
       # - run: nix build .#nixosConfigurations.home-pc.config.system.build.toplevel
diff --git a/flake.lock b/flake.lock
index e95bc40..d7fbb10 100644
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1754433428,
-        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
+        "lastModified": 1750173260,
+        "narHash": "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
+        "rev": "531beac616433bac6f9e2a19feb8e99a22a66baf",
         "type": "github"
       },
       "original": {
@@ -26,11 +26,11 @@
     "arkenfox-userjs": {
       "flake": false,
       "locked": {
-        "lastModified": 1755109759,
-        "narHash": "sha256-+DN5bKev9IyefMikOqEWZf/u0flJbLAxwEotGhKSSS4=",
+        "lastModified": 1745247844,
+        "narHash": "sha256-YfgmhyqLH067pjqRSeCpfqFkeaac1nBvsKcrRNkKw7o=",
         "owner": "arkenfox",
         "repo": "user.js",
-        "rev": "9103afafff2b5287b495c1a1268968fdb447d66f",
+        "rev": "7f852e94fc80fd0aa19f1c948319974e3301187f",
         "type": "github"
       },
       "original": {
@@ -129,11 +129,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1756267413,
-        "narHash": "sha256-6U8w5ekYCkSl+abrWoZbMRIJh38pjO2zCQsLxhh9ea4=",
+        "lastModified": 1753070653,
+        "narHash": "sha256-vp4Svdpb90eEYkUKxjVROgcJ92u/2sVF8hnpsiKJEhI=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "cfca2aacacfd57476bd4137033e1b181ed239dff",
+        "rev": "87f5912350a5bac28eacc1b89bb1767ca1a77e7e",
         "type": "gitlab"
       },
       "original": {
@@ -178,11 +178,11 @@
     "flake-compat_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1747046372,
-        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -198,11 +198,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1754487366,
-        "narHash": "sha256-pHYj8gUBapuUzKV/kN/tR3Zvqc7o6gdFB9XKXIp1SQ8=",
+        "lastModified": 1751413152,
+        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "af66ad14b28a127c5c0f3bbb298218fc63528a18",
+        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
         "type": "github"
       },
       "original": {
@@ -314,11 +314,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756245065,
-        "narHash": "sha256-aAZNbGcWrVRZgWgkQbkabSGcDVRDMgON4BipMy69gvI=",
+        "lastModified": 1753055804,
+        "narHash": "sha256-KerePGJYX47ex6OY3CWsid4AltO2gDtQROunYJ0eCEE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "54b2879ce622d44415e727905925e21b8f833a98",
+        "rev": "adf195f021a8cbb0c317f75b52e96c82616526f9",
         "type": "github"
       },
       "original": {
@@ -405,11 +405,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1756245047,
-        "narHash": "sha256-9bHzrVbjAudbO8q4vYFBWlEkDam31fsz0J7GB8k4AsI=",
+        "lastModified": 1752666637,
+        "narHash": "sha256-P8J72psdc/rWliIvp8jUpoQ6qRDlVzgSDDlgkaXQ0Fw=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a65b650d6981e23edd1afa1f01eb942f19cdcbb7",
+        "rev": "d1bfa8f6ccfb5c383e1eba609c1eb67ca24ed153",
         "type": "github"
       },
       "original": {
@@ -420,11 +420,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756217674,
-        "narHash": "sha256-TH1SfSP523QI7kcPiNtMAEuwZR3Jdz0MCDXPs7TS8uo=",
+        "lastModified": 1752866191,
+        "narHash": "sha256-NV4S2Lf2hYmZQ3Qf4t/YyyBaJNuxLPyjzvDma0zPp/M=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4e7667a90c167f7a81d906e5a75cba4ad8bee620",
+        "rev": "f01fe91b0108a7aff99c99f2e9abbc45db0adc2a",
         "type": "github"
       },
       "original": {
@@ -436,11 +436,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1756125398,
-        "narHash": "sha256-XexyKZpf46cMiO5Vbj+dWSAXOnr285GHsMch8FBoHbc=",
+        "lastModified": 1752950548,
+        "narHash": "sha256-NS6BLD0lxOrnCiEOcvQCDVPXafX1/ek1dfJHX1nUIzc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3b9f00d7a7bf68acd4c4abb9d43695afb04e03a5",
+        "rev": "c87b95e25065c028d31a94f06a62927d18763fdf",
         "type": "github"
       },
       "original": {
@@ -475,11 +475,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1756283140,
-        "narHash": "sha256-8AuMP13UaN30a/9bT4JzpCRqmjh0VxfPAK073RJv4UM=",
+        "lastModified": 1753086528,
+        "narHash": "sha256-5RMRU6J7fiaHzA0Bz/xStfuLLQ1AtJfIagxHqEhAb2c=",
         "owner": "astro",
         "repo": "nix-openwrt-imagebuilder",
-        "rev": "7fd8eb5de4235f44a8071ffd3daf877a9f2c4de6",
+        "rev": "09b9e58d8b4e98193590aa02f60b41881fad840d",
         "type": "github"
       },
       "original": {
@@ -497,11 +497,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755960406,
-        "narHash": "sha256-RF7j6C1TmSTK9tYWO6CdEMtg6XZaUKcvZwOCD2SICZs=",
+        "lastModified": 1750779888,
+        "narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "e891a93b193fcaf2fc8012d890dc7f0befe86ec2",
+        "rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
         "type": "github"
       },
       "original": {
diff --git a/home/felschr-work.nix b/home/felschr-work.nix
index 9b9d7fa..924a8e2 100644
--- a/home/felschr-work.nix
+++ b/home/felschr-work.nix
@@ -56,7 +56,7 @@ with pkgs;
 
     # security & privacy
     unstable.proton-pass
-    unstable.proton-authenticator
+    authenticator
     collision
     metadata-cleaner
     raider
diff --git a/home/felschr.nix b/home/felschr.nix
index 08cbe7b..95c4076 100644
--- a/home/felschr.nix
+++ b/home/felschr.nix
@@ -69,7 +69,7 @@
 
     # security & privacy
     unstable.proton-pass
-    unstable.proton-authenticator
+    authenticator
     collision
     metadata-cleaner
     raider
diff --git a/system/networking.nix b/system/networking.nix
index edd1a18..831e5a3 100644
--- a/system/networking.nix
+++ b/system/networking.nix
@@ -122,31 +122,12 @@ in
 
   networking.networkmanager.dispatcherScripts = [
     {
-      source = pkgs.writeShellScript "wifi-auto-toggle" ''
-        LOG_PREFIX="WiFi Auto-Toggle"
-
-        if [[ "$1" =~ ^(enp|eth) ]]; then
-          case "$2" in
-            up)
-              echo "$LOG_PREFIX ethernet up"
-              ${pkgs.networkmanager}/bin/nmcli radio wifi off
-              ;;
-            down)
-              echo "$LOG_PREFIX ethernet down"
-              ${pkgs.networkmanager}/bin/nmcli radio wifi on
-              ;;
-          esac
-        elif [[ "$(${pkgs.networkmanager}/bin/nmcli -g GENERAL.STATE device show $ETHERNET_INTERFACE)" = "20 (unavailable)" ]]; then
-          echo "$LOG_PREFIX failsafe"
-          ${pkgs.networkmanager}/bin/nmcli radio wifi on
-        fi
-      '';
-    }
-    {
-      source = pkgs.writeShellScript "connect-ice" ''
+      #!/usr/bin/env bash
+      source = pkgs.writeText "connect_ice" ''
+        set -euxo pipefail
         ACTION="$2"
         if [[ "$ACTION" == "up" ]]; then
-          if [[ "$CONNECTION_ID" =~ ^(WIFIonICE|WIFI\@DB)$ ]]; then
+          if [[ "$CONNECTION_ID" =~ "WIFIonICE|WIFI@DB" ]]; then
             ${pkgs.curl}/bin/curl 'https://login.wifionice.de/cna/logon' -sSL -X POST
           fi
         fi