diff --git a/.editorconfig b/.editorconfig
index 6b19e96..18a0a98 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -8,12 +8,6 @@ indent_size = 2
 trim_trailing_whitespace = true
 insert_final_newline = true
 
-[*.{nix,yaml,yml,json,md,sh,toml}]
-indent_style = space
-indent_size = 2
-trim_trailing_whitespace = true
-insert_final_newline = true
-
 # Markdown uses trailing whitespace for hard line breaks.
 [*.md]
 trim_trailing_whitespace = false
diff --git a/flake.nix b/flake.nix
index 2f6a4dd..3e65810 100644
--- a/flake.nix
+++ b/flake.nix
@@ -93,8 +93,6 @@
         # Unfree packages permitted to be built (replaces blanket allowUnfree).
         unfreePackages = [
           "claude-code"
-          "lens"
-          "lens-desktop"
         ];
 
         # Per-user identity, keyed by username. See README "Users".
diff --git a/home/README.md b/home/README.md
index e100128..173f1d9 100644
--- a/home/README.md
+++ b/home/README.md
@@ -110,23 +110,23 @@ declaratively with **nixvim**, so the same plugins and config are baked in on
 every host. Migrated from plain vim; the practical gain is a real LSP stack in
 place of the old (inert) ALE.
 
-| Feature        | Notes                                                                                  |
-| -------------- | -------------------------------------------------------------------------------------- |
-| Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                    |
-| File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                               |
-| Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers   |
-| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise)  |
-| Git            | fugitive (`:Git …`) + gitsigns gutter signs/blame                                      |
-| Diagnostics    | inline + trouble list (`<leader>xx`)                                                   |
-| Completion     | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion                              |
-| Indent guides  | indent-blankline, on by default (was vim-indent-guides)                                |
-| Statusline     | lualine (Catppuccin theme)                                                             |
-| Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects               |
-| Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes           |
-| Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)            |
-| LSP            | nvim-cmp completion + servers `nil` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
-| Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on          |
-| Filetypes      | `*Jenkinsfile` → groovy                                                                |
+| Feature        | Notes                                                                                     |
+| -------------- | ----------------------------------------------------------------------------------------- |
+| Colorscheme    | Catppuccin Mocha (matches the terminal and the rest of the desktop)                       |
+| File tree      | nvim-tree, toggled with `,,` (comma twice; was nerdtree)                                  |
+| Fuzzy finder   | telescope (+fzf-native): `<leader>ff` files, `<leader>fg` grep, `<leader>fb` buffers      |
+| Format on save | conform-nvim (nixfmt, stylua, ruff, shfmt, prettier, gofumpt; LSP fallback otherwise)     |
+| Git            | fugitive (`:Git …`) + gitsigns gutter signs/blame                                         |
+| Diagnostics    | inline + trouble list (`<leader>xx`)                                                      |
+| Completion     | nvim-cmp (LSP/buffer/path) with luasnip snippet expansion                                 |
+| Indent guides  | indent-blankline, on by default (was vim-indent-guides)                                   |
+| Statusline     | lualine (Catppuccin theme)                                                                |
+| Editing        | which-key hints, comment (`gc`/`gcc`), autopairs, treesitter textobjects                  |
+| Pane nav       | vim-tmux-navigator — `Ctrl`+`h/j/k/l` moves across vim splits and tmux panes              |
+| Syntax         | tree-sitter (nix, lua, bash, markdown, groovy, c#, python, terraform, yaml)               |
+| LSP            | nvim-cmp completion + servers `nil_ls` (Nix), `lua_ls`, `pyright` (Python), `terraformls` |
+| Indentation    | 2-wide hard tabs (`noexpandtab`, `tabstop`/`shiftwidth` = 2); line numbers on             |
+| Filetypes      | `*Jenkinsfile` → groovy                                                                   |
 
 Leader is `Space`. LSP keymaps (`gd`, `gr`, `K`, `<leader>rn`, `<leader>ca`) and
 the file-tree toggle are listed in
diff --git a/hosts/RPi5/docker.nix b/hosts/RPi5/docker.nix
index ff4dc88..1fe1b4f 100644
--- a/hosts/RPi5/docker.nix
+++ b/hosts/RPi5/docker.nix
@@ -8,6 +8,10 @@
 # secure upgrade path is mutual TLS on 2376 (--tlsverify with client certs);
 # that needs out-of-band cert provisioning and is intentionally not wired here.
 { ... }:
+let
+  # LAN allowed to reach the unauthenticated Docker TCP socket (see SECURITY above).
+  trustedSubnet = "10.187.1.0/24";
+in
 {
   virtualisation.docker.enable = true;
 
@@ -29,6 +33,6 @@
   # CIDR to match the LAN that should reach the Docker API.
   networking.nftables.enable = true;
   networking.firewall.extraInputRules = ''
-    ip saddr 10.187.1.0/24 tcp dport 2375 accept
+    ip saddr ${trustedSubnet} tcp dport 2375 accept
   '';
 }
diff --git a/users/emmathorpe/work.nix b/users/emmathorpe/work.nix
index b435b95..a68d816 100644
--- a/users/emmathorpe/work.nix
+++ b/users/emmathorpe/work.nix
@@ -24,7 +24,6 @@
     pkgs.powershell
     pkgs.nuget
     pkgs.gedit
-    pkgs.lens
     pkgs.python3
     pkgs.gnumake
     pkgs.gcc