diff --git a/system/machine/Darwin/configuration.nix b/system/machine/Darwin/configuration.nix
index e894e08..bea63d2 100644
--- a/system/machine/Darwin/configuration.nix
+++ b/system/machine/Darwin/configuration.nix
@@ -151,6 +151,38 @@
     };
   };
 
+  # Touch ID authorises sudo (and darwin-rebuild's sudo prompt) instead of a
+  # typed password. sudo_local keeps the change in /etc/pam.d/sudo_local so it
+  # survives macOS updates.
+  security.pam.services.sudo_local.touchIdAuth = true;
+
+  # Declarative macOS UI defaults -- the main reason to run nix-darwin beyond
+  # package management. Applied on activation; all reversible.
+  system.defaults = {
+    dock = {
+      autohide = true;
+      show-recents = false;
+      mru-spaces = false; # don't reorder spaces by use
+      tilesize = 48;
+    };
+    finder = {
+      AppleShowAllExtensions = true;
+      ShowPathbar = true;
+      FXPreferredViewStyle = "Nlsv"; # list view
+      _FXShowPosixPathInTitle = true;
+    };
+    NSGlobalDomain = {
+      AppleInterfaceStyle = "Dark";
+      ApplePressAndHoldEnabled = false; # key-repeat instead of the accent popup
+      InitialKeyRepeat = 15;
+      KeyRepeat = 2;
+    };
+    trackpad = {
+      Clicking = true; # tap to click
+      TrackpadThreeFingerDrag = true;
+    };
+  };
+
   # Used for backwards compatibility; read `darwin-rebuild changelog` before changing.
   system.stateVersion = 5;
 }