diff --git a/AGENTS.md b/AGENTS.md
index 9e704c5..6db36b1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -39,6 +39,7 @@ Prefer the following placements:
 | ---------------------------------------------------- | ------------------------------------------------------- |
 | Nix settings shared by every system host             | `modules/systems/nix/common.nix`                        |
 | NixOS-only boot configuration                        | `modules/systems/boot/.../nixos.nix`                    |
+| Disko NixOS module and CLI                           | `modules/systems/disko/`                                |
 | macOS Dock defaults                                  | `modules/systems/dock/darwin.nix`                       |
 | macOS trackpad defaults                              | `modules/systems/trackpad/darwin.nix`                   |
 | Ghostty-specific configuration                       | `modules/applications/ghostty/`                         |
@@ -312,10 +313,11 @@ Application metadata should include only dependencies technically required for
 the application to work. A profile owns the user's choice to adopt several
 otherwise independent applications together. For example, the niri application
 includes the Wayland foundation as a technical dependency. The
-`profiles.interface.linux-desktop` profile selects Ghostty, Nautilus, and
-Vicinae because both GNOME and niri use them, while `profiles.interface.niri`
-selects only the niri-specific shell and services. Ghostty must not depend on
-niri, and niri-specific keybindings remain owned by the niri unit.
+`profiles.interface.linux-desktop` profile selects Ghostty and Nautilus because
+both GNOME and niri use them, while the cross-platform `profiles.interface.gui`
+profile selects Vicinae for graphical hosts. `profiles.interface.niri` selects
+only the niri-specific shell and services. Ghostty and Vicinae must not depend
+on niri, and niri-specific keybindings remain owned by the niri unit.
 
 ## Profiles
 
@@ -329,6 +331,7 @@ modules/profiles/
 ├── base/
 ├── interface/
 │   ├── cli/
+│   ├── gui/
 │   ├── macos/
 │   ├── linux-desktop/
 │   ├── gnome/
@@ -366,10 +369,13 @@ The profile layers have these responsibilities:
   includes only `systems.nix`; optional secrets, interface, hardware, and
   workloads do not belong there.
 - `interface` describes how the host is operated. `interface.cli` is shared by
-  NixOS and macOS and includes `tio`. `interface.macos` owns the macOS Dock and
-  trackpad defaults. `interface.linux-desktop` owns the common GNOME/niri
-  desktop selection, including Ghostty, Nautilus, and Vicinae. GNOME and niri
-  remain independently selectable and do not imply CLI or personal workloads.
+  NixOS and macOS and includes `tio`. `interface.gui` owns cross-platform
+  graphical interface applications such as Vicinae. `interface.macos` owns the
+  macOS Dock and trackpad defaults and includes `interface.gui`.
+  `interface.linux-desktop` owns the common GNOME/niri desktop selection,
+  including Ghostty and Nautilus, and also includes `interface.gui`. GNOME and
+  niri remain independently selectable and do not imply CLI or personal
+  workloads.
 - `platform` describes NixOS foundations and physical or virtual form factors.
   macOS does not need an empty symmetric platform profile.
 - `workload` describes optional host uses. `workload.development` and
diff --git a/hosts/default.nix b/hosts/default.nix
index c3dd680..8858b66 100644
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -12,6 +12,7 @@
       "interface.niri"
       "platform.thinkpad-x1"
       "security.fingerprint"
+      # "security.secrets"
       "workload.personal"
     ];
   };
@@ -27,6 +28,7 @@
       "interface.cli"
       "interface.macos"
       "security.fingerprint"
+      # "security.secrets"
       "workload.development"
       "workload.personal"
     ];
diff --git a/modules/applications/vicinae/home.nix b/modules/applications/vicinae/home.nix
index 491ecd4..9d4ccc8 100644
--- a/modules/applications/vicinae/home.nix
+++ b/modules/applications/vicinae/home.nix
@@ -6,6 +6,7 @@
 }:
 let
   isLinux = pkgs.stdenv.hostPlatform.isLinux;
+  isDarwin = pkgs.stdenv.hostPlatform.isDarwin;
   extensions = inputs.vicinae-extensions.packages.${pkgs.stdenv.hostPlatform.system};
 in
 {
@@ -16,6 +17,10 @@ in
       autoStart = true;
       environment.USE_LAYER_SHELL = 1;
     };
+    launchd = lib.mkIf isDarwin {
+      enable = true;
+      autoStart = true;
+    };
     settings = {
       font.size = 11;
       close_on_focus_loss = true;
diff --git a/modules/profiles/README.md b/modules/profiles/README.md
index f2510cf..1156fb8 100644
--- a/modules/profiles/README.md
+++ b/modules/profiles/README.md
@@ -24,6 +24,7 @@ when removing it from any supported host would make that host invalid.
 | ------------------------------------ | ------------------------------------- |
 | `base`                               | NixOS, macOS                          |
 | `interface.cli`                      | NixOS, macOS with Home Manager        |
+| `interface.gui`                      | NixOS, macOS with Home Manager        |
 | `interface.macos`                    | macOS                                 |
 | `interface.linux-desktop`            | NixOS with Home Manager               |
 | `interface.gnome`                    | NixOS with Home Manager               |
@@ -46,7 +47,8 @@ when removing it from any supported host would make that host invalid.
 
 Select independent concerns independently in `hosts/default.nix`. For example,
 a NixOS desktop can combine `interface.gnome` and `interface.niri` to provide
-both sessions while sharing `interface.linux-desktop`; niri supplies ly. A
+both sessions while sharing `interface.linux-desktop` and `interface.gui`; niri
+supplies ly. A
 daily-use macOS development machine can combine `interface.macos`,
 `workload.development`, and `workload.personal`. Hardware support does not
 implicitly select an interface or workload.
diff --git a/modules/profiles/interface/gui/meta.nix b/modules/profiles/interface/gui/meta.nix
new file mode 100644
index 0000000..8157949
--- /dev/null
+++ b/modules/profiles/interface/gui/meta.nix
@@ -0,0 +1,5 @@
+{
+  description = "Cross-platform graphical interface applications";
+
+  includes = [ "applications.vicinae" ];
+}
diff --git a/modules/profiles/interface/linux-desktop/meta.nix b/modules/profiles/interface/linux-desktop/meta.nix
index ffcbdf1..43bcc5a 100644
--- a/modules/profiles/interface/linux-desktop/meta.nix
+++ b/modules/profiles/interface/linux-desktop/meta.nix
@@ -2,11 +2,11 @@
   description = "Shared NixOS graphical desktop foundation";
 
   includes = [
+    "profiles.interface.gui"
     "applications.fcitx5"
     "applications.ghostty"
     "applications.gtk"
     "applications.nautilus"
-    "applications.vicinae"
     "hardwares.graphics"
     "systems.audio"
     "systems.fonts"
diff --git a/modules/profiles/interface/macos/meta.nix b/modules/profiles/interface/macos/meta.nix
index f2bc3f9..5d8d7c9 100644
--- a/modules/profiles/interface/macos/meta.nix
+++ b/modules/profiles/interface/macos/meta.nix
@@ -2,6 +2,7 @@
   description = "macOS graphical interface defaults";
 
   includes = [
+    "profiles.interface.gui"
     "systems.dock"
     "systems.trackpad"
   ];
diff --git a/modules/profiles/platform/nixos/meta.nix b/modules/profiles/platform/nixos/meta.nix
index d2451e0..b29a3b9 100644
--- a/modules/profiles/platform/nixos/meta.nix
+++ b/modules/profiles/platform/nixos/meta.nix
@@ -2,6 +2,7 @@
   description = "Foundation shared by all NixOS platforms";
 
   includes = [
+    "systems.disko"
     "systems.boot.base"
     "systems.locale"
     "systems.networking.base"
diff --git a/modules/systems/disko/nixos.nix b/modules/systems/disko/nixos.nix
index 346da7e..1ffc128 100644
--- a/modules/systems/disko/nixos.nix
+++ b/modules/systems/disko/nixos.nix
@@ -1,4 +1,13 @@
-{ lib, ... }:
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
 {
   disko.enableConfig = lib.mkDefault false;
+
+  environment.systemPackages = [
+    inputs.disko.packages.${pkgs.stdenv.hostPlatform.system}.disko
+  ];
 }