diff --git a/Docker-Compose.ign b/Docker-Compose.ign
index 3e8af53..a174d0e 100644
--- a/Docker-Compose.ign
+++ b/Docker-Compose.ign
@@ -181,7 +181,7 @@
   "systemd": {
     "units": [
       {
-        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/rpm-ostree install auditd docker-ce docker-compose-plugin firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf | /usr/bin/tee /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' \u003e\u003e /etc/systemd/system.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
+        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/rpm-ostree install docker-ce docker-compose-plugin firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf | /usr/bin/tee /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' \u003e\u003e /etc/systemd/system.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
         "enabled": true,
         "name": "postinst.service"
       },
diff --git a/Docker-Compose.yml b/Docker-Compose.yml
index 9a33498..baa7a70 100644
--- a/Docker-Compose.yml
+++ b/Docker-Compose.yml
@@ -45,7 +45,7 @@ systemd:
         ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf
         ExecStart=/usr/bin/systemctl restart chronyd
         ExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac
-        ExecStart=/usr/bin/rpm-ostree install auditd docker-ce docker-compose-plugin firewalld qemu-guest-agent tuned unbound
+        ExecStart=/usr/bin/rpm-ostree install docker-ce docker-compose-plugin firewalld qemu-guest-agent tuned unbound
         ExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth
         ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf
         ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf | /usr/bin/tee /etc/sysctl.d/990-security-misc.conf
diff --git a/Generic.ign b/Generic.ign
index 1443011..d1d2dde 100644
--- a/Generic.ign
+++ b/Generic.ign
@@ -174,7 +174,7 @@
   "systemd": {
     "units": [
       {
-        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/rpm-ostree install auditd docker-ce firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf -o /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' \u003e\u003e /etc/systemd/system.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
+        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/rpm-ostree install docker-ce firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf -o /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' \u003e\u003e /etc/systemd/system.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
         "enabled": true,
         "name": "postinst.service"
       },
diff --git a/Generic.yml b/Generic.yml
index 2dd36a0..e90b2ac 100644
--- a/Generic.yml
+++ b/Generic.yml
@@ -45,7 +45,7 @@ systemd:
         ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf
         ExecStart=/usr/bin/systemctl restart chronyd
         ExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac
-        ExecStart=/usr/bin/rpm-ostree install auditd docker-ce firewalld qemu-guest-agent tuned unbound
+        ExecStart=/usr/bin/rpm-ostree install docker-ce firewalld qemu-guest-agent tuned unbound
         ExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth
         ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf
         ExecStart=/usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf -o /etc/sysctl.d/990-security-misc.conf
diff --git a/UTM.ign b/UTM.ign
index 5e7dd8f..bba6869 100644
--- a/UTM.ign
+++ b/UTM.ign
@@ -160,7 +160,7 @@
   "systemd": {
     "units": [
       {
-        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf\nExecStart=/usr/bin/echo \"allow 10.0.2.2/32\" \u003e\u003e /etc/chrony.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree install auditd firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf -o /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/lib/sysctl.d/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/lib/sysctl.d/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/sudo -u unpriv https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' \u003e\u003e /etc/systemd/system.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
+        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf\nExecStart=/usr/bin/echo \"allow 10.0.2.2/32\" \u003e\u003e /etc/chrony.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree install firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf -o /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/lib/sysctl.d/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/lib/sysctl.d/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/sudo -u unpriv https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' \u003e\u003e /etc/systemd/system.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
         "enabled": true,
         "name": "postinst.service"
       },
diff --git a/UTM.yml b/UTM.yml
index 6d300d6..3ed96d8 100644
--- a/UTM.yml
+++ b/UTM.yml
@@ -45,7 +45,7 @@ systemd:
         ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf
         ExecStart=/usr/bin/echo "allow 10.0.2.2/32" >> /etc/chrony.conf
         ExecStart=/usr/bin/systemctl restart chronyd
-        ExecStart=/usr/bin/rpm-ostree install auditd firewalld qemu-guest-agent tuned unbound
+        ExecStart=/usr/bin/rpm-ostree install firewalld qemu-guest-agent tuned unbound
         ExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac
         ExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth
         ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf