diff --git a/flake.lock b/flake.lock
index 00e97de..2fcbdc6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2122,6 +2122,7 @@
         "paseo": "paseo",
         "reenv": "reenv",
         "rusic": "rusic",
+        "spacebot-src": "spacebot-src",
         "spacedrive-src": "spacedrive-src",
         "zed": "zed",
         "zen-browser": "zen-browser"
@@ -2249,6 +2250,22 @@
         "type": "github"
       }
     },
+    "spacebot-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1778363043,
+        "narHash": "sha256-Brc2PZP0CyQTpsWEY0G8hHfzALLvvITPAtHI7mh5a1k=",
+        "owner": "spacedriveapp",
+        "repo": "spacebot",
+        "rev": "ac52277404d3813045aa053b78c95810ab85e7c5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "spacedriveapp",
+        "repo": "spacebot",
+        "type": "github"
+      }
+    },
     "spacedrive-src": {
       "flake": false,
       "locked": {
diff --git a/flake.nix b/flake.nix
index 23aad31..0e9d070 100644
--- a/flake.nix
+++ b/flake.nix
@@ -13,6 +13,10 @@
       url = "github:spacedriveapp/spacedrive";
       flake = false;
     };
+    spacebot-src = {
+      url = "github:spacedriveapp/spacebot";
+      flake = false;
+    };
     dmm = {
       url = "github:deadlock-mod-manager/deadlock-mod-manager/v1.0.0";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -96,6 +100,7 @@
       bun2nix,
       crane,
       spacedrive-src,
+      spacebot-src,
       ...
     }@attrs:
     {
@@ -188,6 +193,7 @@
                       pkgs = final;
                       craneLib = crane.mkLib final;
                       upstreamRoot = spacedrive-src;
+                      spacebotRoot = spacebot-src;
                       inherit (sources)
                         frontendSrc
                         daemonRustSrc
diff --git a/pkgs/spacedrive/nix/default.nix b/pkgs/spacedrive/nix/default.nix
index cbc532d..24b4213 100644
--- a/pkgs/spacedrive/nix/default.nix
+++ b/pkgs/spacedrive/nix/default.nix
@@ -2,6 +2,7 @@
   pkgs,
   craneLib,
   upstreamRoot,
+  spacebotRoot,
   frontendSrc,
   daemonRustSrc,
   desktopRustSrc,
@@ -91,6 +92,37 @@ let
 
     postPatch = ''
       cp ${../bun.lock} bun.lock
+      ln -s ${spacebotRoot} ../spacebot
+
+      substituteInPlace apps/tauri/src/contextMenu.ts \
+        --replace-fail \
+          "import { Menu, MenuItem, Submenu, PredefinedMenuItem } from '@tauri-apps/api/menu';" \
+          "import { LogicalPosition } from '@tauri-apps/api/dpi'; import { Menu, MenuItem, Submenu, PredefinedMenuItem } from '@tauri-apps/api/menu';" \
+        --replace-fail \
+          'await menu.popup();' \
+          'await menu.popup(new LogicalPosition(position.x, position.y));'
+
+      # The sidebar is z-[65]. Radix portals default to z-50, which puts the
+      # space switcher menu behind the translucent sidebar stacking context.
+      # Radix copies the content z-index to its popper wrapper, so raising the
+      # content also fixes the compositor order of the wrapper.
+      substituteInPlace packages/interface/src/components/SpacesSidebar/SpaceSwitcher.tsx \
+        --replace-fail \
+          'className="min-w-[var(--radix-dropdown-menu-trigger-width)] p-1"' \
+          'className="z-[100] min-w-[var(--radix-dropdown-menu-trigger-width)] p-1"'
+
+      # The published primitives package uses these classes for its dialog
+      # overlay and content, but Tailwind does not scan the package through its
+      # node_modules symlink. Define the missing utilities explicitly.
+      substituteInPlace apps/tauri/src/index.css \
+        --replace-fail \
+          '@source "../../../../spaceui/packages/primitives/src";' \
+          '@source "../../../../spaceui/packages/primitives/src";
+
+/* Utilities referenced by @spacedrive/primitives but absent from this build. */
+.z-\[102\] { z-index: 102; }
+.z-\[103\] { z-index: 103; }'
+
     '';
 
     buildPhase = ''
@@ -197,7 +229,18 @@ let
       src = daemonRustSrc;
       cargoArtifacts = daemonCargoArtifacts;
       cargoExtraArgs = "--package sd-core --bin sd-daemon --features ffmpeg";
-      postPatch = rust197PostPatch;
+      postPatch = rust197PostPatch + ''
+        substituteInPlace core/src/volume/platform/linux.rs \
+          --replace-fail \
+            '.args(["-h", "-T"]) // -T shows filesystem type' \
+            '.args(["-B1", "-T"]) // Exact bytes; unlike -h, this is locale-independent'
+
+        substituteInPlace core/src/volume/utils.rs \
+          --replace-fail '"/" | "/usr"' '"/usr"' \
+          --replace-fail \
+            'assert!(should_hide_by_mount_path(Path::new("/")));' \
+            'assert!(!should_hide_by_mount_path(Path::new("/")));'
+      '';
       buildInputs = daemonBuildInputs;
       nativeBuildInputs = daemonNativeBuildInputs ++ [ pkgs.makeWrapper ];
       LIBCLANG_PATH = "${pkgs.llvmPackages.libclang.lib}/lib";
@@ -241,8 +284,31 @@ let
       src = desktopRustSrc;
       cargoArtifacts = desktopCargoArtifacts;
       cargoExtraArgs = "--package spacedrive --bin Spacedrive";
-      patches = [ ../graceful-global-shortcut.patch ];
-      postPatch = rust197PostPatch;
+      patches = [
+        ../graceful-global-shortcut.patch
+      ];
+      postPatch = rust197PostPatch + ''
+        substituteInPlace apps/tauri/src-tauri/src/main.rs \
+          --replace-fail 'for i in 0..30 {' 'for i in 0..300 {' \
+          --replace-fail 'connection not available after 3 seconds' 'connection not available after 30 seconds'
+
+        substituteInPlace apps/tauri/src-tauri/tauri.conf.json \
+          --replace-fail '"decorations": true' '"decorations": false'
+
+        substituteInPlace apps/tauri/src-tauri/src/windows.rs \
+          --replace-fail 'true,  // decorations' 'false, // decorations'
+
+        substituteInPlace apps/tauri/src-tauri/src/main.rs \
+          --replace-fail \
+            '// Explicitly remove menu on Windows' \
+            '// Explicitly remove the native menu bar on Windows and Linux'
+        sed -i '/Explicitly remove the native menu bar/{
+          n
+          s/#\[cfg(target_os = "windows")\]/#[cfg(any(target_os = "windows", target_os = "linux"))]/
+        }' apps/tauri/src-tauri/src/main.rs
+        grep -Fq '#[cfg(any(target_os = "windows", target_os = "linux"))]' \
+          apps/tauri/src-tauri/src/main.rs
+      '';
 
       nativeBuildInputs = commonNativeBuildInputs ++ [
         pkgs.wrapGAppsHook4
@@ -261,14 +327,17 @@ let
       '';
 
       postInstall = ''
-        mkdir -p $out/share/icons/hicolor/128x128/apps
+        mkdir -p $out/bin $out/share/icons/hicolor/128x128/apps
+        ln -s ${sd-daemon}/bin/sd-daemon $out/bin/sd-daemon
+        ln -s ${sd-daemon}/bin/sd-daemon $out/bin/sd-daemon-${targetTriple}
         cp apps/tauri/src-tauri/icons/128x128.png $out/share/icons/hicolor/128x128/apps/spacedrive.png
       '';
 
       postFixup = ''
         wrapProgram $out/bin/Spacedrive \
           --set GST_PLUGIN_SYSTEM_PATH_1_0 ${gstreamerPluginPath} \
-          --set SPACEDRIVE_DAEMON_PATH ${sd-daemon}/bin/sd-daemon
+          --set WEBKIT_DMABUF_RENDERER_FORCE_SHM 1 \
+          --set WEBKIT_FORCE_COMPOSITING_MODE 1
       '';
 
       meta = with lib; {
diff --git a/servers/eisen/configuration.nix b/servers/eisen/configuration.nix
index 8ee6996..cb2cedd 100644
--- a/servers/eisen/configuration.nix
+++ b/servers/eisen/configuration.nix
@@ -37,7 +37,7 @@ let
     livekit-jwt = 8080;
   };
   matrixServerName = "matrix.badapple.cz";
-  livekitKeyFile = "/etc/secrets/livekit.keys";
+  livekitKeyFile = "/var/lib/livekit/keys";
 in
 {
   deployment = {
@@ -98,7 +98,15 @@ in
       settings.global = {
         server_name = matrixServerName;
         port = [ ports.matrix ];
-        allow_registration = false;
+        allow_registration = true;
+        oidc_native_auth = true;
+        ip_source = "rightmost_x_forwarded_for";
+        registration_token_file = "/etc/secrets/matrix-registration-token";
+
+        well_known = {
+          client = "https://${matrixServerName}";
+          livekit_url = "wss://${matrixServerName}/livekit/sfu";
+        };
       };
     };
 
@@ -335,7 +343,7 @@ in
           }) (builtins.attrNames ports)
         )
         // {
-          "${matrixServerName}" = {
+          "${matrixServerName}:80" = {
             extraConfig = ''
               @matrixClientWellKnown path /.well-known/matrix/client
               handle @matrixClientWellKnown {
@@ -388,6 +396,40 @@ in
   };
   systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = matrixServerName;
 
+  systemd.services.livekit-keys = {
+    description = "Generate the shared LiveKit API key";
+    before = [
+      "livekit.service"
+      "lk-jwt-service.service"
+    ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      StateDirectory = "livekit";
+      StateDirectoryMode = "0700";
+      UMask = "0077";
+    };
+    script = ''
+      if [[ ! -s "$STATE_DIRECTORY/keys" ]]; then
+        key="$(${lib.getExe pkgs.openssl} rand -base64 48)"
+        printf 'lk-jwt-service: %s\n' "$key" > "$STATE_DIRECTORY/keys"
+      fi
+    '';
+  };
+  systemd.services.livekit = {
+    requires = [ "livekit-keys.service" ];
+    after = [ "livekit-keys.service" ];
+  };
+  systemd.services.lk-jwt-service = {
+    requires = [ "livekit-keys.service" ];
+    after = [ "livekit-keys.service" ];
+  };
+
+  # The Karakeep module still emits this option, but Meilisearch 1.51 removed it.
+  systemd.services.meilisearch.serviceConfig.ExecStartPre = lib.mkAfter [
+    "${lib.getExe pkgs.gnused} -i '/^experimental_dumpless_upgrade =/d' \${RUNTIME_DIRECTORY}/config.toml"
+  ];
+
   # LiveKit's TCP ICE fallback is separate from its HTTP/WebSocket port.
   networking.firewall.allowedTCPPorts = [ 7881 ];
   # systemd.services.syncthing.environment.STNODEFAULTFOLDER = "true";
diff --git a/servers/ui-mode/home.nix b/servers/ui-mode/home.nix
index 48dc041..df8d214 100644
--- a/servers/ui-mode/home.nix
+++ b/servers/ui-mode/home.nix
@@ -132,6 +132,7 @@ in
     stateVersion = "25.11";
 
     packages = with pkgs; [
+      cinny
       spacedrive-master
       eden
       gh
diff --git a/with-extra.sh b/with-extra.sh
index 91f0b14..46ee46a 100644
--- a/with-extra.sh
+++ b/with-extra.sh
@@ -1 +1 @@
-nixos-rebuild boot --option extra-substituters "https://cache.nixos.org https://nix-community.cachix.org https://hyprland.cachix.org https://nix-gaming.cachix.org https://colmena.cachix.org https://install.determinate.systems https://cache.garnix.io https://rusic.cachix.org" --option extra-trusted-public-keys "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc= nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= rusic.cachix.org-1:WXMpGpamblLUiJtcoxBxGGGGwIcWxGPJBUxarLiqWmw=" --flake ".#fern"
+nixos-rebuild boot --option extra-substituters "https://cache.nixos.org https://nix-community.cachix.org https://hyprland.cachix.org https://nix-gaming.cachix.org https://colmena.cachix.org https://install.determinate.systems https://rusic.cachix.org" --option extra-trusted-public-keys "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc= nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs= cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= rusic.cachix.org-1:WXMpGpamblLUiJtcoxBxGGGGwIcWxGPJBUxarLiqWmw=" --flake ".#fern"