diff --git a/modules/nixos/shared/security/services.nix b/modules/nixos/shared/security/services.nix
index 706670b..2e6cae9 100644
--- a/modules/nixos/shared/security/services.nix
+++ b/modules/nixos/shared/security/services.nix
@@ -24,6 +24,9 @@ in {
   ];
   systemd.services = {
     nix-daemon.serviceConfig.RestrictNamespaces = lib.mkForce [];
-    sshd.serviceConfig.ProtectHome = lib.mkForce "no";
+    sshd.serviceConfig = {
+      ReadWritePaths = ["/storage" "/etc/nixos"];
+      ProtectHome = lib.mkForce "no";
+    };
   };
 }
diff --git a/modules/users/user/programs.nix b/modules/users/user/programs.nix
index 7ff431c..7dfff44 100644
--- a/modules/users/user/programs.nix
+++ b/modules/users/user/programs.nix
@@ -213,8 +213,8 @@ in {
       appimage-run
       adwaita-icon-theme
       # vial # qmk keyboard configuring app
-      perSystem.t3code.t3code-desktop
-      perSystem.t3code.t3code-server
+      (perSystem.t3code.desktop.override {withCodex = true;})
+      (perSystem.t3code.server.override {withCodex = true;})
       pinentry-gnome3 # pinentry for rbw
       (mkIf libvirtd.enable virt-manager) # libvirt gui
       # waycheck # check wayland protocols