diff --git a/dot_config/noctalia/config.toml b/dot_config/noctalia/config.toml
new file mode 100644
index 0000000..ca00e6f
--- /dev/null
+++ b/dot_config/noctalia/config.toml
@@ -0,0 +1,9 @@
+# Noctalia hand-written config (merged under the GUI's
+# ~/.local/state/noctalia/settings.toml, which is not managed).
+# Reference: https://docs.noctalia.dev/noctalia/configuration/
+
+[shell]
+# Built-in polkit authentication agent: the Umbriel session starts nothing but
+# Noctalia, so without it pkexec and other privileged actions fail with "no
+# agent is available". Only one agent can register per session.
+polkit_agent = true