diff --git a/docs/chezmoi/data.mdx b/docs/chezmoi/data.mdx
index f4110bc..22f0ee5 100644
--- a/docs/chezmoi/data.mdx
+++ b/docs/chezmoi/data.mdx
@@ -38,7 +38,7 @@ One manifest per platform, plus a `shared` block. Any edit to the file changes t
 
 | Source | Packages |
 | --- | --- |
-| pacman | `niri`, `noctalia`, `xwayland-satellite`, `polkit-gnome`, `uwsm`, `xdg-user-dirs`; Wayland utilities `wl-clipboard`, `cliphist`, `wtype`, `ydotool`, `grim`, `slurp`, `hyprpicker`, `pamixer`, `brightnessctl`, `libnotify`; apps `nautilus`, `imv`, `mpv`, `evince`, `chromium`, `obsidian`; strata runtime deps `bubblewrap`, `desktop-file-utils`, `fontconfig`, `gstreamer`, `gst-libav`, `gst-plugins-base`, `gst-plugins-good`, `gtk4`, `gtksourceview5`, `gvfs`, `poppler-glib`, `xdg-utils` |
+| pacman | `niri`, `noctalia`, `xwayland-satellite`, `polkit`, `polkit-gnome`, `uwsm`, `xdg-user-dirs`; Wayland utilities `wl-clipboard`, `cliphist`, `wtype`, `ydotool`, `grim`, `slurp`, `hyprpicker`, `pamixer`, `brightnessctl`, `libnotify`; apps `nautilus`, `imv`, `mpv`, `evince`, `chromium`, `obsidian`; strata runtime deps `bubblewrap`, `desktop-file-utils`, `fontconfig`, `gstreamer`, `gst-libav`, `gst-plugins-base`, `gst-plugins-good`, `gtk4`, `gtksourceview5`, `gvfs`, `poppler-glib`, `xdg-utils` |
 | AUR (or a sync repo with the same name) | `vicinae-bin`, `tldraw-offline-bin`; desktop apps `beeper-bin`, `fastmail`, `1password`, `brave-origin-bin`, `claude-desktop`, `spotify` |
 | `[omarchy]` repo (`packages.arch.desktop.omarchy`, only when `pacman-conf -l` lists that repo) | `herdr`, `flea`, `voxtype-bin`, `xdg-terminal-exec`, `hyprland-preview-share-picker` |
 | `[cachyos]` repo (`packages.arch.desktop.cachyos`, only when `pacman-conf -l` lists that repo) | `umbriel`, `xdg-desktop-portal-umbriel` (the AUR `umbriel` is a placeholder and `umbriel-git` conflicts with the repo build) |
diff --git a/docs/chezmoi/externals-and-ignore.mdx b/docs/chezmoi/externals-and-ignore.mdx
index 631ef32..5e3e060 100644
--- a/docs/chezmoi/externals-and-ignore.mdx
+++ b/docs/chezmoi/externals-and-ignore.mdx
@@ -156,7 +156,7 @@ mise tool versions stay local to each machine and are not managed.
 {{ end }}
 ```
 
-The block is emitted, and these paths skipped, unless the OS is `linux` and the role is `desktop` or `laptop`. `mac` and `server` machines, and any non-Linux machine regardless of role, never receive the niri and Hyprland configs (`dot_config/niri/`, `dot_config/hypr/`), fontconfig (`dot_config/fontconfig/fonts.conf`), default-app associations (`dot_config/mimeapps.list`), the fish auto-start hook (`dot_config/fish/auto-Niri.fish`), the systemd user units (`dot_config/systemd/user/kitty-day-save.service`, `projects-sync.service`, `projects-sync.timer`), or the `niri-launch`, `cp-appid`, `kitty-day-save` and `projects-sync` scripts. The `noctalia` and `niri-dynamic-workspaces` rules match nothing in the current source tree; they only take effect if those configs are added later.
+The block is emitted, and these paths skipped, unless the OS is `linux` and the role is `desktop` or `laptop`. `mac` and `server` machines, and any non-Linux machine regardless of role, never receive the niri, Umbriel, and Hyprland configs (`dot_config/niri/`, `dot_config/umbriel/`, `dot_config/hypr/`), the Noctalia config (`dot_config/noctalia/config.toml`), fontconfig (`dot_config/fontconfig/fonts.conf`), default-app associations (`dot_config/mimeapps.list`), the fish auto-start hook (`dot_config/fish/auto-Niri.fish`), the systemd user units (`dot_config/systemd/user/kitty-day-save.service`, `projects-sync.service`, `projects-sync.timer`), or the `niri-launch`, `umbriel-launch`, `umbriel-smart-move`, `cp-appid`, `kitty-day-save` and `projects-sync` scripts. The `niri-dynamic-workspaces` rule matches nothing in the current source tree; it only takes effect if that config is added later.
 
 | Machine | Desktop layer |
 | --- | --- |
diff --git a/docs/desktop/index.mdx b/docs/desktop/index.mdx
index d183a9c..494875f 100644
--- a/docs/desktop/index.mdx
+++ b/docs/desktop/index.mdx
@@ -28,7 +28,7 @@ Three Wayland compositors are configured side by side. niri is the original setu
 
 | Source | Packages |
 | --- | --- |
-| pacman | `niri`, `noctalia` (the CachyOS build where that repo is configured, else `extra`), `xwayland-satellite`, `polkit-gnome`, `uwsm`, `xdg-user-dirs`, Wayland utilities (`wl-clipboard`, `cliphist`, `wtype`, `ydotool`, `grim`, `slurp`, `hyprpicker`, `pamixer`, `brightnessctl`, `libnotify`), the bound apps (`nautilus`, `imv`, `mpv`, `evince`, `chromium`, `obsidian`), and strata's runtime deps |
+| pacman | `niri`, `noctalia` (the CachyOS build where that repo is configured, else `extra`), `xwayland-satellite`, `polkit`, `polkit-gnome`, `uwsm`, `xdg-user-dirs`, Wayland utilities (`wl-clipboard`, `cliphist`, `wtype`, `ydotool`, `grim`, `slurp`, `hyprpicker`, `pamixer`, `brightnessctl`, `libnotify`), the bound apps (`nautilus`, `imv`, `mpv`, `evince`, `chromium`, `obsidian`), and strata's runtime deps |
 | AUR via `yay`/`paru` (a sync repo wins when it has the name) | `vicinae-bin`, `tldraw-offline-bin`, and the desktop apps `beeper-bin`, `fastmail`, `1password`, `brave-origin-bin`, `claude-desktop`, `spotify` |
 | `[omarchy]` repo, when configured | `herdr`, `flea`, `voxtype-bin`, `xdg-terminal-exec`, `hyprland-preview-share-picker` |
 | `[cachyos]` repo, when configured | `umbriel`, `xdg-desktop-portal-umbriel` |
diff --git a/docs/desktop/umbriel.mdx b/docs/desktop/umbriel.mdx
index 7fdc5ab..627c343 100644
--- a/docs/desktop/umbriel.mdx
+++ b/docs/desktop/umbriel.mdx
@@ -5,6 +5,8 @@ description: Umbriel scrolling compositor config — Noctalia-only session, niri
 
 [Umbriel](https://docs.noctalia.dev/umbriel/) is a wlroots scrolling compositor from the Noctalia project. The config ports the [niri](/desktop/niri) layout, rules, springs, and binds, and adds the per-app scratch workspaces from [Hyprland](/desktop/hyprland) as Umbriel scratchpads. The session starts only `noctalia`: its launcher, clipboard history, polkit agent, notifications, and OSD replace vicinae, cliphist, and polkit-gnome.
 
+Noctalia's polkit agent is off by default. `dot_config/noctalia/config.toml` (→ `~/.config/noctalia/config.toml`, merged under the GUI's unmanaged `~/.local/state/noctalia/settings.toml`) sets `[shell] polkit_agent = true`, so `pkexec` and other privileged actions prompt in a Noctalia panel. `polkitd` itself is D-Bus activated (`polkit.service` is static; nothing to enable). The setting also applies under niri, which still starts polkit-gnome: only one agent registers per session, whichever starts first.
+
 :::note
 Linux `desktop` and `laptop` roles only (`.chezmoiignore.tmpl`). `umbriel` and its portal backend `xdg-desktop-portal-umbriel` (screenshots and screen sharing for portal clients) come from the `[cachyos]` repo (`packages.arch.desktop.cachyos`); the AUR `umbriel` is a placeholder and `umbriel-git` conflicts with the repo build, so other Arch machines install them by hand.
 :::