diff --git a/deploy/nixos/configuration.nix b/deploy/nixos/configuration.nix
index 6c11db7..11f6d22 100644
--- a/deploy/nixos/configuration.nix
+++ b/deploy/nixos/configuration.nix
@@ -13,7 +13,18 @@
   # - speechd: text-to-speech (speech-dispatcher → espeak-ng → mbrola, ~1GB).
   #   An ATM does not talk.
   # - documentation: man/info/NixOS manual — no one reads them on a kiosk.
+  # - pipewire: the audio stack (+ WirePlumber, ALSA, the PulseAudio shim),
+  #   ~353MB. The app has never played a sound — nothing under apps/machine or
+  #   packages/ constructs an Audio element or ships an audio file.
+  #
+  # All three need mkForce, not just an absent/false assignment: enabling
+  # services.xserver pulls in NixOS's `graphical-desktop` module, which
+  # mkDefault-enables speechd AND pipewire (services/misc/graphical-desktop.nix).
+  # Dropping our own `enable = true` simply falls back to that default — the
+  # 353MB stayed until this was forced off. Re-enable pipewire (with alsa +
+  # pulse) and security.rtkit if transaction sounds are ever added.
   services.speechd.enable = lib.mkForce false;
+  services.pipewire.enable = lib.mkForce false;
   documentation.enable = false;
   documentation.nixos.enable = false;
 
@@ -99,14 +110,6 @@
     user = "bitspire";
   };
 
-  # Audio (for transaction sounds)
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    pulse.enable = true;
-  };
-
   # System packages
   environment.systemPackages = with pkgs; [
     # System utilities