{
  pov,
  hostConfig,
  config,
  lib,
  ...
}:
let
  inherit (lib) types;
  cfg = lib.getAttrFromPath pov config;

in
{

  option = {
    type = types.bool;
    default = false;
  };

  config = lib.mkIf (cfg.enable && cfg.kernel) {
    environment = {
      # memoryAllocator.provider = mkDefault "scudo"; # Breaks stuff
      # variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1"; # Breaks stuff
    };

    boot = {
      blacklistedKernelModules = [
        # Obscure network protocols
        "ax25"
        "netrom"
        "rose"

        # Old or rare or insufficiently audited filesystems
        "adfs"
        "affs"
        "bfs"
        "befs"
        "cramfs"
        "efs"
        "erofs"
        "exofs"
        "freevxfs"
        "f2fs"
        "hfs"
        "hpfs"
        "jfs"
        "minix"
        "nilfs2"
        "ntfs"
        "omfs"
        "qnx4"
        "qnx6"
        "sysv"
        "ufs"
      ];
      kernel.sysctl = {
        "kernel.yama.ptrace_scope" = lib.mkOverride 500 1;
        "kernel.kptr_restrict" = lib.mkOverride 500 2;
        "net.core.bpf_jit_enable" = lib.mkDefault false;
        "kernel.ftrace_enabled" = lib.mkDefault false;
      };
      kernelParams = lib.mkMerge [
        [
          # Slab/slub sanity checks, redzoning, and poisoning
          "slub_debug=FZP"

          # Overwrite free'd memory
          "page_poison=1"

          # Enable page allocator randomization
          "page_alloc.shuffle=1"
        ]
        # Disable hibernation (allows replacing the running kernel) unless requested
        (lib.mkIf (!hostConfig.hardware.allowHibernation) [ "nohibernate" ])
      ];
    };

    # Disable kernel module loading once the system is fully initialised.
    # FIXME: Remove reverse dependencies
    security.lockKernelModules = lib.mkDefault (!config.modules.presets.graphical.enable);
    # Prevent replacing the running kernel image w/o reboot
    boot.kernel.sysctl."kernel.kexec_load_disabled" = lib.mkDefault true;
  };

}