configuration.nix

@@ -55,6 +55,22 @@ in
     }
   ];
 
+  # Let the kiosk app apply pending updates by restarting its own TTY
+  # session (re-autologin -> fresh cage + RadiantWave). Scoped to exactly
+  # one unit and verb; everything else keeps stock (denied) policy.
+  security.polkit.enable = true;
+  environment.etc."polkit-1/rules.d/10-kiosk-getty.rules".text = ''
+    polkit.addRule(function(action, subject) {
+      if (subject.user !== "kiosk") return null;
+      if (action.id !== "org.freedesktop.systemd1.manage-units") return null;
+      var unit = action.lookup("unit");
+      var verb = action.lookup("verb");
+      if ((unit === "getty@tty1.service" || unit === "getty@tty1") && verb === "restart") {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+
   hardware.graphics.enable = true;
 
   time.timeZone = "America/Chicago";
@@ -69,10 +85,6 @@ in
     operation = "switch";
   };
 
-  system.activationScripts.cleanRadiantFiles = ''
-    rm -rf /home/kiosk/.local/radiantwave/audio
-  '';
-
   # Virtual machine declaration
   virtualisation.vmVariant = {
     boot.loader.systemd-boot.enable = pkgs.lib.mkForce false;