{pkgs, ...}: {
  # The encrypted USB is NOT part of boot anymore
  # We do NOT use crypttab or systemd-cryptsetup units at all

  fileSystems."/mnt/ssh-keys" = {
    device = "/dev/mapper/ssh-keys";
    fsType = "ext4";

    # keep it fully manual/on-demand
    options = ["noauto" "nofail"];
  };

  environment.systemPackages = with pkgs; [
    cryptsetup

    # 🔓 Mount + unlock + load SSH key
    (writeShellScriptBin "keys-mount" ''
      set -e

      DEVICE="/dev/disk/by-uuid/da31e270-80d4-4a89-9633-87dd4d736ca2"
      NAME="ssh-keys"
      MNT="/mnt/ssh-keys"

      echo "🔐 Unlocking encrypted USB..."
      sudo cryptsetup open "$DEVICE" "$NAME"

      echo "📂 Mounting..."
      sudo mount "/dev/mapper/$NAME" "$MNT"

      echo "🔑 Adding SSH key..."
      ssh-add "$MNT/poseidon"

      echo "✅ Done"
    '')

    # 🔒 Clean unmount + lock
    (writeShellScriptBin "keys-umount" ''
      set -e

      MNT="/mnt/ssh-keys"
      NAME="ssh-keys"

      echo "🔑 Removing SSH key..."
      ssh-add -d "$MNT/poseidon" 2>/dev/null || true

      echo "📤 Unmounting..."
      sudo umount "$MNT" || true

      echo "🔒 Closing encrypted device..."
      sudo cryptsetup close "$NAME" || true

      echo "✅ Done"
    '')
  ];

  # Create mountpoint safely (but do NOT enforce permissions on contents)
  systemd.tmpfiles.rules = [
    "d /mnt/ssh-keys 0755 root root -"
  ];
}