{
  config,
  pkgs,
  inputs,
  ...
}:
{
  # Enable KDE Wallet (KWallet) for secret management
  security.pam.services.login.kwallet.enable = config.services.displayManager.sddm.enable;
  programs.bash.shellInit = ''
    export SUITECLOUD_CI_PASSKEY="$(cat ${config.age.secrets."sdk-ci-passkey".path})"
  '';
  programs.zsh.shellInit = ''
    export SUITECLOUD_CI_PASSKEY="$(cat ${config.age.secrets."sdk-ci-passkey".path})"
  '';

  # Install necessary tools and libraries
  environment = {
    sessionVariables = {
      SECRETSERVICE_BACKEND = "kwallet";
      SUITECLOUD_CI = 1;
    };
    systemPackages =
      with pkgs;
      [
        libsecret # Library for secrets (used by apps like Git, Chrome)
        jdk21_headless
        # nodejs_22 # migrated to modules/node/default.nix
      ]
      ++ (
        if config.services.displayManager.sddm.enable then
          [
            pkgs.kwalletcli # CLI tool for KWallet (optional)
            pkgs.kdePackages.kwalletmanager # GUI to manage KWallet (optional)
            pkgs.kdePackages.kwallet-pam
          ]
        else
          [ ]
      );
  };
}