diff --git a/systems/zaatar/atuin.nix b/systems/zaatar/atuin.nix
index 8e8d1ee..0a73999 100644
--- a/systems/zaatar/atuin.nix
+++ b/systems/zaatar/atuin.nix
@@ -1,29 +1,10 @@
-{
-  config,
-  pkgs,
-  ...
-}: let
-  inherit (import ../../lib) tmpfilesConfig;
-in {
-  services.postgresql = {
-    dataDir = "/var/state/postgresql/${config.services.postgresql.package.psqlSchema}";
-    package = pkgs.postgresql_11;
-  };
-
+{pkgs, ...}: {
   services.postgresqlBackup = {
     enable = true;
     databases = ["atuin"];
   };
 
-  systemd.tmpfiles.rules = [
-    (tmpfilesConfig {
-      type = "d";
-      path = "/var/state/postgresql";
-      mode = "0700";
-      user = "postgres";
-      group = "postgres";
-    })
-  ];
+  services.postgresql.package = pkgs.postgresql_14;
 
   services.atuin = {
     host = "0.0.0.0";
diff --git a/systems/zaatar/configuration.nix b/systems/zaatar/configuration.nix
index b833f06..18d34cf 100644
--- a/systems/zaatar/configuration.nix
+++ b/systems/zaatar/configuration.nix
@@ -10,6 +10,7 @@ in {
     ./atuin.nix
     ./backup.nix
     ./gaslight.nix
+    ./kiosk.nix
     ./hardware-configuration.nix
     ./moodle-dl-meinhark.nix
     ./pulseaudio.nix
@@ -89,5 +90,5 @@ in {
     retiolum = retiolumAddresses.zaatar;
   };
 
-  system.stateVersion = "20.09";
+  system.stateVersion = "22.05";
 }
diff --git a/systems/zaatar/spotifyd.nix b/systems/zaatar/spotifyd.nix
index cbd20ac..353ae72 100644
--- a/systems/zaatar/spotifyd.nix
+++ b/systems/zaatar/spotifyd.nix
@@ -1,15 +1,10 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{config, ...}: {
   services.spotifyd = {
     enable = true;
     settings = {
       global = {
-        username_cmd = "cat ${config.age.secrets.spotify-username.path}";
-        password_cmd = "cat ${config.age.secrets.spotify-password.path}";
+        username_cmd = "cat $CREDENTIALS_DIRECTORY/username";
+        password_cmd = "cat $CREDENTIALS_DIRECTORY/password";
         backend = "pulseaudio";
         bitrate = 320;
         device_type = "s_t_b"; # set-top box
@@ -18,6 +13,13 @@
     };
   };
 
+  systemd.services.spotifyd = {
+    serviceConfig.LoadCredential = [
+      "username:${config.age.secrets.spotify-username.path}"
+      "password:${config.age.secrets.spotify-password.path}"
+    ];
+  };
+
   age.secrets = {
     spotify-username.file = ../../secrets/spotify-username.age;
     spotify-password.file = ../../secrets/spotify-password.age;
@@ -28,6 +30,4 @@
     unload-module module-native-protocol-unix
     load-module module-native-protocol-unix auth-anonymous=1
   '';
-
-  systemd.services.spotifyd.serviceConfig.Restart = "always";
 }