{
  ...
}:
{
  powerManagement = {
    enable = true;
    cpuFreqGovernor = "powersave";
  };

  # Always-on server: disable all sleep targets.
  systemd.targets = {
    sleep.enable = false;
    suspend.enable = false;
    hibernate.enable = false;
    hybrid-sleep.enable = false;
  };

  boot.kernelParams = [
    # Disable NMI watchdog at boot. Eliminates periodic perf-counter interrupts
    # across all cores (~1 W). Safe: apcupsd provides hardware hang detection
    # via UPS, and softlockup watchdog remains active.
    "nmi_watchdog=0"

    # Route kernel work items to already-busy CPUs rather than waking idle ones.
    # Reduces C-state exit frequency at the cost of slightly higher latency on
    # work items -- irrelevant for a server whose latency-sensitive paths are
    # all in userspace (caddy, jellyfin).
    "workqueue.power_efficient=1"
  ];

  boot.kernel.sysctl = {
    # Belt-and-suspenders: also set via boot param, but sysctl ensures it
    # stays off if anything re-enables it at runtime.
    "kernel.nmi_watchdog" = 0;
  };

  # Server has no audio consumers. Power-gate the HDA codec at module load.
  boot.extraModprobeConfig = ''
    options snd_hda_intel power_save=1 power_save_controller=Y
  '';
}