diff --git a/flake.lock b/flake.lock
index 0126bb7..8b3e6e9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -981,11 +981,11 @@
         "pre-commit-hooks": "pre-commit-hooks_3"
       },
       "locked": {
-        "lastModified": 1704938286,
-        "narHash": "sha256-/uv+N2v5ixqYz7SG8R5GWOTdrNKboHEp85BR5Jdz6qE=",
+        "lastModified": 1704999567,
+        "narHash": "sha256-Whj1PFPomS/f97OD30CRrETTH/dmnUJdjEevDLJG4MM=",
         "owner": "oddlama",
         "repo": "nixos-extra-modules",
-        "rev": "c55f465ba1f369852ab4122a9fa42c85b4a571de",
+        "rev": "4744a2844cd74ca9b122fbaaae5ae97159c0d30e",
         "type": "github"
       },
       "original": {
diff --git a/hosts/sire/guests/paperless.nix b/hosts/sire/guests/paperless.nix
index 7555485..793b9f1 100644
--- a/hosts/sire/guests/paperless.nix
+++ b/hosts/sire/guests/paperless.nix
@@ -59,7 +59,7 @@ in {
     enable = true;
     address = "0.0.0.0";
     passwordFile = config.age.secrets.paperless-admin-password.path;
-    extraConfig = {
+    settings = {
       PAPERLESS_URL = "https://${paperlessDomain}";
       PAPERLESS_CONSUMER_ENABLE_BARCODES = true;
       PAPERLESS_CONSUMER_ENABLE_ASN_BARCODE = true;
diff --git a/hosts/ward/guests/forgejo.nix b/hosts/ward/guests/forgejo.nix
index 35f6f92..73dbf37 100644
--- a/hosts/ward/guests/forgejo.nix
+++ b/hosts/ward/guests/forgejo.nix
@@ -82,7 +82,7 @@ in {
     settings = {
       actions = {
         ENABLED = true;
-        DEFAULT_ACTIONS_URL = "https://gitea.com";
+        DEFAULT_ACTIONS_URL = "github";
       };
       database = {
         SQLITE_JOURNAL_MODE = "WAL";
@@ -111,7 +111,7 @@ in {
       };
       # packages.ENABLED = true;
       repository = {
-        DEFAULT_PRIVATE = false;
+        DEFAULT_PRIVATE = "private";
         ENABLE_PUSH_CREATE_USER = true;
         ENABLE_PUSH_CREATE_ORG = true;
       };
diff --git a/hosts/ward/kea.nix b/hosts/ward/kea.nix
index 22a0eca..80bc3d9 100644
--- a/hosts/ward/kea.nix
+++ b/hosts/ward/kea.nix
@@ -18,9 +18,8 @@ in {
         persist = true;
         type = "memfile";
       };
-      valid-lifetime = 4000;
-      renew-timer = 1000;
-      rebind-timer = 2000;
+      valid-lifetime = 86400;
+      renew-timer = 3600;
       interfaces-config = {
         # XXX: BUG: why does this bind other macvtaps?
         interfaces = ["lan-self"];