diff --git a/machines/gw-cnx-1/disko.nix b/machines/gw-cnx-1/disko.nix
index 4efaf32..80e4ed7 100644
--- a/machines/gw-cnx-1/disko.nix
+++ b/machines/gw-cnx-1/disko.nix
@@ -1,44 +1,50 @@
-# Single-disk ZFS layout for the Topton's 256GB mSATA SSD: vfat ESP for boot,
-# the rest a zpool (zstd compression, no atime). Single disk = no redundancy;
-# ZFS buys us compression, snapshots, and checksumming. Requires
-# networking.hostId (set in configuration.nix). The device is a placeholder:
-# boot the installer, read the real id from `ls -l /dev/disk/by-id/`, and fill
-# it in before `clan machines install`. Changing the layout later requires
-# wiping and reinstalling.
+{ ... }:
+let
+  hashDisk = disk: "os-${builtins.substring 0 5 (builtins.hashString "sha256" disk)}";
+  os = "/dev/disk/by-id/ata-TS256GMSA230S_J927900030";
+in
 {
 
-  boot.loader.grub.efiSupport = true;
-  boot.loader.grub.efiInstallAsRemovable = true;
-  boot.loader.grub.enable = true;
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+    };
+    efi = {
+      canTouchEfiVariables = true;
+    };
+  };
+
+  boot.zfs.forceImportRoot = true;
+
   disko.devices = {
     disk = {
-      main = {
-        name = "main-gw-cnx-1";
-        device = "/dev/disk/by-id/CHANGE-ME-msata-ssd";
+      "os-${hashDisk os}" = {
         type = "disk";
+        device = os;
         content = {
           type = "gpt";
           partitions = {
-            "boot" = {
-              size = "1M";
-              type = "EF02"; # for grub MBR
-              priority = 1;
-            };
             ESP = {
+              size = "1G";
               type = "EF00";
-              size = "500M";
               content = {
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
+                mountOptions = [ "nofail" ];
               };
             };
-            zfs = {
+            system = {
               size = "100%";
               content = {
                 type = "zfs";
-                pool = "rpool";
+                pool = "zroot";
+              };
+            };
+            swap = {
+              size = "16G";
+              content = {
+                type = "swap";
               };
             };
           };
@@ -46,29 +52,42 @@
       };
     };
     zpool = {
-      rpool = {
+      zroot = {
         type = "zpool";
-        options.ashift = "12";
         rootFsOptions = {
-          compression = "zstd";
+          mountpoint = "none";
+          compression = "lz4";
           acltype = "posixacl";
           xattr = "sa";
-          atime = "off";
-          mountpoint = "none";
+          "com.sun:auto-snapshot" = "true";
         };
+        options.ashift = "12";
         datasets = {
-          root = {
+          "root" = {
             type = "zfs_fs";
+            options.mountpoint = "none";
+          };
+          "root/nixos" = {
+            type = "zfs_fs";
+            options.mountpoint = "/";
             mountpoint = "/";
           };
-          nix = {
+          "root/home" = {
             type = "zfs_fs";
-            mountpoint = "/nix";
+            options.mountpoint = "/home";
+            mountpoint = "/home";
           };
-          # Service state (Omada, Kea leases, CrowdSec db, journald) — its own
-          # dataset so it can be snapshotted/sent independently of the OS.
-          var = {
+          "root/tmp" = {
             type = "zfs_fs";
+            mountpoint = "/tmp";
+            options = {
+              mountpoint = "/tmp";
+              sync = "disabled";
+            };
+          };
+          "root/var" = {
+            type = "zfs_fs";
+            options.mountpoint = "/var";
             mountpoint = "/var";
           };
         };