diff --git a/home/pkgs/rofi-steam-game-list/default.nix b/home/pkgs/rofi-steam-game-list/default.nix
index d4f1797..2a6303b 100644
--- a/home/pkgs/rofi-steam-game-list/default.nix
+++ b/home/pkgs/rofi-steam-game-list/default.nix
@@ -1,10 +1,23 @@
-{ lib, rustPlatform, nix-gitignore }:
+{ lib
+, substituteAll
+, nix-gitignore 
+, rustPlatform
+, xdg-utils
+, ... }:
+
 rustPlatform.buildRustPackage {
   pname = "rofi-steam-game-list";
   version = "0.1";
 
   src = nix-gitignore.gitignoreSource ["/target" "default.nix"] (lib.cleanSource ./.);
 
+  patches = [
+    (substituteAll {
+      src = ./hardcode_xdg_open.patch;
+      xdg_open = "${xdg-utils}/bin/xdg-open";
+    })
+  ];
+
   cargoLock.lockFile = ./Cargo.lock;
 
   meta = with lib; {
diff --git a/home/pkgs/rofi-steam-game-list/hardcode_xdg_open.patch b/home/pkgs/rofi-steam-game-list/hardcode_xdg_open.patch
new file mode 100644
index 0000000..de8709f
--- /dev/null
+++ b/home/pkgs/rofi-steam-game-list/hardcode_xdg_open.patch
@@ -0,0 +1,13 @@
+diff --git a/src/main.rs b/src/main.rs
+index ba9b0dd..00df815 100644
+--- a/src/main.rs
++++ b/src/main.rs
+@@ -395,7 +395,7 @@ fn main() {
+     );
+     if let Ok(appid) = std::env::var("ROFI_INFO") {
+         let _ = daemon(true, false);
+-        let mut cmd = std::process::Command::new("xdg-open")
++        let mut cmd = std::process::Command::new("@xdg_open@")
+             .arg(&format!("steam://rungameid/{appid}"))
+             .spawn()
+             .unwrap();
diff --git a/system/hosts/nixmsi.nix b/system/hosts/nixmsi.nix
index a77fb65..e4673ed 100644
--- a/system/hosts/nixmsi.nix
+++ b/system/hosts/nixmsi.nix
@@ -108,10 +108,17 @@ in {
     USB_DENYLIST = "0bda:8156";
   };
 
-  # see common/vfio.nix
+  # see modules/vfio.nix
   vfio.enable = true;
   vfio.pciIDs = [ "1002:73df" "1002:ab28" ];
   vfio.libvirtdGroup = [ "user" ];
+  
+  # because libvirtd's nat is broken for some reason...
+  networking.nat = {
+    enable = true;
+    internalInterfaces = [ "virbr0" ];
+    externalInterface = "enp7s0f4u1c2";
+  };
 
   fileSystems = let
     device = cryptroot;
@@ -214,7 +221,6 @@ in {
 
   networking.useDHCP = true;
   # networking.firewall.enable = false;
-  # KDE connect: 1714-1764
   networking.firewall.allowedTCPPorts = [
     27015
     25565
@@ -223,6 +229,7 @@ in {
   # kde connect
   ++ (lib.range 1714 1764);
   networking.firewall.allowedUDPPorts = lib.range 1714 1764;
+
   # networking.hostName = "nixmsi";
   networking.wireless.iwd.enable = true;
   #networking.networkmanager.enable = true;
diff --git a/system/modules/vfio.nix b/system/modules/vfio.nix
index b2533f5..5af250b 100644
--- a/system/modules/vfio.nix
+++ b/system/modules/vfio.nix
@@ -36,6 +36,7 @@ in {
           description = "PCI passthrough IDs";
         };
         lookingGlass = mkOption {
+          default = { };
           type = types.submodule {
             options = {
               enable = mkOption {
@@ -70,12 +71,11 @@ in {
       };
     };
     description = "VFIO settings";
+    default = { };
   };
-  config = lib.mkIf config.vfio.enable
-  (let
-    gpuIDs = lib.concatStringsSep "," cfg.pciIDs;
+  config = let
     enableIvshmem = config.vfio.lookingGlass.enable && (builtins.length config.vfio.lookingGlass.ivshmem) > 0;
-  in {
+  in lib.mkIf config.vfio.enable {
     # add a custom kernel param for early loading vfio drivers
     # because if we change boot.initrd options in a specialization, two initrds will be built
     # and we don't want to build two initrds
@@ -129,10 +129,10 @@ in {
         with config.boot.kernelPackages;
           lib.mkIf enableIvshmem [ kvmfr ];
       extraModprobeConfig = ''
-          options vfio-pci ids=${gpuIDs} disable_idle_d3=1
+          options vfio-pci ids=${builtins.concatStringsSep "," cfg.pciIDs} disable_idle_d3=1
           options kvm ignore_msrs=1
           ${if enableIvshmem then ''
-          options kvmfr static_size_mb=${lib.concatStringsSep "," (map (x: toString x.size) cfg.lookingGlass.ivshmem)}''
+          options kvmfr static_size_mb=${builtins.concatStringsSep "," (map (x: toString x.size) cfg.lookingGlass.ivshmem)}''
           else ""}
         '';
       kernelParams = [
@@ -145,7 +145,7 @@ in {
     };
     services.udev.extraRules = lib.mkIf enableIvshmem
       (builtins.concatStringsSep
-        "\n"
+        ""
         (lib.imap0
           (i: ivshmem: ''
             SUBSYSTEM=="kvmfr", KERNEL=="kvmfr${toString i}", OWNER="${ivshmem.owner}", GROUP="kvm", MODE="0660"
@@ -181,5 +181,5 @@ in {
     };
     virtualisation.spiceUSBRedirection.enable = true;
     users.groups.libvirtd.members = [ "root" ] ++ cfg.libvirtdGroup;
-  });
+  };
 }