From d5bbc40064429933399317f7c3ed0393b0324a2b Mon Sep 17 00:00:00 2001
From: mahmoud <moud.elsh@gmail.com>
Date: Fri, 26 Dec 2025 17:14:12 -0800
Subject: [PATCH 1/2] keyd: 2.5.0 -> 2.6.0

---
 pkgs/by-name/ke/keyd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ke/keyd/package.nix b/pkgs/by-name/ke/keyd/package.nix
index 7d0709d39674..866c89a8fbfb 100644
--- a/pkgs/by-name/ke/keyd/package.nix
+++ b/pkgs/by-name/ke/keyd/package.nix
@@ -9,13 +9,13 @@
 }:
 
 let
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "rvaiya";
     repo = "keyd";
     rev = "v" + version;
-    hash = "sha256-pylfQjTnXiSzKPRJh9Jli1hhin/MIGIkZxLKxqlReVo=";
+    hash = "sha256-l7yjGpicX1ly4UwF7gcOTaaHPRnxVUMwZkH70NDLL5M=";
   };
 
   pypkgs = python3.pkgs;

From 38f9a3f211a86b4b6325839eb2ae38472bbcadb8 Mon Sep 17 00:00:00 2001
From: mahmoud <moud.elsh@gmail.com>
Date: Fri, 26 Dec 2025 18:21:34 -0800
Subject: [PATCH 2/2] nixos/keyd: Allow mlockall and sched_setscheduler

---
 nixos/modules/services/hardware/keyd.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/hardware/keyd.nix b/nixos/modules/services/hardware/keyd.nix
index 795a640b791e..b80395460c8d 100644
--- a/nixos/modules/services/hardware/keyd.nix
+++ b/nixos/modules/services/hardware/keyd.nix
@@ -152,7 +152,10 @@ in
         RuntimeDirectory = "keyd";
 
         # Hardening
-        CapabilityBoundingSet = [ "CAP_SYS_NICE" ];
+        CapabilityBoundingSet = [
+          "CAP_SYS_NICE"
+          "CAP_IPC_LOCK"
+        ];
         DeviceAllow = [
           "char-input rw"
           "/dev/uinput rw"
@@ -170,7 +173,6 @@ in
         ProtectKernelTunables = true;
         ProtectControlGroups = true;
         MemoryDenyWriteExecute = true;
-        RestrictRealtime = true;
         LockPersonality = true;
         ProtectProc = "invisible";
         SystemCallFilter = [