diff --git a/modules/security/pam.nix b/modules/security/pam.nix
index 9be1bad0668d..977ff0ae5494 100644
--- a/modules/security/pam.nix
+++ b/modules/security/pam.nix
@@ -26,11 +26,9 @@ let
     , # If set, root doesn't need to authenticate (e.g. for the "chsh"
       # service).
       rootOK ? false
-    , # If set, this is a local login (e.g. virtual console or X), so
-      # the user gets ownership of audio devices etc.
-      localLogin ? false
-    , # Temporary hack to get SLiM to work with ConsoleKit.
-      ckHack ? false
+    , # If set, use ConsoleKit's PAM connector module to claim
+      # ownership of audio devices etc.
+      ownDevices ? false
     , # Whether to forward XAuth keys between users.  Mostly useful
       # for "su".
       forwardXAuth ? false
@@ -65,9 +63,7 @@ let
           ${optionalString config.users.ldap.enable
               "session optional ${pam_ldap}/lib/security/pam_ldap.so"}
           session required ${pam_unix2}/lib/security/pam_unix2.so
-          ${optionalString ckHack
-              "session required pam_env.so debug conffile=${envFile} readenv=0"}
-          ${optionalString localLogin
+          ${optionalString ownDevices
               "session optional ${pkgs.console_kit}/lib/security/pam_ck_connector.so"}
           ${optionalString forwardXAuth
               "session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99"}
@@ -75,14 +71,6 @@ let
       target = "pam.d/${name}";
     };
 
-  # This is needed to get an active session in ConsoleKit.  Apparently
-  # a better way is to run ck-launch-session from the session starter
-  # (or let xdm/kdm do it).
-  envFile = pkgs.writeText "pam_env.conf"
-    ''
-      CKCON_X11_DISPLAY_DEVICE DEFAULT="/dev/tty7"
-    '';
-
 in
 
 {
@@ -104,13 +92,13 @@ in
           the name of the service.  The attribute
           <varname>rootOK</varname> specifies whether the root user is
           allowed to use this service without authentication.  The
-          attribute <varname>localLogin</varname> specifies whether
-          this is a local login service (e.g. <command>xdm</command>),
-          which implies that the user gets ownership of devices such
-          as audio and CD-ROM drives.  The
-          attribute <varname>forwardXAuth</varname> specifies whether
-          X authentication keys should be passed from the calling user
-          to the target user (e.g. for <command>su</command>).
+          attribute <varname>ownDevices</varname> specifies whether
+          ConsoleKit's PAM connector module should be used to give the
+          user ownership of devices such as audio and CD-ROM drives.
+          The attribute <varname>forwardXAuth</varname> specifies
+          whether X authentication keys should be passed from the
+          calling user to the target user (e.g. for
+          <command>su</command>).
         '';
     };
 
@@ -151,7 +139,7 @@ in
         { name = "useradd"; rootOK = true; }
         # Used by groupadd etc.
         { name = "shadow"; rootOK = true; }
-        { name = "login"; localLogin = true; }
+        { name = "login"; ownDevices = true; }
       ];
 
   };
diff --git a/modules/services/x11/display-managers/default.nix b/modules/services/x11/display-managers/default.nix
index 0343c6ae766d..1649f2922c03 100644
--- a/modules/services/x11/display-managers/default.nix
+++ b/modules/services/x11/display-managers/default.nix
@@ -43,6 +43,12 @@ let
         fi
       ''}
 
+      # Start a ConsoleKit session so that we get ownership of various
+      # devices.
+      if test -z "$XDG_SESSION_COOKIE"; then
+          exec ${pkgs.console_kit}/bin/ck-launch-session "$0" "$sessionType"
+      fi
+
       # Load X defaults.
       if test -e ~/.Xdefaults; then
           ${xorg.xrdb}/bin/xrdb -merge ~/.Xdefaults
diff --git a/modules/services/x11/display-managers/kdm.nix b/modules/services/x11/display-managers/kdm.nix
index c58b48679674..8f7a5b5b3fe2 100644
--- a/modules/services/x11/display-managers/kdm.nix
+++ b/modules/services/x11/display-managers/kdm.nix
@@ -80,7 +80,7 @@ in
         logsXsession = true;
       };
 
-    security.pam.services = [ { name = "kde"; localLogin = true; ckHack = true; } ];
+    security.pam.services = [ { name = "kde"; } ];
       
   };
   
diff --git a/modules/services/x11/display-managers/slim.nix b/modules/services/x11/display-managers/slim.nix
index f8985f36b525..2f1e8c8e21a7 100644
--- a/modules/services/x11/display-managers/slim.nix
+++ b/modules/services/x11/display-managers/slim.nix
@@ -104,7 +104,7 @@ in
         execCmd = "${pkgs.slim}/bin/slim";
       };
 
-    security.pam.services = [ { name = "slim"; localLogin = true; ckHack = true; } ];
+    security.pam.services = [ { name = "slim"; } ];
 
   };