diff --git a/home/modules/desktop/security/polkit.nix b/home/modules/desktop/security/polkit.nix
index b6235cf..9434f7d 100644
--- a/home/modules/desktop/security/polkit.nix
+++ b/home/modules/desktop/security/polkit.nix
@@ -1,21 +1,14 @@
 { lib, config, pkgs, ... }:
 
 let
-  inherit (lib) mkIf types mkOption; 
-  inherit (builtins) elem;
-  cfg = config.ooknet.desktop.security.polkit;
+  inherit (lib) mkIf; 
+  polkit = config.ooknet.security.polkit;
 in
 
 {
-  options.ooknet.desktop.security.polkit = mkOption {
-    type = types.enum ["gnome" "pantheon"]; # TODO: add kde agent
-    default = "";
-    description = "Type of polkit agent module to use";
-  };
-
   config = {
     systemd.user.services = {
-      polkit-pantheon-authentication-agent-1 = mkIf (elem cfg ["pantheon"]) {
+      polkit-pantheon-authentication-agent-1 = mkIf (polkit == "pantheon") {
         Unit.Description = "polkit-pantheon-authentication-agent-1";
 
         Install = {
@@ -33,7 +26,7 @@ in
         };
       };
 
-      polkit-gnome-authentication-agent-1 = mkIf (elem cfg ["gnome"]) {
+      polkit-gnome-authentication-agent-1 = mkIf (polkit == "gnome") {
         Unit.Description = "polkit-pantheon-authentication-agent-1";
         Install = {
           WantedBy = [ "graphical-session.target" ];
diff --git a/home/modules/options/desktop/security.nix b/home/modules/options/desktop/security.nix
new file mode 100644
index 0000000..902d593
--- /dev/null
+++ b/home/modules/options/desktop/security.nix
@@ -0,0 +1,14 @@
+{ lib, ... }:
+
+let
+  inherit (lib) mkOption types;
+  inherit (types) nullOr enum;
+in
+
+{
+  options.ooknet.security.polkit = mkOption {
+    type = nullOr (enum ["gnome" "pantheon"]); # TODO: add kde agent
+    default = "gnome";
+    description = "Type of polkit agent module to use";
+  };
+}