diff --git a/TODO.md b/TODO.md
index d459517b..b079fb54 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,6 +1,5 @@
 ## BUGS
 - ringer (i.e. dino incoming call) doesn't prevent moby from sleeping
-- Fractal opens links with non-preferred web browser
 - `nix` operations from lappy hang when `desko` is unreachable
   - could at least direct the cache to `http://desko-hn:5001`
 - waybar isn't visible on moby until after `swaymsg reload`
diff --git a/hosts/modules/gui/sxmo/default.nix b/hosts/modules/gui/sxmo/default.nix
index 1192ffa9..ee17ee23 100644
--- a/hosts/modules/gui/sxmo/default.nix
+++ b/hosts/modules/gui/sxmo/default.nix
@@ -612,11 +612,7 @@ in
         ];
 
         sane.user.services = let
-          sxmoPath = [
-            "/etc/profiles/per-user/colin"  # so as to launch user-enabled applications (like g4music, etc)
-            "/run/wrappers"  # for doas, and anything else suid
-            "/run/current-system/sw"  # for things installed system-wide, especially flock
-          ] ++ [ package ] ++ package.runtimeDeps;
+          sxmoPath = [ package ] ++ package.runtimeDeps;
           sxmoEnvSetup = ''
             # mimic my sxmo_init.sh a bit. refer to the actual sxmo_init.sh above for details.
             # the specific ordering, and the duplicated profile sourcing, matters.
diff --git a/modules/users.nix b/modules/users.nix
index 23a61cd8..10e087aa 100644
--- a/modules/users.nix
+++ b/modules/users.nix
@@ -88,7 +88,7 @@ let
     };
 
     config = lib.mkMerge [
-    # if we're the default user, inherit whatever settings were routed to the default user
+      # if we're the default user, inherit whatever settings were routed to the default user
       (mkIf config.default {
         inherit (sane-user-cfg) fs persist environment;
         services = lib.mapAttrs (_: lib.mkMerge) sane-user-cfg.services;
@@ -110,12 +110,20 @@ let
             lib.concatStringsSep "\n" env;
       }
       {
-        fs = lib.mkMerge (mapAttrsToList (name: value:
+        fs = lib.mkMerge (mapAttrsToList (serviceName: value:
           let
             # see: <repo:nixos/nixpkgs:nixos/lib/utils.nix>
             # see: <repo:nix-community/home-manager:modules/systemd.nix>
-            cleanName = utils.systemdUtils.lib.mkPathSafeName name;
-            generatedUnit = utils.systemdUtils.lib.serviceToUnit name value;
+            cleanName = utils.systemdUtils.lib.mkPathSafeName serviceName;
+            generatedUnit = utils.systemdUtils.lib.serviceToUnit serviceName (value // {
+              environment = (value.environment or {}) // {
+                # replicate the default NixOS user PATH (omitting dirs which don't exist)
+                PATH = lib.removePrefix ":" (
+                  (value.environment.PATH or "")
+                  + ":/run/wrappers/bin:/etc/profiles/per-user/${name}/bin:/run/current-system/sw/bin"
+                );
+              };
+            });
             #^ generatedUnit contains keys:
             # - text
             # - aliases  (IGNORED)
@@ -129,13 +137,13 @@ let
               targetName = "${cleanName}.service";  # systemd derives unit name from symlink target
             };
             serviceEntry = {
-              ".config/systemd/user/${name}.service".symlink = symlinkData;
+              ".config/systemd/user/${serviceName}.service".symlink = symlinkData;
             };
             wants = builtins.map (wantedBy: {
-              ".config/systemd/user/${wantedBy}.wants/${name}.service".symlink = symlinkData;
+              ".config/systemd/user/${wantedBy}.wants/${serviceName}.service".symlink = symlinkData;
             }) generatedUnit.wantedBy;
             requires = builtins.map (requiredBy: {
-              ".config/systemd/user/${requiredBy}.requires/${name}.service".symlink = symlinkData;
+              ".config/systemd/user/${requiredBy}.requires/${serviceName}.service".symlink = symlinkData;
             }) generatedUnit.requiredBy;
           in lib.mkMerge ([ serviceEntry ] ++ wants ++ requires)
         ) config.services);