diff --git a/hosts/by-name/desko/default.nix b/hosts/by-name/desko/default.nix
index c0dbfff8..b01b4c26 100644
--- a/hosts/by-name/desko/default.nix
+++ b/hosts/by-name/desko/default.nix
@@ -10,7 +10,6 @@
   sane.services.wg-home.ip = config.sane.hosts.by-name."desko".wg-home.ip;
   sane.services.duplicity.enable = true;
   sane.services.nixserve.sopsFile = ../../../secrets/desko.yaml;
-  sane.persist.enable = true;
 
   sane.gui.sway.enable = true;
   sane.programs.iphoneUtils.enableFor.user.colin = true;
diff --git a/hosts/by-name/lappy/default.nix b/hosts/by-name/lappy/default.nix
index 27872f2e..ab65d927 100644
--- a/hosts/by-name/lappy/default.nix
+++ b/hosts/by-name/lappy/default.nix
@@ -10,7 +10,6 @@
 
   # sane.guest.enable = true;
   sane.gui.sway.enable = true;
-  sane.persist.enable = true;
   boot.loader.efi.canTouchEfiVariables = false;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
 
diff --git a/hosts/by-name/moby/default.nix b/hosts/by-name/moby/default.nix
index 3377aa1f..afd45c27 100644
--- a/hosts/by-name/moby/default.nix
+++ b/hosts/by-name/moby/default.nix
@@ -34,7 +34,6 @@
     ".config/pulse"  # persist pulseaudio volume
   ];
 
-  sane.persist.enable = true;
   sane.gui.phosh.enable = true;
   # sane.programs.consoleUtils.enableFor.user.colin = false;
   # sane.programs.guiApps.enableFor.user.colin = false;
diff --git a/hosts/by-name/rescue/default.nix b/hosts/by-name/rescue/default.nix
index ea13d0ae..cc50425e 100644
--- a/hosts/by-name/rescue/default.nix
+++ b/hosts/by-name/rescue/default.nix
@@ -7,6 +7,7 @@
   boot.loader.generic-extlinux-compatible.enable = true;
   boot.loader.efi.canTouchEfiVariables = false;
   sane.image.extraBootFiles = [ pkgs.bootpart-uefi-x86_64 ];
+  sane.persist.enable = false;
   sane.nixcache.enable = false;  # don't want to be calling out to dead machines that we're *trying* to rescue
 
   # docs: https://nixos.org/manual/nixos/stable/options.html#opt-system.stateVersion
diff --git a/hosts/by-name/servo/default.nix b/hosts/by-name/servo/default.nix
index 6364c43e..bfd68da3 100644
--- a/hosts/by-name/servo/default.nix
+++ b/hosts/by-name/servo/default.nix
@@ -16,7 +16,6 @@
   };
 
   sane.roles.build-machine = true;
-  sane.persist.enable = true;
   sane.zsh.showDeadlines = false;  # ~/knowledge doesn't always exist
   sane.services.dyn-dns.enable = true;
   sane.services.wg-home.enable = true;
diff --git a/hosts/common/default.nix b/hosts/common/default.nix
index 299121c7..5b9cd86c 100644
--- a/hosts/common/default.nix
+++ b/hosts/common/default.nix
@@ -20,6 +20,7 @@
 
   sane.nixcache.enable-trusted-keys = true;
   sane.nixcache.enable = lib.mkDefault true;
+  sane.persist.enable = lib.mkDefault true;
   sane.programs.sysadminUtils.enableFor.system = lib.mkDefault true;
   sane.programs.consoleUtils.enableFor.user.colin = lib.mkDefault true;
 
diff --git a/modules/persist/default.nix b/modules/persist/default.nix
index 10a65b28..3ae1b02b 100644
--- a/modules/persist/default.nix
+++ b/modules/persist/default.nix
@@ -124,6 +124,9 @@ let
   #   <option>.private.".cache/vim" = { mode = "0700"; };
   # to place ".cache/vim" into the private store and create with the appropriate mode
   dirsSubModule = types.submodule ({ config, ... }: {
+    # TODO: this should be a plain-old `attrsOf (convertInlineAcl entryInStoreOrShorthand)` with downstream checks,
+    #   rather than being filled in based on *other* settings.
+    #   otherwise, it behaves poorly when `sane.persist.enable = false`
     options = lib.attrsets.unionOfDisjoint
       (mapAttrs (store: store-cfg: mkOption {
         default = [];