diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index a5e7b575..c9f601dd 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -350,11 +350,6 @@ in
       # creds, widevine .so download. TODO: could easily manage these statically.
       spotify.persist.plaintext = [ ".config/spotify" ];
 
-      steam.persist.plaintext = [
-        ".steam"
-        ".local/share/Steam"
-      ];
-
       tdesktop.persist.private = [ ".local/share/TelegramDesktop" ];
 
       tokodon.persist.private = [ ".cache/KDE/tokodon" ];
diff --git a/hosts/common/programs/default.nix b/hosts/common/programs/default.nix
index cd5d6841..c787216b 100644
--- a/hosts/common/programs/default.nix
+++ b/hosts/common/programs/default.nix
@@ -1,7 +1,6 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
-
   imports = [
     ./aerc.nix
     ./assorted.nix
@@ -18,6 +17,7 @@
     ./offlineimap.nix
     ./ripgrep.nix
     ./splatmoji.nix
+    ./steam.nix
     ./sublime-music.nix
     ./vlc.nix
     ./web-browser.nix
@@ -30,13 +30,5 @@
     # XXX: this might not be necessary. try removing this and cacert.unbundled (servo)?
     environment.etc."ssl/certs".source = "${pkgs.cacert.unbundled}/etc/ssl/certs/*";
 
-    # steam requires system-level config for e.g. firewall or controller support
-    # TODO: split into steam.nix
-    programs.steam = lib.mkIf config.sane.programs.steam.enabled {
-      enable = true;
-      # not sure if needed: stole this whole snippet from the wiki
-      remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
-      dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
-    };
   };
 }
diff --git a/hosts/common/programs/steam.nix b/hosts/common/programs/steam.nix
new file mode 100644
index 00000000..c9190390
--- /dev/null
+++ b/hosts/common/programs/steam.nix
@@ -0,0 +1,16 @@
+{ config, lib, ...}:
+{
+  sane.programs.steam = {
+    persist.plaintext = [
+      ".steam"
+      ".local/share/Steam"
+    ];
+  };
+  # steam requires system-level config for e.g. firewall or controller support
+  programs.steam = lib.mkIf config.sane.programs.steam.enabled {
+    enable = true;
+    # not sure if needed: stole this whole snippet from the wiki
+    remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
+    dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
+  };
+}