diff --git a/roles/desktop/defaults/main.yml b/roles/desktop/defaults/main.yml
index 96f37c8..4af9a6f 100644
--- a/roles/desktop/defaults/main.yml
+++ b/roles/desktop/defaults/main.yml
@@ -148,13 +148,28 @@ desktop_apt_packages_remove_extra: []
 desktop_apt_debs: []
 desktop_apt_debs_extra: []
 
-desktop_dnf_packages:
-  - foot
-  - htop
+desktop_ostree_layered_packages:
+  - akmod-v4l2loopback                  # Used by OBS for proper virtual webcam
+  - cava                                # Sadly does not enable functionality in waybar :<
+  - cryfs                               # Used for vaults
+  - foot                                # Wayblue ships Kitty but I don't like the dev direction
+  - htop                                # For some reason not the default
   - ibm-plex-fonts-all
+  - iotop                               # Requires uncontainerized access to the host
+  - libvirt
   - ncdu
-  - vim
-desktop_dnf_packages_extra: []
+  - NetworkManager-tui
+  - obs-studio                          # Has to be installed native for virtual webcam
+  - restic                              # Also called in via the backup role, but doing this here saves a deployment
+  - vim                                 # It's just way too much hassle that this isn't installed by default
+  - virt-manager                        # VMs, baby
+  - ydotool                             # Must be layered in and configured since it's a hw emulator thing
+  - zerotier-one                        # Ideally layered in since it's a network daemon
+desktop_ostree_layered_packages_extra: []
+desktop_ostree_removed_packages:
+  - firefox
+  - firefox-langpacks
+desktop_ostree_removed_packages_extra: []
 
 desktop_flatpak_remotes:
   - name: flathub
diff --git a/roles/desktop/tasks/packages.yml b/roles/desktop/tasks/packages.yml
index 183d006..5e18419 100644
--- a/roles/desktop/tasks/packages.yml
+++ b/roles/desktop/tasks/packages.yml
@@ -27,8 +27,12 @@
       ansible.builtin.apt: deb="{{ item }}"
       loop: "{{ desktop_apt_debs + desktop_apt_debs_extra }}"
   when: ansible_pkg_mgr == "apt"
-- name: configure packages for ostree
-  community.general.rpm_ostree_pkg: name="{{ desktop_dnf_packages + desktop_dnf_packages_extra }}"
+- name: configure ostree
+  block:
+    - name: configure layered packages for ostree
+      community.general.rpm_ostree_pkg: name="{{ desktop_ostree_layered_packages + desktop_ostree_layered_packages_extra }}"
+    - name: configure removed base packages for ostree
+      community.general.rpm_ostree_pkg: name="{{ desktop_ostree_removed_packages + desktop_ostree_removed_packages_extra }}" state=absent
   when: ansible_os_family == "RedHat" and ansible_pkg_mgr == "atomic_container"
 - name: configure pip3 packages
   ansible.builtin.pip: executable=/usr/bin/pip3 state=latest name="{{ desktop_pip3_packages + desktop_pip3_packages_extra }}"