diff --git a/.config/guix/manifests/desktop.scm b/.config/guix/manifests/desktop.scm
index c4bc655..29606d7 100644
--- a/.config/guix/manifests/desktop.scm
+++ b/.config/guix/manifests/desktop.scm
@@ -1,5 +1,6 @@
 (specifications->manifest
  '(
+   "polkit-gnome"
    "fontconfig"
    "qbittorrent"
    "gnome-font-viewer"
diff --git a/.config/shepherd/init.scm b/.config/shepherd/init.scm
index c51e92f..7a4f8aa 100644
--- a/.config/shepherd/init.scm
+++ b/.config/shepherd/init.scm
@@ -63,6 +63,20 @@
     #:one-shot? #t
     #:start (make-system-constructor "ln -sf {app/com.discordapp.Discord,$XDG_RUNTIME_DIR}/discord-ipc-0")))
 
+(define polkit-gnome
+  (make <service>
+    #:provides '(polkit-gnome)
+    #:respawn? #t
+    #:start (make-forkexec-constructor '("/home/pavel/.guix-extra-profiles/desktop/desktop/libexec/polkit-gnome-authentication-agent-1"))
+    #:stop (make-kill-destructor)))
+
+(define vpn
+  (make <service>
+    #:provides '(vpn)
+    #:respawn? #t
+    #:start (make-forkexec-constructor '("/home/pavel/bin/scripts/vpn-start"))
+    #:stop (make-kill-destructor)))
+
 (register-services
  mpd
  mpd-watcher
@@ -72,8 +86,10 @@
  aw-watcher-window
  pulseeffects
  xsettingsd
- discord-rich-presence)
+ discord-rich-presence
+ polkit-gnome
+ vpn)
 
 (action 'shepherd 'daemonize)
 
-(for-each start '(mpd mpd-watcher mcron aw-server aw-watcher-afk aw-watcher-window pulseeffects xsettingsd discord-rich-presence))
+(for-each start '(mpd mpd-watcher mcron aw-server aw-watcher-afk aw-watcher-window pulseeffects xsettingsd discord-rich-presence polkit-gnome))
diff --git a/Desktop.org b/Desktop.org
index da816b4..80ce923 100644
--- a/Desktop.org
+++ b/Desktop.org
@@ -2325,6 +2325,28 @@ References:
     #:one-shot? #t
     #:start (make-system-constructor "ln -sf {app/com.discordapp.Discord,$XDG_RUNTIME_DIR}/discord-ipc-0")))
 #+end_src
+** Polkit Authentication agent
+Launch an authentication agent. Necessary for stuff like =pkexec=. I suspect I'm not doing that the intended way, but it seems to work.
+
+#+begin_src scheme
+(define polkit-gnome
+  (make <service>
+    #:provides '(polkit-gnome)
+    #:respawn? #t
+    #:start (make-forkexec-constructor '("/home/pavel/.guix-extra-profiles/desktop/desktop/libexec/polkit-gnome-authentication-agent-1"))
+    #:stop (make-kill-destructor)))
+#+end_src
+** VPN
+Run my [[file:Guix.org::*VPN][OpenVPN setup]]. Not lauching this automatially, as it requires an active connection.
+
+#+begin_src scheme
+(define vpn
+  (make <service>
+    #:provides '(vpn)
+    #:respawn? #t
+    #:start (make-forkexec-constructor '("/home/pavel/bin/scripts/vpn-start"))
+    #:stop (make-kill-destructor)))
+#+end_src
 ** Shepherd config
 Register services
 #+begin_src scheme
@@ -2337,7 +2359,9 @@ Register services
  aw-watcher-window
  pulseeffects
  xsettingsd
- discord-rich-presence)
+ discord-rich-presence
+ polkit-gnome
+ vpn)
 #+end_src
 
 Daemonize shepherd
@@ -2347,7 +2371,7 @@ Daemonize shepherd
 
 Run services
 #+begin_src scheme
-(for-each start '(mpd mpd-watcher mcron aw-server aw-watcher-afk aw-watcher-window pulseeffects xsettingsd discord-rich-presence))
+(for-each start '(mpd mpd-watcher mcron aw-server aw-watcher-afk aw-watcher-window pulseeffects xsettingsd discord-rich-presence polkit-gnome))
 #+end_src
 ** Sync
 | Guix dependency |
@@ -2374,6 +2398,7 @@ Other desktop programs I use are listed below.
 | gnome-font-viewer      | view fonts                                |
 | qbittorrent            | torrent client                            |
 | fontconfig             |                                           |
+| polkit-gnome           | Polkit authentication agent               |
 
 #+NAME: packages
 #+begin_src emacs-lisp :tangle no
diff --git a/Guix.org b/Guix.org
index 174d169..a40396e 100644
--- a/Guix.org
+++ b/Guix.org
@@ -567,18 +567,21 @@ I'm currently using CyberGhost VPN. =~/.vpn= folder stores its OpenVPN config (=
 As of now, CyberGhost doesn't provide ipv6, so we have to disable it.
 
 #+begin_src bash :tangle ~/bin/scripts/vpn-start
+export DISPLAY=:0
 CONN=$(nmcli -f NAME con show --active | grep -Ev "(.*docker.*|NAME|br-.*|veth.*|tun.*)" | sed 's/ *$//g')
 
 if [ -z "$CONN" ]; then
     echo "No connection!"
+    notify-send "VPN" "No connection for VPN to run"
     exit
 fi
 
 echo "Connection: $CONN"
+notify-send "VPN" "Initializing for connection: $CONN"
 
-sudo nmcli con modify "$CONN" ipv6.method ignore
+pkexec nmcli con modify "$CONN" ipv6.method ignore
 nmcli connection up "$CONN"
-sudo openvpn --config ~/.vpn/openvpn.ovpn
+pkexec openvpn --config ~/.vpn/openvpn.ovpn
 #+end_src
 
 *** vpn-stop
@@ -588,7 +591,7 @@ Also a script to reverse the changes.
 CONN=$(nmcli -f NAME con show --active | grep -Ev "(.*docker.*|NAME|br-.*|veth.*|tun.*)" | sed 's/ *$//g')
 echo "Connection: $CONN"
 
-sudo nmcli con modify "$CONN" ipv6.method auto
+pkexec nmcli con modify "$CONN" ipv6.method auto
 nmcli connection up "$CONN"
 #+end_src
 ** flatpak
diff --git a/bin/scripts/screen-layout b/bin/scripts/screen-layout
index 1d170ab..c5ec35b 100755
--- a/bin/scripts/screen-layout
+++ b/bin/scripts/screen-layout
@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
-# [[file:../../Desktop.org::*Screen settings][Screen settings:1]]
+# [[file:../../Desktop.org::*Device-specific settings][Device-specific settings:1]]
 hostname=$(hostname)
 if [ "$hostname" = "indigo" ]; then
     xrandr --output DisplayPort-0 --off --output HDMI-A-0 --mode 1920x1080 --pos 0x0 --rotate normal --output DVI-D-0 --mode 1366x768 --pos 1920x312 --rotate normal
 elif [ "$hostname" = "eminence" ]; then
     xgamma -gamma 1.25
 fi
-# Screen settings:1 ends here
+# Device-specific settings:1 ends here
diff --git a/bin/scripts/vpn-start b/bin/scripts/vpn-start
index 137d2fc..cffadd9 100755
--- a/bin/scripts/vpn-start
+++ b/bin/scripts/vpn-start
@@ -1,15 +1,18 @@
 #!/usr/bin/env bash
 # [[file:../../Guix.org::*vpn-start][vpn-start:1]]
+export DISPLAY=:0
 CONN=$(nmcli -f NAME con show --active | grep -Ev "(.*docker.*|NAME|br-.*|veth.*|tun.*)" | sed 's/ *$//g')
 
 if [ -z "$CONN" ]; then
     echo "No connection!"
+    notify-send "VPN" "No connection for VPN to run"
     exit
 fi
 
 echo "Connection: $CONN"
+notify-send "VPN" "Initializing for connection: $CONN"
 
-sudo nmcli con modify "$CONN" ipv6.method ignore
+pkexec nmcli con modify "$CONN" ipv6.method ignore
 nmcli connection up "$CONN"
-sudo openvpn --config ~/.vpn/openvpn.ovpn
+pkexec openvpn --config ~/.vpn/openvpn.ovpn
 # vpn-start:1 ends here
diff --git a/bin/scripts/vpn-stop b/bin/scripts/vpn-stop
index 5fa2856..f95f619 100755
--- a/bin/scripts/vpn-stop
+++ b/bin/scripts/vpn-stop
@@ -3,6 +3,6 @@
 CONN=$(nmcli -f NAME con show --active | grep -Ev "(.*docker.*|NAME|br-.*|veth.*|tun.*)" | sed 's/ *$//g')
 echo "Connection: $CONN"
 
-nmcli con modify "$CONN" ipv6.method auto
+pkexec nmcli con modify "$CONN" ipv6.method auto
 nmcli connection up "$CONN"
 # vpn-stop:1 ends here