diff --git a/docs/nixos_build_spec.md b/docs/nixos_build_spec.md
new file mode 100644
index 0000000..268a76f
--- /dev/null
+++ b/docs/nixos_build_spec.md
@@ -0,0 +1,34 @@
+# NixOS Build Spec (sam-4screen-desktop)
+
+## Disk / Boot (DO NOT BRICK WINDOWS)
+Target disk: /dev/nvme0n1
+
+KEEP (do not format):
+- /dev/nvme0n1p1 (EFI vfat) UUID=94CC-9DA4
+- /dev/nvme0n1p2 (MS reserved)
+- /dev/nvme0n1p3 (Windows NTFS) UUID=8294CD2994CD2111
+- /dev/nvme0n1p4 (Windows recovery NTFS) UUID=6E1AA32B1AA2EEF1
+
+WIPE + install NixOS here:
+- /dev/nvme0n1p5 (currently Ubuntu ext4 /) UUID=4e99904c-ce6f-4c3c-898a-e29cfc373489
+
+Bootloader:
+- systemd-boot, using the existing EFI partition (/dev/nvme0n1p1)
+
+## Networking
+- Use NetworkManager
+- Static IPv4 for wired: enp0s31f6 = 192.168.20.27/24
+- Gateway: 192.168.20.1
+- DNS: 192.168.20.35, 192.168.20.13
+
+## Data drive mount
+- Integral300 ext4 UUID=27febd74-20aa-4a3a-92c1-6fdd1ad7e88e
+- Mountpoint on NixOS: /data (preferred)
+
+## Desktop
+- Primary compositor: Niri
+- Display/login manager: TBD (recommend greetd)
+- GPU: Intel HD 630 + NVIDIA Quadro P620 (confirm which drives monitors)
+
+## Secrets policy
+- No API keys or WiFi PSKs committed to git
diff --git a/logs/06_netplan_config.log b/logs/06_netplan_config.log
index 0dd4632..992887a 100755
--- a/logs/06_netplan_config.log
+++ b/logs/06_netplan_config.log
@@ -17,7 +17,7 @@
 /etc/netplan/90-NM-31ac1c6a-4de8-4a3e-929f-aaec5cd53cf4.yaml:        "Aussie Broadband 8729":
 /etc/netplan/90-NM-31ac1c6a-4de8-4a3e-929f-aaec5cd53cf4.yaml:          auth:
 /etc/netplan/90-NM-31ac1c6a-4de8-4a3e-929f-aaec5cd53cf4.yaml:            key-management: "psk"
-/etc/netplan/90-NM-31ac1c6a-4de8-4a3e-929f-aaec5cd53cf4.yaml:            password: "Ffdfmunfca"
+/etc/netplan/90-NM-31ac1c6a-4de8-4a3e-929f-aaec5cd53cf4.yaml:            password: "<REDACTED>"
 /etc/netplan/90-NM-31ac1c6a-4de8-4a3e-929f-aaec5cd53cf4.yaml:          networkmanager:
 /etc/netplan/90-NM-31ac1c6a-4de8-4a3e-929f-aaec5cd53cf4.yaml:            uuid: "31ac1c6a-4de8-4a3e-929f-aaec5cd53cf4"
 /etc/netplan/90-NM-31ac1c6a-4de8-4a3e-929f-aaec5cd53cf4.yaml:            name: "Aussie Broadband 8729"
@@ -73,7 +73,7 @@
 /etc/netplan/90-NM-ecfc8be2-ba84-46e9-89c6-75bcb35cba55.yaml:        "NetComm Wireless":
 /etc/netplan/90-NM-ecfc8be2-ba84-46e9-89c6-75bcb35cba55.yaml:          auth:
 /etc/netplan/90-NM-ecfc8be2-ba84-46e9-89c6-75bcb35cba55.yaml:            key-management: "psk"
-/etc/netplan/90-NM-ecfc8be2-ba84-46e9-89c6-75bcb35cba55.yaml:            password: "Ffdfmunfca"
+/etc/netplan/90-NM-ecfc8be2-ba84-46e9-89c6-75bcb35cba55.yaml:            password: "<REDACTED>"
 /etc/netplan/90-NM-ecfc8be2-ba84-46e9-89c6-75bcb35cba55.yaml:          networkmanager:
 /etc/netplan/90-NM-ecfc8be2-ba84-46e9-89c6-75bcb35cba55.yaml:            uuid: "ecfc8be2-ba84-46e9-89c6-75bcb35cba55"
 /etc/netplan/90-NM-ecfc8be2-ba84-46e9-89c6-75bcb35cba55.yaml:            name: "NetComm Wireless"
@@ -99,7 +99,7 @@
 /etc/netplan/90-NM-bf81f458-5456-4645-b6c4-0662760765ed.yaml:        "Sams Pixel 8a":
 /etc/netplan/90-NM-bf81f458-5456-4645-b6c4-0662760765ed.yaml:          auth:
 /etc/netplan/90-NM-bf81f458-5456-4645-b6c4-0662760765ed.yaml:            key-management: "psk"
-/etc/netplan/90-NM-bf81f458-5456-4645-b6c4-0662760765ed.yaml:            password: "sjhf3859"
+/etc/netplan/90-NM-bf81f458-5456-4645-b6c4-0662760765ed.yaml:            password: "<REDACTED>"
 /etc/netplan/90-NM-bf81f458-5456-4645-b6c4-0662760765ed.yaml:          networkmanager:
 /etc/netplan/90-NM-bf81f458-5456-4645-b6c4-0662760765ed.yaml:            uuid: "bf81f458-5456-4645-b6c4-0662760765ed"
 /etc/netplan/90-NM-bf81f458-5456-4645-b6c4-0662760765ed.yaml:            name: "Sams Pixel 8a"
diff --git a/plan.md b/plan.md
index 5973f90..818838e 100644
--- a/plan.md
+++ b/plan.md
@@ -37,6 +37,8 @@ setup.md and software_to_add.md are again more files for software consolidation.
 We need development frameworks for python, php, docker-compose, node.
 
 Folder /docs has more directions for the PLAN and software list.
+- docs/nixos_build_spec.md is the source-of-truth for disk/boot/network decisions.
+- docs/software_inventory.md (or equivalent) is the source-of-truth for the final software list.
 
 
 Folder /logs has some scans and hardware profiles which can be used for planning and software. Including looking at the disks. Please ask for more info on the disks if needed.