diff --git a/hosts/home.nix b/hosts/home.nix
index cb959bfe..899c8d81 100644
--- a/hosts/home.nix
+++ b/hosts/home.nix
@@ -26,11 +26,6 @@ with lib;
     longitude = 12.5;
   } else {});
 
-
-  # Refuse ICMP echo requests on my desktop/laptop; nobody has any business
-  # pinging them, unlike my servers.
-  boot.kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = 1;
-
   # So thw bitwarden CLI knows where to find my server.
   modules.shell.bitwarden.config.server = "p.v0.io";
 
diff --git a/hosts/kuro/hardware-configuration.nix b/hosts/kuro/hardware-configuration.nix
index dff7579d..2a410e8a 100644
--- a/hosts/kuro/hardware-configuration.nix
+++ b/hosts/kuro/hardware-configuration.nix
@@ -14,6 +14,10 @@
       #      mission critical or server/headless builds exposed to the world.
       "mitigations=off"
     ];
+
+    # Refuse ICMP echo requests on my desktop/laptop; nobody has any business
+    # pinging them, unlike my servers.
+    kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = 1;
   };
 
   # Modules
diff --git a/hosts/shiro/hardware-configuration.nix b/hosts/shiro/hardware-configuration.nix
index 39291cad..8d694bcc 100644
--- a/hosts/shiro/hardware-configuration.nix
+++ b/hosts/shiro/hardware-configuration.nix
@@ -17,6 +17,10 @@
       #      mission critical or server/headless builds exposed to the world.
       "mitigations=off"
     ];
+
+    # Refuse ICMP echo requests on my desktop/laptop; nobody has any business
+    # pinging them, unlike my servers.
+    kernel.sysctl."net.ipv4.icmp_echo_ignore_broadcasts" = 1;
   };
 
   # Modules