diff --git a/artiq-fast/default.nix b/artiq-fast/default.nix
index 638baa0..5246f93 100644
--- a/artiq-fast/default.nix
+++ b/artiq-fast/default.nix
@@ -1,4 +1,8 @@
-{ pkgs ? import <nixpkgs> {}}:
+{ pkgs ? import <nixpkgs> {
+  overlays = [ (self: super: {
+    python3 = super.python3.overrideAttrs(oa: { configureFlags = oa.configureFlags ++ ["--enable-optimizations" "--with-lto"]; });
+  }) ];
+}}:
 with pkgs;
 let
   pythonDeps = import ./pkgs/python-deps.nix { inherit (pkgs) stdenv fetchFromGitHub python3Packages; };
diff --git a/nixops/desktop.nix b/nixops/desktop.nix
index 996cfcd..653d8e7 100644
--- a/nixops/desktop.nix
+++ b/nixops/desktop.nix
@@ -29,6 +29,7 @@
     wireshark qrencode yosys symbiyosys yices z3 boolector cvc4 pavucontrol keepassx poppler_utils
     jq ark sublime3 rink qemu_kvm konsole
   ];
+  programs.wireshark.enable = true;
 
   services.openssh.enable = true;
   services.openssh.forwardX11 = true;
@@ -81,7 +82,7 @@
   };
   users.extraUsers.harry = {
     isNormalUser = true;
-    extraGroups = ["plugdev" "dialout"];
+    extraGroups = ["plugdev" "dialout" "wireshark"];
   };
   security.sudo.wheelNeedsPassword = false;
   services.udev.packages = [ pkgs.openocd pkgs.hackrf ];
diff --git a/nixops/rpi.nix b/nixops/rpi.nix
index 6285e7d..878fcf1 100644
--- a/nixops/rpi.nix
+++ b/nixops/rpi.nix
@@ -53,7 +53,7 @@ in
   };
   users.extraUsers.astro = {
     isNormalUser = true;
-    extraGroups = ["plugdev" "dialout" "wireshark"];
+    extraGroups = ["plugdev" "dialout" "wireshark" "wheel"];
     openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGJJTSJdpDh82486uPiMhhyhnci4tScp5uUe7156MBC8 a"];
   };
   users.extraUsers.harry = {
@@ -73,7 +73,7 @@ in
   };
   users.extraUsers.sjm = {
     isNormalUser = true;
-    extraGroups = ["plugdev" "dialout"];
+    extraGroups = ["plugdev" "dialout" "wireshark" "wheel"];
     openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPqBya2nrq39Jl/eguA4LcfvT5ishB1gBE7ofkUbd/+Q sjm@fractalide.com"];
   };