{
  config,
  lib,
  pkgs,
  ...
}: let
  cfg = config.desktop;
  needsGtkPortal = cfg.xfce.enable || cfg.hyprland.enable;
  usesPortal = cfg.gnome.enable || cfg.xfce.enable || cfg.sway.enable || cfg.hyprland.enable;
in {
  config = lib.mkMerge [
    # GNOME and Sway configure their own portals in NixOS. XFCE needs a
    # portal; Hyprland benefits from GTK as a fallback to its native one.
    (lib.mkIf needsGtkPortal {
      xdg.portal = {
        enable = true;
        extraPortals = [pkgs.xdg-desktop-portal-gtk];
      };
    })

    (lib.mkIf (cfg.sway.enable || needsGtkPortal) {
      xdg.portal.config.common.default = ["gtk"];
    })

    (lib.mkIf (usesPortal && config.services.gnome.gnome-keyring.enable) {
      xdg.portal.config.common."org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
    })

    (lib.mkIf (cfg.sway.enable && config.services.gnome.gnome-keyring.enable) {
      xdg.portal.config.sway."org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
    })

    # A per-desktop config takes precedence over Hyprland's packaged config,
    # so include its native portal whenever adding a Secret preference.
    (lib.mkIf (cfg.hyprland.enable && config.services.gnome.gnome-keyring.enable) {
      xdg.portal.config.hyprland = {
        default = ["hyprland" "gtk"];
        "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
      };
    })
  ];
}