diff --git a/modules/base.nix b/modules/base.nix
index 3258c60..278b790 100644
--- a/modules/base.nix
+++ b/modules/base.nix
@@ -2,13 +2,17 @@
 {
   # Firmware.
   #
+  # The list of hardware.enableAllFirmware contains non-redistributable licensed firmware files.
+  # This requires nixpkgs.config.allowUnfree to be true.
+  # An alternative is to use the hardware.enableRedistributableFirmware option.
+  hardware.enableAllFirmware = false;
+  #
   # Enables e.g. Intel microcode updates.
   # Defaults to `config.hardware.enableAllFirmware`.
-  #hardware.enableRedistributableFirmware = true;
-  hardware.enableAllFirmware = true;
+  hardware.enableRedistributableFirmware = true;
 
   # Allow unfree packages.
-  nixpkgs.config.allowUnfree = true;
+  nixpkgs.config.allowUnfree = false;
 
   # Bootloader.
   boot.loader.systemd-boot.enable = true;