diff --git a/README.en.md b/README.en.md
index a21519a..fea1853 100644
--- a/README.en.md
+++ b/README.en.md
@@ -20,7 +20,7 @@ One-Click system reinstallation script for VPS [中文](README.md)
 - Supports BIOS and EFI boot, and ARM Server
 - No homemades image included, all resources are obtained in real-time from mirror sites
 
-If this helped you, you can buy me a milk tea.
+Buy me a milk tea:
 [![Donate](https://img.shields.io/badge/Donate-30363D?style=for-the-badge&logo=GitHub-Sponsors&logoColor=#EA4AAA)](https://github.com/sponsors/bin456789)
 
 [![Sponsors](https://raw.githubusercontent.com/bin456789/sponsors/refs/heads/master/sponsors.svg)](https://github.com/sponsors/bin456789)
@@ -147,12 +147,13 @@ certutil -urlcache -f -split https://cnb.cool/bin456789/reinstall/-/git/raw/main
 >
 > If the script was run by mistake, you can run `bash reinstall.sh reset` before rebooting to cancel the reinstallation operation.
 
-- Username `root`. The script prompts for a password. If left blank, a random one is generated.
-- When installing the latest version, the version number does not need to be specified.
+- The script prompts for a username and password. If left blank, will use `root` and random password.
+- If no version specified, will install the latest version.
 - Maximizes disk space utilization: no boot or swap partitions.
-- Automatically selects different optimized kernels based on machine type, such as `Cloud` or `HWE` kernels.
+- Automatically install optimized kernel based on machine type and vendor.
 - When installing Red Hat, you must provide the `qcow2` image link obtained from <https://access.redhat.com/downloads/content/rhel>. You can also install `qcow2` of other RHEL-based OS, such as `Alibaba Cloud Linux` and `TencentOS Server`.
 - After reinstallation, if you need to change the SSH port or switch to key-based login, make sure to also modify the files inside `/etc/ssh/sshd_config.d/`.
+- To ensure a faster reinstall, the new system will not be updated during the process. Please update the system manually after reinstallation.
 
 ```bash
 bash reinstall.sh anolis      7|8|23
@@ -178,9 +179,10 @@ bash reinstall.sh anolis      7|8|23
 
 #### Optional Parameters
 
+- `--username USERNAME` Set the username
 - `--password PASSWORD` Set the password
 - `--ssh-key KEY` Set up SSH login public key, [formatted as follows](#--ssh-key). When using public key, password is empty.
-- `--ssh-port PORT` Change the SSH port (for log observation during installation and for the new system)
+- `--ssh-port PORT` Change the SSH port
 - `--web-port PORT` Change the Web port (for log observation during installation only)
 - `--frpc-config PATH` Add frpc for intranet tunneling. Parameter can be local filepath or HTTP URL of the configuration file.
 - `--hold 1` Reboot only into install environment, without running installer, only for SSH connect to test network connection.
@@ -237,6 +239,7 @@ bash reinstall.sh ubuntu --installer
 - Supports `raw` and fixed-size `vhd` image formats. Either uncompressed or compressed as `.gz`, `.xz`, `.zst`, `.tar`, `.tar.gz`, `.tar.xz`, `.tar.zst`.
 - When deploy a Windows image, the system disk will be automatically expanded, and machines with a static IP will have their IP configured, and may take a few minutes after the first boot for the configuration to take effect.
 - When deploy a Linux image, will **NOT** modify any contents of the image.
+- The script prompts for a username and password for SSH to view logs during the installation. If left blank, will use `root` and random password.
 
 ```bash
 bash reinstall.sh dd --img "https://example.com/xxx.xz"
@@ -244,10 +247,13 @@ bash reinstall.sh dd --img "https://example.com/xxx.xz"
 
 #### Optional Parameters
 
-- `--allow-ping` Configure Windows Firewall to Allow Ping Responses (DD Windows only)
-- `--rdp-port PORT` Change RDP port (DD Windows only)
+- `--username USERNAME` Set username (for log observation during installation)
+- `--password PASSWORD` Set Password (for log observation during installation)
+- `--ssh-key KEY` Set up SSH login public key (for log observation during installation), [formatted as follows](#--ssh-key). When using public key, password is empty.
 - `--ssh-port PORT` Change SSH port (for log observation during installation)
+- `--rdp-port PORT` Change RDP port (DD Windows only)
 - `--web-port PORT` Change Web port (for log observation during installation)
+- `--allow-ping` Configure Windows Firewall to Allow Ping Responses (DD Windows only)
 - `--frpc-config PATH` Add frpc for intranet tunneling (DD Windows only). Parameter can be local filepath or HTTP URL of the configuration file.
 - `--cloud-data PATH_OR_URL` Inject cloud-init NoCloud configuration into the DD'd Linux image (DD Linux only)
 - `--hold 1` Reboot only into install environment, without running installer, only for SSH connect to test network connection.
@@ -257,7 +263,7 @@ bash reinstall.sh dd --img "https://example.com/xxx.xz"
 >
 > `--cloud-data` accepts a local directory path or an HTTP base URL. The directory must contain a `user-data` file; `meta-data` and `network-config` are optional:
 >
-> ```
+> ```bash
 > seed/
 > ├── user-data      # required
 > ├── meta-data      # optional
@@ -282,7 +288,7 @@ bash reinstall.sh dd --img "https://example.com/xxx.xz"
 ### Feature 3: Reboot to <img width="16" height="16" src="https://www.alpinelinux.org/alpine-logo.ico" /> Alpine Live OS
 
 - You can use SSH to backup/restore disk, manually perform DD operations, partition modifications, manual Alpine installation, and other operations.
-- Username `root`. The script prompts for a password. If left blank, a random one is generated.
+- The script prompts for a username and password. If left blank, will use `root` and random password.
 
 > [!TIP]
 >
@@ -296,9 +302,10 @@ bash reinstall.sh alpine --hold 1
 
 #### Optional Parameters
 
+- `--username USERNAME` Set username
 - `--password PASSWORD` Set password
-- `--ssh-port PORT` Change SSH port
 - `--ssh-key KEY` Set up SSH login public key, [formatted as follows](#--ssh-key). When using public key, password is empty.
+- `--ssh-port PORT` Change SSH port
 - `--frpc-config PATH` Add frpc for intranet tunneling. Parameter can be local filepath or HTTP URL of the configuration file.
 
 ### Feature 4: Reboot to <img width="16" height="16" src="https://netboot.xyz/img/favicon.ico" /> netboot.xyz
@@ -327,8 +334,8 @@ bash reinstall.sh netboot.xyz
 >
 > If the script was run by mistake, you can run `bash reinstall.sh reset` before rebooting to cancel the reinstallation operation.
 
-- The script prompts for a username. If left blank, will use `administrator`.
-- The script prompts for a password. If left blank, will use a random one.
+- The script prompts for a username and password. If left blank, will use `administrator` and random password.
+- In a few languages, the system administrator account is not `administrator`. [Details](https://learn.microsoft.com/archive/technet-wiki/13813.localized-names-for-administrator-account-in-windows#list-of-languages-that-localize-the-administrator-account-name)
 - If remote login fails, try adding `.\` before the username, for example, `.\administrator`.
 - The machine with a static IP will automatically configure the IP. It may take a few minutes to take effect on the first boot.
 - Supports ISO images in any language.
@@ -447,12 +454,12 @@ bash reinstall.sh windows \
 
 #### Optional Parameters
 
-- `--username USERNAME` Set Username (for Windows only)
+- `--username USERNAME` Set Username
 - `--password PASSWORD` Set Password
-- `--allow-ping` Configure Windows Firewall to Allow Ping Responses
 - `--rdp-port PORT` Change RDP port
 - `--ssh-port PORT` Change SSH port (for log observation during installation only)
 - `--web-port PORT` Change Web port (for log observation during installation only)
+- `--allow-ping` Configure Windows Firewall to Allow Ping Responses
 - `--add-driver INF_OR_DIR` Add additional driver, specifying .inf path, or the folder contains .inf file.
   - The driver must be downloaded to current system first.
   - This parameter can be set multiple times to add different driver.
@@ -467,7 +474,7 @@ bash reinstall.sh windows \
 - AWS ([ENA Network Adapter][aws-ena], [NVME Storage Controller][aws-nvme])
 - GCP ([gVNIC Network Adapter][gcp-gvnic], [GGA Display Adapter][gcp-gga])
 - Azure ([MANA Network Adapter][azure-mana])
-- Intel (VMD Storage Controller: [11th Gen Core][intel-vmd-gen11], [12th-15th Gen Core][intel-vmd-gen12-to-gen15], Network Adapter: [7][intel-nic-7], [8.x][intel-nic-8.1], [10][intel-nic-10], [11][intel-nic-11], [2008 R2][intel-nic-7], [2012][intel-nic-2012], [2012 R2][intel-nic-2012-r2], [2016][intel-nic-2016], [2019][intel-nic-2019], [2022][intel-nic-2022], [2025][intel-nic-2025])
+- Intel (VMD Storage Controller: [11th Gen Core][intel-vmd-gen11], [12th-15th Gen Core][intel-vmd-gen12-to-gen15], [Core Ultra 3][intel-vmd-ultra3], Network Adapter: [7][intel-nic-7], [8.x][intel-nic-8.1], [10][intel-nic-10], [11][intel-nic-11], [2008 R2][intel-nic-7], [2012][intel-nic-2012], [2012 R2][intel-nic-2012-r2], [2016][intel-nic-2016], [2019][intel-nic-2019], [2022][intel-nic-2022], [2025][intel-nic-2025])
 
 [virtio-virtio]: https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/
 [virtio-aliyun]: https://www.alibabacloud.com/help/ecs/user-guide/install-the-virtio-driver-1
@@ -483,6 +490,7 @@ bash reinstall.sh windows \
 [azure-mana]: https://learn.microsoft.com/azure/virtual-network/accelerated-networking-mana-windows
 [intel-vmd-gen11]: https://www.intel.com/content/www/us/en/download/849933/intel-rapid-storage-technology-driver-installation-software-with-intel-optane-memory-12th-to-13th-gen-platforms.html
 [intel-vmd-gen12-to-gen15]: https://www.intel.com/content/www/us/en/download/849936/intel-rapid-storage-technology-driver-installation-software-with-intel-optane-memory-12th-to-15th-gen-platforms.html
+[intel-vmd-ultra3]: https://www.intel.com/content/www/us/en/download/920456/intel-rapid-storage-technology-driver-installation-software-for-intel-core-ultra-series-3-platforms.html
 [intel-nic-7]: https://www.intel.com/content/www/us/en/download/15590/intel-network-adapter-driver-for-windows-7-final-release.html
 [intel-nic-8.1]: https://www.intel.com/content/www/us/en/download/17479/intel-network-adapter-driver-for-windows-8-1.html
 [intel-nic-10]: https://www.intel.com/content/www/us/en/download/18293/intel-network-adapter-driver-for-windows-10.html
diff --git a/README.md b/README.md
index e1ab9c8..1c63250 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@
 - 支持 BIOS、EFI 引导，支持 ARM 服务器
 - 不含自制包，所有资源均实时从镜像源获得
 
-如果帮到你，可以请我喝奶茶。
+请我喝奶茶：
 [![Donate](https://img.shields.io/badge/Donate-30363D?style=for-the-badge&logo=GitHub-Sponsors&logoColor=#EA4AAA)](https://github.com/sponsors/bin456789)
 
 [![Sponsors](https://raw.githubusercontent.com/bin456789/sponsors/refs/heads/master/sponsors.svg)](https://github.com/sponsors/bin456789)
@@ -147,12 +147,13 @@ certutil -urlcache -f -split https://cnb.cool/bin456789/reinstall/-/git/raw/main
 >
 > 如果不小心运行了脚本，可以在重启前运行 `bash reinstall.sh reset` 取消重装
 
-- 用户名为 `root`，脚本会提示输入密码，不输入则使用随机密码
-- 安装最新版可不输入版本号
+- 脚本会提示输入用户名和密码，不输入则使用 `root` 和随机密码
+- 不输入版本号则安装最新版
 - 最大化利用磁盘空间：不含 boot 和 swap 分区
-- 自动根据机器类型选择不同的优化内核，例如 `Cloud`、`HWE` 内核
+- 自动根据机器类型和商家安装优化内核
 - 安装 Red Hat 时需填写 <https://access.redhat.com/downloads/content/rhel> 得到的 `qcow2` 镜像链接，也可以安装其它类 RHEL 系统的 `qcow2`，例如 `Alibaba Cloud Linux` 和 `TencentOS Server`
 - 重装后如需修改 SSH 端口或者改成密钥登录，注意还要修改 `/etc/ssh/sshd_config.d/` 里面的文件
+- 为了快速安装，重装时不会对新系统进行更新，请在重装后自行更新
 
 ```bash
 bash reinstall.sh anolis      7|8|23
@@ -178,9 +179,10 @@ bash reinstall.sh anolis      7|8|23
 
 #### 可选参数
 
+- `--username USERNAME` 设置用户名
 - `--password PASSWORD` 设置密码
 - `--ssh-key KEY` 设置 SSH 登录公钥，[格式如下](#--ssh-key)。当使用公钥时，密码为空
-- `--ssh-port PORT` 修改 SSH 端口（安装期间观察日志用，也作用于新系统）
+- `--ssh-port PORT` 修改 SSH 端口
 - `--web-port PORT` 修改 Web 端口（安装期间观察日志用）
 - `--frpc-config PATH` 添加 frpc 内网穿透，参数填配置文件的本地路径或 HTTP 链接
 - `--hold 1` 仅重启到安装环境，不运行安装，用于 SSH 登录验证网络连通性
@@ -237,6 +239,7 @@ bash reinstall.sh ubuntu --installer
 - 支持 `raw` 和固定大小的 `vhd` 镜像。未压缩或者压缩成 `.gz` `.xz` `.zst` `.tar` `.tar.gz` `.tar.xz` `.tar.zst`
 - DD Windows 镜像时，会自动扩展系统盘，静态 IP 的机器会配置好 IP，可能首次开机几分钟后才生效
 - DD Linux 镜像时，**不会**修改镜像的任何内容
+- 脚本会提示输入用户名和密码，用于安装时 SSH 登录观察日志，不输入则使用 `root` 和随机密码
 
 ```bash
 bash reinstall.sh dd --img "https://example.com/xxx.xz"
@@ -244,10 +247,13 @@ bash reinstall.sh dd --img "https://example.com/xxx.xz"
 
 #### 可选参数
 
-- `--allow-ping` 设置 Windows 防火墙允许被 Ping (仅限 DD Windows)
-- `--rdp-port PORT` 修改 RDP 端口 (仅限 DD Windows)
+- `--username USERNAME` 设置用户名（安装期间观察日志用）
+- `--password PASSWORD` 设置密码（安装期间观察日志用）
+- `--ssh-key KEY` 设置 SSH 登录公钥（安装期间观察日志用），[格式如下](#--ssh-key)。当使用公钥时，密码为空
 - `--ssh-port PORT` 修改 SSH 端口（安装期间观察日志用）
+- `--rdp-port PORT` 修改 RDP 端口（仅限 DD Windows）
 - `--web-port PORT` 修改 Web 端口（安装期间观察日志用）
+- `--allow-ping` 设置 Windows 防火墙允许被 Ping（仅限 DD Windows）
 - `--frpc-config PATH` 添加 frpc 内网穿透（仅限 DD Windows），参数填配置文件的本地路径或 HTTP 链接
 - `--cloud-data PATH_OR_URL` 为 DD Linux 镜像注入 cloud-init NoCloud 配置（仅限 DD Linux）
 - `--hold 1` 仅重启到安装环境，不运行安装，用于 SSH 登录验证网络连通性
@@ -257,7 +263,7 @@ bash reinstall.sh dd --img "https://example.com/xxx.xz"
 >
 > `--cloud-data` 参数为本地目录或 HTTP 基础 URL，目录须包含 `user-data` 文件，`meta-data`、`network-config` 可选：
 >
-> ```
+> ```bash
 > seed/
 > ├── user-data      # 必须
 > ├── meta-data      # 可选
@@ -282,7 +288,7 @@ bash reinstall.sh dd --img "https://example.com/xxx.xz"
 ### 功能 3: 重启到 <img width="16" height="16" src="https://www.alpinelinux.org/alpine-logo.ico" /> Alpine Live OS（内存系统）
 
 - 可用 ssh 连接，进行备份/恢复硬盘、手动 DD、修改分区、手动安装 Alpine 等操作
-- 用户名为 `root`，脚本会提示输入密码，不输入则使用随机密码
+- 脚本会提示输入用户名和密码，不输入则使用 `root` 和随机密码
 
 > [!TIP]
 >
@@ -296,9 +302,10 @@ bash reinstall.sh alpine --hold 1
 
 #### 可选参数
 
+- `--username USERNAME` 设置用户名
 - `--password PASSWORD` 设置密码
-- `--ssh-port PORT` 修改 SSH 端口
 - `--ssh-key KEY` 设置 SSH 登录公钥，[格式如下](#--ssh-key)。当使用公钥时，密码为空
+- `--ssh-port PORT` 修改 SSH 端口
 - `--frpc-config PATH` 添加 frpc 内网穿透，参数填配置文件的本地路径或 HTTP 链接
 
 ### 功能 4: 重启到 <img width="16" height="16" src="https://netboot.xyz/img/favicon.ico" /> netboot.xyz
@@ -327,9 +334,9 @@ bash reinstall.sh netboot.xyz
 >
 > 如果不小心运行了脚本，可以在重启前运行 `bash reinstall.sh reset` 取消重装
 
-- 脚本会提示输入用户名，不输入则使用 `administrator`
-- 脚本会提示输入密码，不输入则使用随机密码
+- 脚本会提示输入用户名和密码，不输入则使用 `administrator` 和随机密码
 - 如果远程登录失败，请尝试在用户名前添加 `.\`，例如 `.\administrator`
+- 少数语言的系统管理员账号不是 `administrator` [详情](https://learn.microsoft.com/archive/technet-wiki/13813.localized-names-for-administrator-account-in-windows#list-of-languages-that-localize-the-administrator-account-name)
 - 静态机器会自动配置好 IP，可能首次开机几分钟后才生效
 - 支持任意语言的 ISO
 - 自动绕过 Windows 11 硬件限制
@@ -447,12 +454,12 @@ bash reinstall.sh windows \
 
 #### 可选参数
 
-- `--username USERNAME` 设置用户名（仅限 Windows）
+- `--username USERNAME` 设置用户名
 - `--password PASSWORD` 设置密码
+- `--rdp-port PORT` 修改 RDP 端口
+- `--ssh-port PORT` 修改 SSH 端口（安装期间观察日志用）
+- `--web-port PORT` 修改 Web 端口（安装期间观察日志用）
 - `--allow-ping` 设置 Windows 防火墙允许被 Ping
-- `--rdp-port PORT` 更改 RDP 端口
-- `--ssh-port PORT` 修改 SSH 端口（仅安装期间观察日志用）
-- `--web-port PORT` 修改 Web 端口（仅安装期间观察日志用）
 - `--add-driver INF_OR_DIR` 添加额外驱动，填写 .inf 路径，或者 .inf 所在的文件夹
   - 需先下载驱动到当前系统
   - 可多次设置该参数以添加不同的驱动
@@ -467,7 +474,7 @@ bash reinstall.sh windows \
 - AWS ([ENA 网卡][aws-ena], [NVME 存储控制器][aws-nvme])
 - GCP ([gVNIC 网卡][gcp-gvnic], [GGA 显卡][gcp-gga])
 - Azure ([MANA 网卡][azure-mana])
-- Intel (VMD 存储控制器: [11代酷睿][intel-vmd-gen11], [12-15代酷睿][intel-vmd-gen12-to-gen15], 网卡: [7][intel-nic-7], [8.x][intel-nic-8.1], [10][intel-nic-10], [11][intel-nic-11], [2008 R2][intel-nic-7], [2012][intel-nic-2012], [2012 R2][intel-nic-2012-r2], [2016][intel-nic-2016], [2019][intel-nic-2019], [2022][intel-nic-2022], [2025][intel-nic-2025])
+- Intel (VMD 存储控制器: [11代酷睿][intel-vmd-gen11], [12-15代酷睿][intel-vmd-gen12-to-gen15], [酷睿 Ultra 3][intel-vmd-ultra3], 网卡: [7][intel-nic-7], [8.x][intel-nic-8.1], [10][intel-nic-10], [11][intel-nic-11], [2008 R2][intel-nic-7], [2012][intel-nic-2012], [2012 R2][intel-nic-2012-r2], [2016][intel-nic-2016], [2019][intel-nic-2019], [2022][intel-nic-2022], [2025][intel-nic-2025])
 
 [virtio-virtio]: https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/
 [virtio-aliyun]: https://www.alibabacloud.com/help/ecs/user-guide/install-the-virtio-driver-1
@@ -483,6 +490,7 @@ bash reinstall.sh windows \
 [azure-mana]: https://learn.microsoft.com/azure/virtual-network/accelerated-networking-mana-windows
 [intel-vmd-gen11]: https://www.intel.com/content/www/us/en/download/849933/intel-rapid-storage-technology-driver-installation-software-with-intel-optane-memory-12th-to-13th-gen-platforms.html
 [intel-vmd-gen12-to-gen15]: https://www.intel.com/content/www/us/en/download/849936/intel-rapid-storage-technology-driver-installation-software-with-intel-optane-memory-12th-to-15th-gen-platforms.html
+[intel-vmd-ultra3]: https://www.intel.com/content/www/us/en/download/920456/intel-rapid-storage-technology-driver-installation-software-for-intel-core-ultra-series-3-platforms.html
 [intel-nic-7]: https://www.intel.com/content/www/us/en/download/15590/intel-network-adapter-driver-for-windows-7-final-release.html
 [intel-nic-8.1]: https://www.intel.com/content/www/us/en/download/17479/intel-network-adapter-driver-for-windows-8-1.html
 [intel-nic-10]: https://www.intel.com/content/www/us/en/download/18293/intel-network-adapter-driver-for-windows-10.html
diff --git a/reinstall.sh b/reinstall.sh
index ed8f361..4ab21f8 100644
--- a/reinstall.sh
+++ b/reinstall.sh
@@ -881,7 +881,7 @@ is_have_arm_version() {
 find_windows_iso() {
     parse_windows_image_name || error_and_exit "--image-name wrong: $image_name"
     if ! { [ "$version" = 8 ] || [ "$version" = 8.1 ]; } && [ -z "$edition" ]; then
-        error_and_exit "Edition is not set."
+        error_and_exit "Windows Edition is not specified."
     fi
 
     if [ -z "$lang" ]; then
@@ -1284,8 +1284,12 @@ Continue?
             if is_in_china; then
                 hostname=mirror.nju.edu.cn
             else
-                # http.kali.org 没有 ipv6 地址
-                # http.kali.org (geoip 重定向) 到 kali.download (cf)
+                # http.kali.org (geoip 重定向) 到 kali.download (cf) 或最近的站点
+                # 文档还说 which is guaranteed to be up-to-date
+                # 但是目测有可能重定义到一个拉黑了部分 IP 的服务器
+                # 因此这里用 kali.download (cf)
+                # https://www.kali.org/docs/community/kali-linux-mirrors/
+                # https://www.kali.org/docs/general-use/kali-apt-sources/
                 hostname=kali.download
             fi
             codename=kali-rolling
diff --git a/trans.sh b/trans.sh
index da989a8..85a8ecd 100644
--- a/trans.sh
+++ b/trans.sh
@@ -512,7 +512,9 @@ clear_previous() {
     fi
     disconnect_qcow
     # 安装 arch 有 gpg-agent 进程驻留
-    pkill gpg-agent || true
+    killall gpg-agent || true
+    # 在 aria2c 下载时手动中止脚本，aria2c 还会在后台下载
+    killall aria2c || true
     rc-service -q --ifexists --ifstarted nix-daemon stop
     swapoff -a
     umount_all
@@ -1702,6 +1704,8 @@ install_nixos() {
     export USER=root
     export HOME=/root
 
+    # 也可以用 export NIX_CONFIG 和 --option substituters https://mirror.nju.edu.cn/nix-channels/store
+    # https://help.mirrorz.org/nix-channels/
     configure_nix_substituters() {
         if ! is_in_china; then
             return
@@ -1795,6 +1799,9 @@ install_nixos() {
     # 安装 nixos-install-tools
     nix-env -iA nixpkgs.nixos-install-tools -j $threads
 
+    # 安装 nixfmt
+    nix-env -iA nixpkgs.nixfmt -j $threads
+
     # 生成配置并显示
     nixos-generate-config --root /os
     echo "Original NixOS Configuration:"
@@ -1812,7 +1819,7 @@ install_nixos() {
     fi
 
     if [ -e /os/swapfile ] && $keep_swap; then
-        nix_swap="swapDevices = [{ device = \"/swapfile\"; size = $swap_size; }];"
+        nix_swap="swapDevices = [ { device = \"/swapfile\"; size = $swap_size; } ];"
     fi
 
     # keys
@@ -1943,10 +1950,10 @@ EOF
     )
     alls="$olds"
     # https://github.com/search?q=repo%3ANixOS%2Fnixpkgs+availableKernelModules&type=code
-    for mod in ahci ata_piix uhci_hcd sr_mod nvme \
+    for mod in ahci ata_piix uhci_hcd sr_mod nvme vmd \
         virtio_pci virtio_blk virtio_scsi \
         xen_blkfront xen_scsifront \
-        hv_storvsc \
+        hv_storvsc pci_hyperv \
         vmw_pvscsi \
         mptspi; do
         if [ -d /sys/module/$mod ] && ! echo "$olds" | grep -wq "$mod"; then
@@ -1964,6 +1971,10 @@ EOF
         array \
         /os/etc/nixos/hardware-configuration.nix
 
+    # 格式化
+    nixfmt /os/etc/nixos/configuration.nix
+    nixfmt /os/etc/nixos/hardware-configuration.nix
+
     # 显示修改后的配置
     echo "Modified NixOS Configuration:"
     show_nixos_config
@@ -3289,14 +3300,23 @@ modify_windows() {
         bats="$bats windows-set-netconf-$ethx.bat"
     done
 
-    # 5. 设置用户密码永不过期
+    # 5. 设置用户密码永不过期（仅限 iso 安装）
     #    Azure 的 Windows 实例，初始用户的密码也是永不过期的
     #    管理员账号默认不会过期
-    if ! is_administrator_username "$username"; then
+    if [ "$distro" = "windows" ] && ! is_administrator_username "$username"; then
+        # 两种方法都可以，但语法很神奇
+
+        # 第二行前面不能有空格
         cat <<EOF >$os_dir/windows-set-user-password-never-expires.bat
 wmic useraccount where name="$username" set passwordexpires=false || ^
 powershell -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-LocalUser -Name '$username' -PasswordNeverExpires \$true"
 del "%~f0"
+EOF
+        # 第二行 || 前面必须有空格
+        cat <<EOF >$os_dir/windows-set-user-password-never-expires.bat
+wmic useraccount where name="$username" set passwordexpires=false ^
+  || powershell -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Set-LocalUser -Name '$username' -PasswordNeverExpires \$true"
+del "%~f0"
 EOF
         unix2dos $os_dir/windows-set-user-password-never-expires.bat
         bats="$bats windows-set-user-password-never-expires.bat"
@@ -7147,8 +7167,14 @@ EOF
         *)
             # 先获取最新版本号，再下载
             # 用 stable-virtio 的话国内镜像下载的可能是缓存的旧版
-            dir=$(wget --spider -S "$baseurl/stable-virtio" 2>&1 >/dev/null |
-                grep -E '^  Location: ' | grep -Ewo -m1 'archive-virtio/virtio-win-.+$')
+
+            # https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/
+            # 路径是网页，可能会弹出 anubis 验证
+
+            # https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/CHECKSUM
+            # 路径是文件，应该不会弹出 anubis 验证？
+            dir=$(wget --spider -S "$baseurl/stable-virtio/CHECKSUM" 2>&1 >/dev/null |
+                grep -E '^  Location: ' | grep -Ewo -m1 'archive-virtio/virtio-win-[^/]+')
             # dir=stable-virtio
             ;;
         esac
diff --git a/windows-setup.bat b/windows-setup.bat
index 16ceb3e..97b98f2 100644
--- a/windows-setup.bat
+++ b/windows-setup.bat
@@ -87,7 +87,7 @@ rem for /f "tokens=3" %%a in (X:\disk.txt) do (
 rem     set "DiskIndex=%%a"
 rem )
 
-rem PE 下没有 findstr，因此不能从 wmic 的输出直接选出开头为 * 的行，要用复杂的方法取出磁盘编号
+rem PE 下没有 findstr，因此不能从 diskpart 的输出直接选出开头为 * 的行，要用复杂的方法取出磁盘编号
 
 rem 输出 diskpart 结果到文件
 (echo select vol %VolIndex% & echo list disk) | diskpart | find "* " > X:\disk.txt