diff --git a/flake.nix b/flake.nix
index 3e37f35a9..f7fd57c90 100644
--- a/flake.nix
+++ b/flake.nix
@@ -149,10 +149,6 @@
                 inherit inputs;
                 username = "skakinoki";
               };
-              maticIso = import ./named-hosts/matic/iso.nix {
-                inherit inputs;
-                username = "skakinoki";
-              };
               viper = import ./named-hosts/viper {
                 inherit inputs;
                 username = "shunkakinoki";
diff --git a/named-hosts/matic/default.nix b/named-hosts/matic/default.nix
index e1ea42926..a3b221d79 100644
--- a/named-hosts/matic/default.nix
+++ b/named-hosts/matic/default.nix
@@ -3,9 +3,6 @@
   username,
   ...
 }:
-let
-  falconDebExists = builtins.pathExists /etc/nixos/falcon-sensor.deb;
-in
 import ../../hosts/nixos {
   inherit inputs username;
   hostname = "matic";
@@ -27,9 +24,6 @@ import ../../hosts/nixos {
     # Shared keyd config and application mapper wiring
     ../../config/keyd/default.nix
 
-    # Kolide launcher
-    ./kolide.nix
-
     # System configuration
     (
       {
@@ -52,9 +46,6 @@ import ../../hosts/nixos {
           "tpm2-device=auto"
         ];
 
-        # Pin kernel to 6.18 for CrowdStrike Falcon compatibility (RFM on 6.19)
-        boot.kernelPackages = pkgs.linuxPackages_6_18;
-
         # Filesystem hardening
         boot.kernel.sysctl = {
           "fs.protected_regular" = 2;
@@ -359,7 +350,7 @@ import ../../hosts/nixos {
           options mt7925e disable_aspm=1
         '';
 
-        # Enable nix-ld for running dynamically linked binaries (CrowdStrike, Kolide, etc.)
+        # Enable nix-ld for running dynamically linked binaries
         programs.nix-ld.enable = true;
         programs.nix-ld.libraries = with pkgs; [
           curl
@@ -577,6 +568,5 @@ import ../../hosts/nixos {
           };
       }
     )
-  ]
-  ++ (if falconDebExists then [ ./falcon.nix ] else [ ]);
+  ];
 }
diff --git a/named-hosts/matic/falcon-init.sh b/named-hosts/matic/falcon-init.sh
deleted file mode 100644
index 7b5102e06..000000000
--- a/named-hosts/matic/falcon-init.sh
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/usr/bin/env bash
-# CrowdStrike Falcon sensor init script.
-# @e2fsprogs@, @rsync@, @falcon@ are substituted by pkgs.replaceVars.
-set -euo pipefail
-
-# Remove immutable attributes set by CrowdStrike (security feature)
-if [ -d /opt/CrowdStrike ]; then
-  @e2fsprogs@/bin/chattr -i -R /opt/CrowdStrike 2>/dev/null || true
-fi
-
-install -d -m 0770 /opt/CrowdStrike
-
-# CrowdStrike pushes OTA updates that write newer versioned binaries into
-# /opt/CrowdStrike/. Only rsync the packaged binaries when the installed
-# version is not newer than the package, otherwise the rsync clobbers the
-# update and the running sensor can't find its helper binaries (ENOENT).
-pkg_ver="@falcon@/opt/CrowdStrike/falconctl"
-installed_ver=/opt/CrowdStrike/falconctl
-need_sync=true
-
-if [ -x "$installed_ver" ]; then
-  pkg_build=$(readlink -f "$pkg_ver" | grep -oP '\d+$' || echo "0")
-  inst_build=$(readlink -f "$installed_ver" | grep -oP '\d+$' || echo "0")
-  if [ "$inst_build" -gt "$pkg_build" ] 2>/dev/null; then
-    echo "falcon-init: installed build $inst_build is newer than packaged $pkg_build, skipping rsync"
-    need_sync=false
-  fi
-fi
-
-if [ "$need_sync" = true ]; then
-  # Update binaries from the nix store, but preserve runtime state files.
-  # falconstore contains the Agent ID (AID) - if lost, the sensor re-registers
-  # as a new host and consumes another license seat.
-  @rsync@/bin/rsync -a --delete \
-    --exclude=falconstore \
-    --exclude=falconstore.bak \
-    --exclude=CsConfig \
-    "@falcon@/opt/CrowdStrike/" /opt/CrowdStrike/
-fi
-
-chown -R root:root /opt/CrowdStrike
-
-# load CID from /etc/falcon-sensor.env (root-only)
-# shellcheck source=/dev/null
-. /etc/falcon-sensor.env
-
-# set CID via falconctl inside FHS env
-@falcon@/bin/fs-bash -c "/opt/CrowdStrike/falconctl -s -f --cid=\"$FALCON_CID\""
-
-# sanity print
-@falcon@/bin/fs-bash -c "/opt/CrowdStrike/falconctl -g --cid"
diff --git a/named-hosts/matic/falcon.nix b/named-hosts/matic/falcon.nix
deleted file mode 100644
index 3ba37a448..000000000
--- a/named-hosts/matic/falcon.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-# CrowdStrike Falcon sensor configuration for NixOS
-#
-# Prerequisites (manual steps):
-# 1. Obtain the Falcon sensor .deb from IT
-# 2. Place it at: /etc/nixos/falcon-sensor.deb
-#    sudo cp ~/Downloads/falcon-sensor*.deb /etc/nixos/falcon-sensor.deb
-# 3. Create /etc/falcon-sensor.env with: FALCON_CID=<your-cid>
-#
-# This module is only imported if /etc/nixos/falcon-sensor.deb exists.
-#
-# Based on: https://github.com/taylanpince/nixos-config
-{ pkgs, ... }:
-let
-  falcon = pkgs.callPackage ./falcon { };
-
-  initScript = pkgs.writeScript "init-falcon" (
-    builtins.readFile (
-      pkgs.replaceVars ./falcon-init.sh {
-        inherit (pkgs) e2fsprogs rsync;
-        inherit falcon;
-      }
-    )
-  );
-in
-{
-  systemd.tmpfiles.rules = [
-    "d /opt/CrowdStrike 0770 root root -"
-  ];
-
-  systemd.services.falcon-sensor = {
-    description = "CrowdStrike Falcon Sensor";
-    wantedBy = [ "multi-user.target" ];
-    # Falcon does not stop cleanly during nixos-rebuild switch, leaving
-    # vendor processes behind and causing restart attempts to fail with
-    # "Device or resource busy". Keep the running sensor in place during
-    # switch and apply unit changes on the next boot or manual restart.
-    restartIfChanged = false;
-
-    unitConfig.DefaultDependencies = false;
-    # Start-limit directives belong in [Unit], not [Service].
-    unitConfig.StartLimitIntervalSec = 0;
-    after = [ "local-fs.target" ];
-    conflicts = [ "shutdown.target" ];
-    before = [
-      "sysinit.target"
-      "shutdown.target"
-    ];
-
-    serviceConfig = {
-      Type = "forking";
-      PIDFile = "/run/falcond.pid";
-      ExecStartPre = "${pkgs.bash}/bin/bash ${initScript}";
-      ExecStart = "${falcon}/bin/fs-bash -c \"/opt/CrowdStrike/falcond\"";
-
-      Restart = "on-failure";
-      RestartSec = "15s";
-
-      TimeoutStopSec = "60s";
-      KillMode = "process";
-      Delegate = true;
-    };
-  };
-}
diff --git a/named-hosts/matic/falcon/default.nix b/named-hosts/matic/falcon/default.nix
deleted file mode 100644
index 6f7d11312..000000000
--- a/named-hosts/matic/falcon/default.nix
+++ /dev/null
@@ -1,67 +0,0 @@
-# CrowdStrike Falcon sensor package for NixOS
-#
-# Prerequisites:
-# 1. Obtain the Falcon sensor .deb from IT
-# 2. Place it at: /etc/nixos/falcon-sensor.deb
-#    sudo cp ~/Downloads/falcon-sensor*.deb /etc/nixos/falcon-sensor.deb
-# 3. Update the version below if different
-{
-  stdenv,
-  lib,
-  dpkg,
-  openssl,
-  libnl,
-  zlib,
-  autoPatchelfHook,
-  buildFHSEnv,
-  ...
-}:
-let
-  pname = "falcon-sensor";
-  version = "7.31.0-18410";
-  arch = "amd64";
-
-  # Use absolute path outside the flake (gitignored files aren't visible to flakes)
-  src = /etc/nixos/falcon-sensor.deb;
-
-  falcon-sensor = stdenv.mkDerivation {
-    name = pname;
-    inherit version arch src;
-
-    buildInputs = [
-      autoPatchelfHook
-      dpkg
-      zlib
-    ];
-    sourceRoot = ".";
-
-    unpackPhase = ''
-      dpkg-deb -x $src .
-    '';
-
-    installPhase = ''
-      cp -r . $out
-    '';
-
-    meta = with lib; {
-      description = "CrowdStrike Falcon Sensor";
-      homepage = "https://www.crowdstrike.com/";
-      license = licenses.unfree;
-      platforms = platforms.linux;
-    };
-  };
-in
-buildFHSEnv {
-  name = "fs-bash";
-  targetPkgs = _: [
-    libnl
-    openssl
-    zlib
-  ];
-
-  extraInstallCommands = ''
-    ln -s ${falcon-sensor}/* $out/
-  '';
-
-  runScript = "bash";
-}
diff --git a/named-hosts/matic/iso.nix b/named-hosts/matic/iso.nix
deleted file mode 100644
index 6a49b6aa4..000000000
--- a/named-hosts/matic/iso.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  inputs,
-  username,
-  ...
-}:
-import ../../hosts/nixos {
-  inherit inputs username;
-  hostname = "matic";
-  userInitialPassword = "changemeow";
-  modules = [
-    "${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
-    "${inputs.nixpkgs}/nixos/modules/installer/cd-dvd/channel.nix"
-    (
-      { lib, pkgs, ... }:
-      {
-        # ISO bootstrap - no home-manager available
-        environment.systemPackages = with pkgs; [
-          curl
-          git
-          vim
-        ];
-        image.fileName = "matic.iso";
-        services.getty.helpLine = lib.mkForce "";
-      }
-    )
-  ];
-}
diff --git a/named-hosts/matic/kolide.nix b/named-hosts/matic/kolide.nix
deleted file mode 100644
index cf46516e0..000000000
--- a/named-hosts/matic/kolide.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-# Kolide Launcher configuration for NixOS
-#
-# Uses the official Kolide NixOS module from https://github.com/kolide/nix-agent
-#
-# Prerequisites (manual steps):
-# 1. Obtain the Kolide launcher .deb from IT
-# 2. Extract the enrollment secret:
-#    nix-shell -p dpkg --run 'dpkg-deb -x ~/Downloads/kolide-launcher.deb /tmp/kolide-deb'
-#    cat /tmp/kolide-deb/etc/kolide-k2/secret
-# 3. Install secret to /etc/kolide-k2/secret (root:root, 0600):
-#    sudo install -d -m 755 /etc/kolide-k2
-#    sudo sh -c 'cat /tmp/kolide-deb/etc/kolide-k2/secret > /etc/kolide-k2/secret'
-#    sudo chown root:root /etc/kolide-k2/secret
-#    sudo chmod 600 /etc/kolide-k2/secret
-{ lib, pkgs, ... }:
-
-let
-  falconInstalled = builtins.pathExists /etc/nixos/falcon-sensor.deb;
-
-  # Official Kolide NixOS module
-  # Pin to specific commit to avoid hash mismatches when upstream pushes to main.
-  # To update: get latest commit from https://github.com/kolide/nix-agent
-  # then: nix-prefetch-url --unpack https://github.com/kolide/nix-agent/archive/<commit>.tar.gz
-  kolideSrc = builtins.fetchTarball {
-    url = "https://github.com/kolide/nix-agent/archive/0ccdf83c1a86cf0606f045363e29db4d840684e1.tar.gz";
-    sha256 = "1pawad6s3cd59x58mbj8g0qmfmki2mgmk5sgbn19ic692cb5lj98";
-  };
-in
-{
-  imports = [
-    "${kolideSrc}/modules/kolide-launcher"
-  ];
-
-  # dpkg status shim for Kolide/osquery compliance
-  # NixOS has no dpkg database, so Kolide's osquery deb_packages check fails.
-  # This shim reports falcon-sensor as "installed" to satisfy the CrowdStrike check.
-  systemd.tmpfiles.rules = [
-    "d /var/lib/dpkg 0755 root root -"
-    "f /var/lib/dpkg/status 0644 root root - Package: falcon-sensor\\nStatus: install ok installed\\nPriority: optional\\nSection: misc\\nInstalled-Size: 0\\nMaintainer: CrowdStrike\\nArchitecture: amd64\\nVersion: 7.31.0-18410\\nDescription: CrowdStrike Falcon Sensor (shim for Kolide/osquery on NixOS)\\n"
-  ];
-
-  systemd.services.kolide-launcher = {
-    # Kolide shells out to both dpkg-backed package checks and gsettings-based
-    # screen-lock checks, neither of which are on PATH by default on NixOS.
-    path = with pkgs; [
-      dpkg
-      glib
-    ];
-
-    # When Falcon is installed, start Kolide after it so the initial CrowdStrike
-    # compliance query does not race the sensor startup during boot/switch.
-    after = lib.optional falconInstalled "falcon-sensor.service";
-    wants = lib.optional falconInstalled "falcon-sensor.service";
-  };
-
-  # Enable Kolide launcher
-  services.kolide-launcher.enable = true;
-}
diff --git a/spec/coverage_spec.sh b/spec/coverage_spec.sh
index 5f70d1ea7..07d3be177 100644
--- a/spec/coverage_spec.sh
+++ b/spec/coverage_spec.sh
@@ -177,10 +177,6 @@ It 'has spec file for home-manager/modules/uv-globals/install-uv-globals.sh'
 The path "spec/uv_globals_spec.sh" should be exist
 End
 
-It 'has spec file for named-hosts/matic/falcon-init.sh'
-The path "spec/falcon_init_spec.sh" should be exist
-End
-
 It 'has spec file for named-hosts/matic/pam-gnome-keyring-tpm-unlock.sh'
 The path "spec/pam_gnome_keyring_tpm_unlock_spec.sh" should be exist
 End
@@ -477,7 +473,6 @@ named-hosts/kyber/activate-backup-files.sh
 named-hosts/kyber/activate-ip-forwarding.sh
 named-hosts/kyber/rekey-galactica.sh
 named-hosts/kyber/setup.sh
-named-hosts/matic/falcon-init.sh
 named-hosts/matic/pam-gnome-keyring-tpm-unlock.sh
 nix-darwin/config/keyboard/apply-hid-user-key-mappings.sh
 nix-darwin/services/pmset-battery-policy/power-policy.sh
diff --git a/spec/falcon_init_spec.sh b/spec/falcon_init_spec.sh
deleted file mode 100644
index 606fad25d..000000000
--- a/spec/falcon_init_spec.sh
+++ /dev/null
@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-# shellcheck disable=SC2329
-
-Describe 'named-hosts/matic/falcon-init.sh'
-SCRIPT="$PWD/named-hosts/matic/falcon-init.sh"
-
-Describe 'script properties'
-It 'uses bash shebang'
-When run bash -c "head -1 '$SCRIPT'"
-The output should include '#!/usr/bin/env bash'
-End
-
-It 'uses strict mode'
-When run bash -c "grep 'set -euo pipefail' '$SCRIPT'"
-The output should include 'set -euo pipefail'
-End
-End
-
-Describe 'placeholder substitutions'
-It 'references @e2fsprogs@ for chattr'
-When run bash -c "grep '@e2fsprogs@' '$SCRIPT'"
-The output should include 'chattr'
-End
-
-It 'references @rsync@ for sync'
-When run bash -c "grep '@rsync@' '$SCRIPT'"
-The output should include 'rsync'
-End
-
-It 'references @falcon@ for falconctl'
-When run bash -c "grep '@falcon@' '$SCRIPT'"
-The output should include 'falconctl'
-End
-End
-
-Describe 'logic'
-It 'preserves falconstore from rsync deletion'
-When run bash -c "grep 'falconstore' '$SCRIPT'"
-The output should include '--exclude=falconstore'
-End
-
-It 'loads CID from env file'
-When run bash -c "grep 'falcon-sensor.env' '$SCRIPT'"
-The output should include '/etc/falcon-sensor.env'
-End
-
-It 'sets CID via falconctl'
-When run bash -c "grep 'FALCON_CID' '$SCRIPT'"
-The output should include 'FALCON_CID'
-End
-End
-
-End
diff --git a/tests/eval.nix b/tests/eval.nix
index 189c04d77..56088ac78 100644
--- a/tests/eval.nix
+++ b/tests/eval.nix
@@ -74,13 +74,6 @@ let
           username = "shunkakinoki";
         }).config.system.build.toplevel;
 
-    eval-nixos-matic-iso =
-      mkEvalCheck "nixos-matic-iso"
-        (import ../named-hosts/matic/iso.nix {
-          inherit inputs;
-          username = "shunkakinoki";
-        }).config.system.build.isoImage;
-
     eval-nixos-viper =
       mkEvalCheck "nixos-viper"
         (import ../named-hosts/viper {