The Omarchy vs NixOS question has become the most common Linux desktop debate we hear from developers this summer, and for good reason. Omarchy 4.0, officially named Quattro, shipped on August 14, 2026 with a rebuilt desktop shell, sub-minute installs, and a pre-wired default coding agent chosen from nine options. NixOS 26.05, codenamed Yarara, shipped on May 30, 2026 with a systemd-based initrd and the largest package collection in the Linux world. Both are keyboard-first, both run Hyprland, and both attract the same kind of engineer. They are built on opposite philosophies. We run NixOS with Hyprland on our own engineering workstations and lab hosts at Petronella Technology Group, Inc., so the NixOS half of this comparison comes from daily use. For the Omarchy half we worked from the project's release notes, manual, source repository, and the security releases that followed Quattro, and every factual claim is tied to a primary source at the end.
If you only want the short answer: Omarchy Quattro is the fastest path from a blank laptop to a polished, opinionated Hyprland desktop, and it is the better pick for a solo developer or a small team that wants curated defaults and does not want to learn a new language. NixOS is the better pick when you need to prove what is on a machine, reproduce it on ten more, roll back with certainty, and hand an auditor a git history instead of a shell script. The rest of this guide explains why, where each one hurts, and what regulated teams should think about before standardizing on either.
What Omarchy Quattro Actually Is
Omarchy describes itself as an omakase Linux distribution based on Arch, the Hyprland tiling window manager, and the Quickshell desktop construction kit. It was created by David Heinemeier Hansson, incubated at 37signals, and first released on June 26, 2025 as a sister project to Omakub, his opinionated Ubuntu setup. The code is MIT licensed and lives at basecamp/omarchy on GitHub, where it had roughly 34,900 stars at the time of writing.
Quattro is the fourth major release, and the release notes call it the biggest since the project started. The headline changes matter for this comparison:
- A single desktop shell. The bar, launcher, menus, notifications, on-screen displays, control panels, lock screen, and polkit agent now all live inside one long-running Quickshell process. That replaces eight separate components from the 3.x era, including Waybar, Walker, Mako, SwayOSD, hyprlock, hypridle, swaybg, and polkit-gnome.
- Internals moved from git to system packages. Omarchy is now installed as regular pacman packages from the Omarchy Package Repository, which the project says was done for safely separating user modifications from project files. This directly answers the long-running community feedback that Omarchy was a set of dotfiles and scripts layered on Arch.
- Faster, smaller installs. The ISO shrank by more than a gigabyte to under 6 GB, installation is more than 30 percent faster, and the project advertises sub-minute installs on fast hardware. Dual-boot installation is offered when free space is available.
- Lua Hyprland configs for full Hyprland 0.56 compatibility, theme coloring expanded from 8 to 24 colors, a plugin system, NetworkManager for the new network panel, and three new themes.
- Factory reset and new-owner setup. Setup, then Reset Computer swaps the running root for a fresh clone of the factory btrfs snapshot.
- A configurable default coding agent with instant launch shortcuts. Quattro also ships Herdr, a Rust terminal multiplexer, alongside tmux. We compare Herdr head to head with tmux and cmux in our tmux vs cmux vs herdr guide, and cover that side of the ecosystem in our tmux configuration guide and our Cmux explainer.
A fast-follow 4.0.1 release on August 25, 2026 was, in the project's own words, mostly a collection of security fixes validated by the new Omarchy Security Team. We return to that below, because it is the crux of the security section.
The money and momentum behind Omarchy are also new. The Omacom Foundation launched in August 2026 with $8 million from eight founding patrons, including Tobi Lutke, Patrick Collison, Michael Dell, Jack Dorsey, Matthew Prince, Brendan Iribe, Jason Fried, and Hansson himself, and two more patrons took it to $10 million four days later. Dell announced day-one Omarchy support on the 2026 XPS 14 and 16. 37signals has said it will move its Ops and Ruby programming teams to Omarchy over three years.
What NixOS 26.05 Actually Is
NixOS is the operating system built on the Nix package manager, which Eelco Dolstra created in 2003 at Utrecht University. The first stable NixOS release was 13.10 in 2013, and the NixOS Foundation was established in 2015 as a Dutch non-profit. The project ships stable releases twice a year, and since 2021 the schedule has been fixed at late May and late November, with each release supported for seven months.
The current stable release is NixOS 26.05 Yarara, published May 30, 2026 and supported until December 31, 2026. The release announcement credits 2,842 contributors and 59,703 commits. Nixpkgs added 20,442 new packages and updated 20,641 existing ones in this cycle, and NixOS itself gained 85 new modules and 1,547 configuration options. The headline change is that stage 1, the initrd, is now systemd-based by default, with the old scripted implementation deprecated and scheduled for removal in 26.11. It is also the last release to support x86_64 Darwin.
The idea that makes NixOS different is simple to state and hard to fully appreciate until you have lived with it. The entire system, from kernel to services to desktop, is described in a declarative configuration file, traditionally /etc/nixos/configuration.nix. Running nixos-rebuild switch builds a new system generation from that description and activates it atomically. Every generation stays bootable from the boot menu until you garbage-collect it, and nixos-rebuild switch --rollback takes you back to the previous one. If an upgrade is interrupted by a power failure, the system is still consistent.
Three practical facts about the NixOS ecosystem in 2026 belong here:
- Flakes are still officially experimental. Flakes were introduced in Nix 2.4 and remain behind an experimental flag with no firm stabilization date, even though Determinate Systems and a large share of the community have used them in production for years. RFC 0136 lays out an incremental path to stabilization.
- Home Manager, the nix-community project for managing a user environment declaratively, follows the NixOS release branches and has more than 10,000 GitHub stars. Its README is candid that you should be comfortable with the Nix language before adopting it.
- Hyprland is a first-class citizen. A single option,
programs.hyprland.enable = true;, turns on Hyprland along with polkit, the Hyprland desktop portal, graphics drivers, and XWayland. Nixpkgs unstable carries Hyprland 0.56.2, the same line Omarchy Quattro targets, while NixOS 26.05 stable carries 0.55.4. Our Hyprland setup guide covers the compositor itself in depth.
Omarchy vs NixOS: Installation and First Boot
This is where the two projects diverge on day one.
Omarchy ships a bootable ISO from iso.omarchy.org. The manual is blunt about its requirements: you must turn off Secure Boot and/or TPM in firmware to install. Full-disk encryption with LUKS is on by default, and you can press Ctrl+C at the disk formatting confirmation to switch to an unencrypted install, an option added in 3.8. Quattro adds dual-boot when free space exists, and the manual reminds Windows users to turn off BitLocker first. Installs complete in under a minute on fast hardware, and Dell's XPS launch post, written against Omarchy 3.5, quotes about four minutes end to end with encryption on. The ISO can also run completely unattended when handed a configuration on a second drive, with files such as user_configuration.json, user_credentials.json, authorized_keys, and tailscale_authkey. The manual positions that as the way to treat Omarchy as a base image for VMs and fleet machines.
What you get at first boot is the point of the project. Hyprland is configured, themed, and keyboard-driven, with Super+Space for the unified Omarchy menu, which now absorbs the launcher, and Super+Return for a terminal. Neovim, Chromium, Obsidian, LibreOffice, Kdenlive, OBS Studio, and a curated set of terminal tools are already installed, and Quattro moved Signal, Spotify, and 1Password to on-demand installs. There are no decisions to make, which is exactly what Hansson means by omakase.
NixOS offers a graphical Calamares installer, which the manual recommends for desktop users and which includes a LUKS option, plus a fully manual nixos-install path for people who want to partition and write the initial configuration by hand. Secure Boot is not required to be off, but it is not turned on for you either. NixOS supports it through Lanzaboote or Limine, and the wiki still describes Lanzaboote as in development.
What you get at first boot is a working but plain system. If you chose Hyprland in your configuration, you have Hyprland with defaults and none of the polish. Everything Omarchy hands you pre-assembled, you assemble yourself in Nix. That is either the whole appeal or the whole problem, depending on who you are. The community port called omarchy-nix, which the Omarchy manual itself links to, exists precisely because people want Omarchy's defaults with NixOS's model.
Configuration Model: Curated Packages vs Declarative Nix
Omarchy Quattro's move from git-managed dotfiles to pacman packages is a real improvement in maintainability. Project files are owned by packages, and omarchy reinstall configs resets every Omarchy config to its default, overwriting your changes to those files, so your own tweaks belong in the override locations the dotfiles chapter describes. Hyprland configuration is now Lua. You edit files, you learn Hyprland's keywords, and you are done. The learning curve is the Arch and Hyprland learning curve, which the Omarchy manual openly embraces: manually editing some config files, heavy on the terminal.
NixOS asks more of you up front and pays it back later. The Nix language is a domain-specific, pure, lazy, functional, dynamically typed language, and reviewers from Jesse Smith in 2015 to Full Circle in 2022 have called out the learning curve. In exchange, the whole machine is a text file you can commit, diff, code-review, and apply to another machine. Two NixOS hosts built from the same configuration and the same pinned nixpkgs input are the same system, not two machines that drifted in the same general direction.
For a solo developer this difference is mostly taste. For a team it changes the operating model. When we onboard an engineer onto a NixOS workstation, the pull request that adds their host is the documentation. When we retire it, the git history is the record. There is no equivalent artifact in the Omarchy model unless you build it yourself, and the unattended-install configuration files, while useful, describe the initial state rather than the running state.
Updates, Rollback, and Recovery
Omarchy is a rolling-release system with a twist. Updates run through Update, then Omarchy in the menu, and there are four channels: stable, RC, edge, and dev. The stable channel is the default and points at an Arch mirror that runs one month behind the latest, so the project can catch incompatibilities that require config changes before they reach users. Edge gets the latest Arch. Rollback is handled by btrfs snapshots selectable from the Limine boot loader, which has been the default since Omarchy 2.0. A snapshot restore brings back the root filesystem but not /home.
That one-month delay is a deliberate stability trade, and it has a cost that users have raised in the project's discussions: security updates for packages such as Chromium arrive later on the stable mirror than they do on upstream Arch. If your patch policy is measured in days, you either run edge or you accept the lag.
NixOS is release-branch based. You track 26.05 for seven months of bug and security fixes, or you track nixos-unstable for a rolling experience. nixos-rebuild switch --upgrade pulls the channel and rebuilds. Every rebuild is a new generation, every generation is in the boot menu, under NixOS, All configurations with GRUB, and rollback is a single command or a boot menu selection. Because activation is atomic, a half-applied update is not a state the system can be in.
Both models work. The NixOS model is stronger in one specific way that matters for recovery planning: rollback is a property of every change, not a snapshot you hope was taken. That is the same argument we make for infrastructure in our Proxmox vs Docker comparison: prefer systems where the safe state is the default state.
Packages, Hardware, and NVIDIA
On raw package availability the numbers are not close. Repology ranks nixpkgs unstable first among all repositories with about 118,000 projects, 87 percent of them at the latest upstream version. NixOS 26.05 stable carries about 115,000. The Arch User Repository has about 93,000 at 69 percent current, and the official Arch repositories about 12,000. In practice both systems will have what a developer needs, but NixOS has it in one place, built by one CI system, and the AUR remains a community-maintained collection that Omarchy users install from at their own discretion.
Hardware is where Omarchy's commercial backing shows. Dell worked with Intel on kernel and power management for the XPS 14 and 16 and ships Omarchy support on day one. Quattro adds speaker tunings for those laptops specifically. Intel Macs are supported, Apple Silicon is not directly supported, and the manual points M1 and M2 users to a community project on Asahi. NixOS supports a wider range of hardware through nixpkgs and the nixos-hardware collection, but no OEM is tuning drivers for it.
NVIDIA deserves its own paragraph because most AI workstations have one. On NixOS the path is documented and declarative: set services.xserver.videoDrivers = ["nvidia"], allow unfree packages, set hardware.nvidia.open as required since driver 560, and configure PRIME for hybrid laptops. It is verbose but predictable, and once it is in the configuration it is on every machine you build from it. Omarchy's installer, in install/hardware/nvidia.sh, picks nvidia-open-dkms for GSP-capable GPUs, the nvidia-580xx legacy driver for older supported cards, and refuses unsupported ones, then sets nvidia_drm.modeset=1 and early KMS for you; Quattro also detects the GPU from sysfs by device ID. It is less verbose than the NixOS route and also less visible. If you are building a GPU box, our AI workstation build guide covers the hardware side, and our Ollama vs vLLM benchmarks cover the serving side.
Omarchy vs NixOS for AI Coding Agents and Developer Workflow
Quattro leans hard into agentic development. The release notes list Claude Code, Codex, OpenCode, Pi, Oh My Pi, Gemini, Grok, Copilot, and Crush as default-agent choices, the manual's AI chapter now carries ten launchers including Google's Antigravity CLI, and Super+Shift+Ctrl+A launches the default. An Omarchy skill, which the manual labels experimental, is symlinked into the skills directories of Claude Code, Codex, Pi, Antigravity, and the generic ~/.agents/skills location so the agent knows how to operate the system. The manual is explicit that agents launched this way run unattended in their respective don't-stop-to-ask modes, and it tells you to be ready for them to actually do things. The 4.0.1 security release changed the Claude and Codex launch to auto-review instead of full bypass, which we think was the right call and which we would have wanted from the start.
Hansson's own productivity argument is about speed. He has written that for the HEY test suite, even the fastest Mac, an M4 Max, is almost twice as slow as a Framework Desktop running Linux with native Docker. That is a claim about Linux versus macOS more than Omarchy versus NixOS, and it applies equally to both.
NixOS has no agent launcher and no skill symlinks. What it has is a development environment model that agents benefit from enormously: a shell.nix or flake dev shell pins every compiler, interpreter, and tool version for a project, so an agent working in that directory sees exactly the toolchain the project declares. Our Claude Code CLI guide and Cursor setup guide both assume you control the toolchain, and NixOS makes that control explicit. The 4.0.1 change to auto-review mode is also a reminder that the security posture of an agent workstation is mostly about what the agent is allowed to do, which we cover in keeping coding agents safe with supply chain guards.
Our honest read: if you want an agent-first laptop this afternoon, Omarchy Quattro is the more complete product. If you want agent-ready project environments that behave the same on every machine and in CI, NixOS is the better foundation, and you can still install every one of those agents on it.
Omarchy vs NixOS: Security and Compliance Posture
This is the section our clients ask about, so we will be specific.
Omarchy's defaults are good. Full-disk encryption with LUKS is mandatory on the standard install path and the manual calls it that. The firewall blocks all incoming traffic by default except port 53317 for LocalSend, SSH is off until you enable it, and Docker is locked down with ufw-docker. Fingerprint and FIDO2 authentication for sudo and polkit are available from the Setup menu. The project now has a security page, a security@omarchy.org contact, a responsible-disclosure policy, and a named security team. On the current Quattro branch the pacman configuration for the Omarchy repository uses the global SigLevel = Required DatabaseOptional, and the earlier issue documenting a TrustAll setting on the Omarchy repo in the 3.1 era is closed.
Omarchy's recent history is the concern. The 4.0.0 release notes themselves record closing three code-execution paths a malicious theme could take through installation, plus an unconstrained sudoers grant that let any wheel user write a root-owned symlink anywhere. Eleven days later, 4.0.1 shipped a further set of fixes that stop an installed theme from running code, stop USB device names from being executed as Hyprland Lua, run notification click actions as safe argv, guard plugin-add against git transport-helper URLs, pin a trusted PATH in a privileged DNS helper, remove a sudo lockout reset command, and make the docker group opt-in. A pseudonymous write-up titled Merchants of Insecurity, which the Register picked up, catalogued the same class of issues and argued the project should not process untrusted input with AI-generated shell. The Register's coverage of the foundation funding on August 27 called the project controversial and quoted the security criticism. None of that is disqualifying, and the response cadence was fast. It does mean that as of August 2026 Omarchy has a young security process that is being built in public, and a regulated buyer should weight that.
NixOS's strengths are structural. A 2025 study rebuilt 709,816 nixpkgs packages across snapshots from 2017 to 2023 and found bitwise reproducibility between 69 and 91 percent with an upward trend, and rebuildability above 99 percent. The last published official reproducibility report for the nixos-unstable minimal ISO, from February 2025, showed 96.59 percent of store paths, and the minimal ISO has been independently rebuilt bit for bit. Tooling such as sbomnix generates CycloneDX and SPDX SBOMs and SLSA v1.0 provenance directly from a flake reference or store path. NixOS 26.05 removed its old hardened profile and the linux-hardened kernel, citing the lack of a clear baseline and a lack of maintenance; what remains are individual options such as kernel module locking, AppArmor, and Secure Boot through Lanzaboote or Limine that you enable and justify yourself. Nixpkgs runs a public security tracker with named disclosure contacts. France's DINUM is building Securix, a secure and reproducible OS base, on NixOS.
What neither one gives you. Neither Arch nor NixOS appears in the CIS Benchmarks operating system list. The nixpkgs request for optional FIPS module support in OpenSSL 3 was closed as not planned after going stale. No Nix-built OpenSSL is FIPS 140 validated, and Arch has no validated module either. For a CMMC Level 2 enclave where SC.L2-3.13.11 requires FIPS-validated cryptography for protecting CUI, that means neither distribution is a candidate for the CUI-handling endpoints themselves. Both can be excellent developer workstations outside the CUI boundary, and NixOS in particular is a strong fit for the build and tooling hosts where reproducibility and SBOMs are what the assessor wants to see. The ArchWiki's Arch Security Team page also carries a notice that the security tracker is not currently being updated, and that the tracker page itself does not show that status, which is worth knowing if you rely on Arch security advisories for patch tracking.
If you are mapping any Linux endpoint into a compliance scope, the questions are the same ones we ask for macOS in our compliance practice: is it a CUI asset or a contractor risk managed asset, what cryptography protects data at rest and in transit, can you inventory what is on it, and can you prove the configuration. NixOS answers the last two better than any distribution we have used. Omarchy answers the first two adequately and the last two with more effort.
Our Verdict: Who Should Run Which
Choose Omarchy Quattro if:
- You are a developer or a small team that wants a beautiful, fast, keyboard-driven Hyprland desktop with zero configuration decisions.
- You buy hardware Omarchy targets, especially the 2026 Dell XPS 14 or 16 or a Framework laptop.
- You want AI coding agents wired into the desktop out of the box.
- You are comfortable with Arch's rolling model and a one-month stable delay, or you will run the edge channel and patch fast.
- You do not need to prove machine state to anyone but yourself.
Choose NixOS 26.05 if:
- You manage more than a couple of machines and want every one of them built from a reviewed, version-controlled description.
- Rollback needs to be a guarantee rather than a snapshot.
- You ship software and want reproducible builds, SBOMs, and provenance from the same tool that builds your workstation.
- You are building tooling or build hosts adjacent to a regulated environment and expect an assessor to ask how you know what is installed.
- You are willing to learn Nix, and you accept that flakes remain an experimental flag on paper.
Run both if: you want Omarchy on the laptop you carry and NixOS on the machines you cannot afford to rebuild by hand. That is the split we would recommend to a mixed team. The Omarchy manual even links to omarchy-nix for people who want the aesthetic on the other model.
How We Run It at Petronella Technology Group, Inc.
Our engineering workstations and several lab hosts run NixOS with Hyprland, rebuilt from a shared flake so that a new machine is a pull request rather than an afternoon. That is not a theoretical preference. When a rebuild kept killing our status bar under Hyprland this month, bringing it back was a single command, the durable fix is a change to one user unit in the flake, and the previous generation was one boot-menu entry away the whole time. We have not standardized on Omarchy. Reading the Quattro release notes and the 4.0.1 security release closely, the shell consolidation and the agent launcher are genuinely good ideas, and the switch to auto-review mode was the right correction. We are watching the new Security Team's cadence through the fall before we would recommend Omarchy for a client workstation fleet, and we would want to see the 4.0.0 class of issues stay fixed across a few more releases first.
Two of our guides feed directly into either choice: our Nerd Fonts guide includes the NixOS and Arch install paths that both desktops need for their default terminals, and our Ghostty setup guide covers the terminal we run under Hyprland on both.
FAQ
Is Omarchy Quattro the same as Omarchy 4?
Yes. Quattro is the official name of Omarchy 4.0.0, released August 14, 2026. The GitHub release is titled The Quattro Release, the work is tracked by pull request 6231, titled Omarchy Quattro, which remains open, and the repository's default branch was switched to quattro. A 4.0.1 security release followed on August 25, 2026.
Is NixOS harder to learn than Omarchy?
Yes, and by a wide margin at the start. Omarchy asks you to learn Arch conventions and Hyprland configuration. NixOS asks you to learn the Nix language and its module system before you can change much of anything. Home Manager's own documentation says you should be comfortable with Nix before adopting it. The payoff is a system you can reproduce and roll back with certainty.
Can I run Hyprland on NixOS the way Omarchy does?
You can run the same compositor. programs.hyprland.enable = true; enables Hyprland with its portal, polkit, and graphics drivers, and nixpkgs unstable carries the same Hyprland 0.56 line Quattro targets. You will not get Omarchy's Quickshell desktop, themes, or menus unless you build them or use the community omarchy-nix port.
Which one is more secure?
Omarchy has strong defaults: mandatory LUKS, a deny-by-default firewall, SSH off, FIDO2 for sudo. It also shipped 4.0.0 with several code-execution issues that 4.0.1 fixed eleven days later, and its security process is new. NixOS has structural advantages in reproducibility, SBOM generation, and a mature security tracker, but hands you a plainer system to harden yourself. Neither has a CIS Benchmark or FIPS-validated cryptography, so neither belongs on a CUI-handling endpoint in a CMMC Level 2 scope.
Does Omarchy Quattro require turning off Secure Boot?
Yes. The getting-started manual states you must turn off Secure Boot and/or TPM in firmware to install. Community guides document re-enabling Secure Boot afterward with a Limine unified kernel image and sbctl, but that is not part of the supported install path.
How does rollback compare?
Omarchy uses btrfs snapshots selectable from the Limine boot loader, which restore the root filesystem but not /home, and only on Limine-based installs. NixOS creates a bootable generation on every rebuild, lists them all in the boot menu, and offers nixos-rebuild switch --rollback as a command. Both work; the NixOS model makes rollback a property of every change.
Can I use Omarchy or NixOS for a CMMC enclave workstation?
Not for the endpoints that store, process, or transmit CUI, because neither distribution offers FIPS 140 validated cryptographic modules, which SC.L2-3.13.11 requires. Both are reasonable choices for developer and build systems outside the CUI boundary, and NixOS's reproducibility and SBOM tooling are useful evidence for supply chain controls. Our CMMC compliance team can help you draw that boundary correctly.
Is flakes support in NixOS stable enough to depend on?
Flakes remain an experimental feature on paper, with RFC 0136 outlining an incremental stabilization path and no firm date. In practice, Determinate Systems and a large part of the community have used flakes in production for years and argue the flag should have been removed long ago. We use flakes for every host we manage.
Need Help Standardizing Linux Workstations?
Whether you are picking a desktop for a developer team, building a NixOS fleet from a shared flake, or deciding which Linux endpoints can sit inside a regulated boundary, Petronella Technology Group, Inc. has done it on our own hardware first. We design private AI workstations, harden Linux endpoints, and map every one of them to the framework you are assessed against. Start with our private AI services or talk to our engineering team about a workstation standard that will survive an audit.
Sources and Further Reading
- Omarchy v4.0.0, The Quattro Release, release notes
- Omarchy v4.0.1 security release notes
- The Omarchy Manual, including the getting started, updates, system snapshots, security, and unattended installs chapters
- Omarchy Manual, AI chapter
- Omacom Foundation launch announcement
- Dell: Omarchy on XPS
- DHH: All in on Omarchy at 37signals
- The Register: Omarchy distro gains serious backing
- Merchants of Insecurity
- NixOS 26.05 Yarara release announcement
- NixOS Manual, installation and rollback sections
- NixOS Wiki: Flakes and Determinate Systems: Experimental does not mean unstable
- Hyprland on NixOS and NixOS Wiki: NVIDIA
- Repology repository statistics
- Malka et al., reproducibility of nixpkgs (arXiv 2501.15919) and NixOS minimal ISO reproducibility report
- sbomnix
- nixpkgs issue 324013: FIPS module support for OpenSSL 3
- CIS Benchmarks list
Free, practical, and specific to regulated environments. We will email it to you.
No spam. Unsubscribe anytime.
