diff --git a/group_vars/all.yml b/group_vars/all.yml
index 9da7488..4a3cc26 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -103,6 +103,18 @@ desktop:
     - vlc
     - xclip
 
+  # Snap packages to install.
+  # Each item can optionally set:
+  # - classic: true|false
+  # - channel: e.g. latest/stable, latest/edge, 2.0/stable, etc.
+  snaps:
+    - name: bw
+    - name: chezmoi
+      classic: true
+      # examples:
+      # - name: some-snap
+      #   channel: latest/edge
+
 # Variables from roles/development
 development_enabled: true
 development:
diff --git a/roles/desktop/defaults/main.yml b/roles/desktop/defaults/main.yml
index b16f02a..10ee3a0 100644
--- a/roles/desktop/defaults/main.yml
+++ b/roles/desktop/defaults/main.yml
@@ -13,3 +13,15 @@ desktop:
     - ubuntu-restricted-extras
     - vlc
     - xclip
+
+  # Snap packages to install.
+  # Each item can optionally set:
+  # - classic: true|false
+  # - channel: e.g. latest/stable, latest/edge, 2.0/stable, etc.
+  snaps:
+    - name: bw
+    - name: chezmoi
+      classic: true
+      # examples:
+      # - name: some-snap
+      #   channel: latest/edge
diff --git a/roles/desktop/tasks/main.yml b/roles/desktop/tasks/main.yml
index 9b30820..7912b09 100644
--- a/roles/desktop/tasks/main.yml
+++ b/roles/desktop/tasks/main.yml
@@ -14,3 +14,14 @@
     state: present
     update_cache: true
     cache_valid_time: "{{ apt_cache_time | default(3600) }}"
+
+- name: Install desktop snap packages
+  become: true
+  community.general.snap:
+    name: "{{ item.name }}"
+    state: present
+    classic: "{{ item.classic | default(false) }}"
+    channel: "{{ item.channel | default(omit) }}"
+  loop: "{{ desktop.snaps | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
diff --git a/roles/hadolint/tasks/main.yml b/roles/hadolint/tasks/main.yml
index aaa38f4..bc63cdd 100644
--- a/roles/hadolint/tasks/main.yml
+++ b/roles/hadolint/tasks/main.yml
@@ -78,7 +78,7 @@
 # Prefer checksum from API digest (e.g., 'sha256:<hex>')
 - name: "Hadolint | Compute SHA256 from API digest if available"
   ansible.builtin.set_fact:
-    _sha256: "{{ (_bin_asset.digest | default('') ).split(':') | last }}"
+    _sha256: "{{ (_bin_asset.digest | default('')).split(':') | last }}"
   when: _bin_asset.digest is defined and (_bin_asset.digest | length > 0)
 
 # Fallback to fetching .sha256 file
diff --git a/roles/kvm/tasks/passthrough.yml b/roles/kvm/tasks/passthrough.yml
index aba9c14..945a0e5 100644
--- a/roles/kvm/tasks/passthrough.yml
+++ b/roles/kvm/tasks/passthrough.yml
@@ -41,16 +41,7 @@
       {%- endif %}
 
     pci_ids: "{{ vga_id + (',' + audio_id if audio_id | length > 0 else '') }}" # string
-    vendor: >-
-      {% if 'NVIDIA' in vga_line or 'Nvidia' in vga_line -%}
-      nvidia
-      {%- elif 'Intel' in vga_line -%}
-      intel
-      {%- elif 'AMD' in vga_line or 'Advanced' in vga_line -%}
-      amd
-      {%- else -%}
-      unknown
-      {%- endif %}
+    vendor: "{% if 'NVIDIA' in vga_line or 'Nvidia' in vga_line -%} nvidia{%- elif 'Intel' in vga_line -%} intel{%- elif 'AMD' in vga_line or 'Advanced' in vga_line -%} amd{%- else -%} unknown{%- endif %}"
 
     new_entry: ["{{ group_id }}", "{{ vendor }}", "{{ pci_ids }}"] # [string*3]