diff --git a/lib/session.sh b/lib/session.sh
index 72d6e60..610d4d6 100644
--- a/lib/session.sh
+++ b/lib/session.sh
@@ -85,7 +85,21 @@ install_session_prereqs() {
     install_packages \
         xdg-desktop-portal \
         polkit \
+        polkit-gnome \
         pipewire \
         pipewire-pulseaudio \
         wireplumber
+
+    # A bare compositor (niri, MangoWC, Hyprland) has NO polkit agent: without
+    # one, anything needing privilege elevation (virt-manager's libvirt access,
+    # disks, network settings) fails with "no polkit agent available to
+    # authenticate". Autostart it for every graphical session via the XDG
+    # autostart dir the session runs.
+    local autostart="${XDG_AUTOSTART_DIR:-/etc/xdg/autostart}"
+    local desktop_src="${POLKIT_AGENT_DESKTOP:-/usr/share/applications/polkit-gnome-authentication-agent-1.desktop}"
+    if [[ -f "$desktop_src" ]] && [[ ! -e "$autostart/$(basename "$desktop_src")" ]]; then
+        info "Enabling polkit agent for compositor sessions..."
+        sudo mkdir -p "$autostart"
+        sudo ln -sf "$desktop_src" "$autostart/$(basename "$desktop_src")"
+    fi
 }
diff --git a/modules/twm/niri.sh b/modules/twm/niri.sh
index 5917489..35adbba 100755
--- a/modules/twm/niri.sh
+++ b/modules/twm/niri.sh
@@ -28,4 +28,14 @@ install_nerd_font JetBrainsMono
 install_packages sddm
 switch_display_manager sddm
 
+# virt-manager/qemu:///system without password prompts: libvirt group +
+# enabled daemon. Group membership applies to NEW sessions (re-login).
+install_optional qemu-kvm libvirt virt-install virt-manager virt-viewer
+if pkg_installed libvirt; then
+    info "Enabling libvirtd and adding $USER to the libvirt group..."
+    sudo systemctl enable --now libvirtd 2>/dev/null || true
+    sudo usermod -aG libvirt "$USER" || true
+    info "Group membership applies after re-login."
+fi
+
 ok "Niri setup complete. Log out and pick Niri in SDDM."