diff --git a/nixos/linux.nix b/nixos/linux.nix
index 051db92..76e5284 100644
--- a/nixos/linux.nix
+++ b/nixos/linux.nix
@@ -208,9 +208,11 @@ in {
     defaultNetwork.settings.dns_enabled = true;
   };
 
-  # KDE Plasma spawns many threads; raise the default container pids limit (2048) to
-  # avoid "Thread creation error: Resource temporarily unavailable" in the VNC container.
-  virtualisation.containers.containersConf.settings.containers.pids_limit = 8192;
+  # KDE Plasma spawns many threads (and obexd loops without Bluetooth hardware).
+  # The libpod scope for each container inherits systemd's DefaultTasksMax (~9286);
+  # raise machine.slice to infinity so podman scopes aren't capped.
+  systemd.slices.machine.sliceConfig.TasksMax = "infinity";
+  virtualisation.containers.containersConf.settings.containers.pids_limit = 0;
 
   virtualisation.oci-containers = {
     backend = "podman";
diff --git a/nixos/vnc-desktop/Dockerfile b/nixos/vnc-desktop/Dockerfile
index 380ae2e..bdd9b5a 100644
--- a/nixos/vnc-desktop/Dockerfile
+++ b/nixos/vnc-desktop/Dockerfile
@@ -15,6 +15,12 @@ RUN apt-get update && apt-get install -y \
     openssh-client \
     && rm -rf /var/lib/apt/lists/*
 
+# Remove Bluetooth stack — obexd gets activated in a tight loop by kded5
+# inside the container (no BT hardware), which exhausts the process limit.
+RUN apt-get purge -y --auto-remove bluez bluez-obexd 2>/dev/null || true; \
+    rm -f /usr/share/dbus-1/services/org.bluez.obex.service \
+          /usr/share/dbus-1/system-services/org.bluez.service
+
 COPY start.sh /start.sh
 RUN chmod +x /start.sh