diff --git a/hm/desktop/frobar/frobar/common.py b/hm/desktop/frobar/frobar/common.py
index a7fa66e..d4f0b05 100644
--- a/hm/desktop/frobar/frobar/common.py
+++ b/hm/desktop/frobar/frobar/common.py
@@ -375,12 +375,18 @@ class Screen(ComposableText):
                     markup = self.get_markup()
                     # sys.stdout.write(markup)  # DEBUG
                     proc.stdin.write(markup.encode())
+                    try:
+                        await proc.stdin.drain()
+                    except BrokenPipeError:
+                        log.error("zelbar: broken pipe, killing")
+                        proc.kill()
+                        return
                     await self.refresh.wait()
                     self.refresh.clear()
 
             async def action_handler(proc: asyncio.subprocess.Process) -> None:
                 assert proc.stdout
-                while proc.returncode is None:
+                while not proc.stdout.at_eof():
                     line = await proc.stdout.readline()
                     try:
                         command = line.decode().strip()
@@ -393,6 +399,8 @@ class Screen(ComposableText):
                         log.error("Unknown command: %s", command)
                         continue
                     callback()
+                log.error("zelbar: EOF reached, killing")
+                proc.kill()
 
             refresher_task = self.bar.add_long_running_task(refresher(proc))
             action_handler_task = self.bar.add_long_running_task(action_handler(proc))
diff --git a/os/desktop/default.nix b/os/desktop/default.nix
index 931fa82..7c7ae5d 100644
--- a/os/desktop/default.nix
+++ b/os/desktop/default.nix
@@ -8,6 +8,9 @@
   config = lib.mkIf config.frogeye.desktop.xorg {
     boot.kernelModules = [ "i2c-dev" ]; # Allows using ddcutil
     programs.sway.enable = true;
+    security.pam.services.swaylock.enable = true; # Let HM handle this
+    # Otherwise the screen is locked twice, the second one with screen off
+    # TODO Can we maybe use this instead?
     security.rtkit.enable = true; # Recommended for pipewire
     services = {
       blueman.enable = true;