diff --git a/netvm/dbus-nm-applet.conf b/netvm/dbus-nm-applet.conf
new file mode 100644
index 0000000..0d0f082
--- /dev/null
+++ b/netvm/dbus-nm-applet.conf
@@ -0,0 +1,42 @@
+<!DOCTYPE busconfig PUBLIC
+ "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+	<!--
+	     WARNING: if running any D-Bus version prior to 1.2.6, you may be
+	     vulnerable to information leakage via the NM D-Bus interface.
+	     Previous D-Bus versions did not deny-by-default, and this permissions
+	     config file assumes that D-Bus will deny rules by default unless
+	     explicitly over-ridden with an <allow /> tag.
+	 -->
+
+        <policy user="root">
+                <allow own="org.freedesktop.NetworkManagerUserSettings"/>
+
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.NetworkManagerSettings"/>
+
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.NetworkManagerSettings.Connection"/>
+
+                <!-- Only root can get secrets -->
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.NetworkManagerSettings.Connection.Secrets"/>
+        </policy>
+        <policy user="user">
+                <allow own="org.freedesktop.NetworkManagerUserSettings"/>
+
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.NetworkManagerSettings"/>
+
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.NetworkManagerSettings.Connection"/>
+        </policy>
+        <policy context="default">
+                <allow send_destination="org.freedesktop.NetworkManagerUserSettings"
+                       send_interface="org.freedesktop.DBus.Introspectable"/>
+        </policy>
+
+        <limit name="max_replies_per_connection">512</limit>
+</busconfig>
+
diff --git a/rpm_spec/core-appvm.spec b/rpm_spec/core-appvm.spec
index 9b97616..1a97cb5 100644
--- a/rpm_spec/core-appvm.spec
+++ b/rpm_spec/core-appvm.spec
@@ -48,17 +48,12 @@ The Qubes core files for installation inside a Qubes AppVM.
 
 %pre
 
-# Remove password for root, so PolicyKit will not ask for it
-usermod -p '' root
-
 if [ "$1" !=  1 ] ; then
-# remove user password if this is upgrade
-usermod -p '' user
 # do this whole %pre thing only when updating for the first time...
 exit 0
 fi
 
-adduser -p '' --create-home user
+adduser --create-home user
 su user -c 'mkdir -p /home/user/.gnome2/nautilus-scripts'
 su user -c 'ln -s /usr/lib/qubes/qvm-copy-to-vm2.gnome /home/user/.gnome2/nautilus-scripts/"Copy to other AppVM"'
 su user -c 'ln -s /usr/bin/qvm-open-in-dvm2 /home/user/.gnome2/nautilus-scripts/"Open in DisposableVM"'
diff --git a/rpm_spec/core-commonvm.spec b/rpm_spec/core-commonvm.spec
index 97b1c8e..0da0f39 100644
--- a/rpm_spec/core-commonvm.spec
+++ b/rpm_spec/core-commonvm.spec
@@ -80,6 +80,9 @@ cp /var/lib/qubes/serial.conf /etc/init/serial.conf
 
 %post
 
+# Disable gpk-update-icon
+sed 's/^NotShowIn=KDE;$/\0QUBES;/' -i /etc/xdg/autostart/gpk-update-icon.desktop
+
 if [ "$1" !=  1 ] ; then
 # do this whole %post thing only when updating for the first time...
 exit 0
diff --git a/rpm_spec/core-netvm.spec b/rpm_spec/core-netvm.spec
index a4c966b..07200b4 100644
--- a/rpm_spec/core-netvm.spec
+++ b/rpm_spec/core-netvm.spec
@@ -66,6 +66,9 @@ mkdir -p $RPM_BUILD_ROOT/var/run/qubes
 mkdir -p $RPM_BUILD_ROOT/etc/xen/scripts
 cp ../common/vif-route-qubes $RPM_BUILD_ROOT/etc/xen/scripts
 
+mkdir -p $RPM_BUILD_ROOT/etc/dbus-1/system.d
+cp ../netvm/dbus-nm-applet.conf $RPM_BUILD_ROOT/etc/dbus-1/system.d/qubes-nm-applet.conf
+
 %post
 
 # Create NetworkManager configuration if we do not have it
@@ -88,6 +91,11 @@ if [ "$1" = 0 ] ; then
     chkconfig qubes_core_netvm off
 fi
 
+%triggerin -- NetworkManager
+# Fix PolicyKit settings to allow run as normal user not visible to ConsoleKit
+sed 's#<defaults>$#\0<allow_any>yes</allow_any>#' -i /usr/share/polkit-1/actions/org.freedesktop.NetworkManager.policy
+
+
 %clean
 rm -rf $RPM_BUILD_ROOT
 
@@ -100,3 +108,4 @@ rm -rf $RPM_BUILD_ROOT
 /etc/NetworkManager/dispatcher.d/qubes_nmhook
 /etc/NetworkManager/dispatcher.d/30-qubes_external_ip
 /etc/xen/scripts/vif-route-qubes
+/etc/dbus-1/system.d/qubes-nm-applet.conf