diff --git a/falco/rules/tune-noise.yaml b/falco/rules/tune-noise.yaml
index 4dc31e8..7770a31 100644
--- a/falco/rules/tune-noise.yaml
+++ b/falco/rules/tune-noise.yaml
@@ -5,20 +5,47 @@
 # else. Add entries here as new noisy defaults turn up - don't let this list
 # grow into blinding Falco to anything actually meaningful.
 
-# "Sensitive file opened for reading by non-trusted program" fired every
-# ~10s from inbox-zero-db's pg_isready healthcheck touching /etc/shadow -
-# NSS/libc user-lookup behavior during process init, not credential
-# harvesting. Scoped to just this binary, not a blanket rule disable.
+# "Sensitive file opened for reading by non-trusted program" false-positives:
+# - pg_isready: fired every ~10s from inbox-zero-db's healthcheck touching
+#   /etc/shadow - NSS/libc user-lookup behavior during process init, not
+#   credential harvesting.
+# - lscr.io/linuxserver/obsidian: fires once per container start from
+#   `sed -i s/CORRUPT_FILE/NOPASSWD/g /etc/sudoers` - linuxserver.io's
+#   own s6-init NOPASSWD setup, same class of init-time file touch.
 - macro: user_known_read_sensitive_files_activities
-  condition: (proc.name = pg_isready)
+  condition: >
+    (proc.name = pg_isready)
+    or (container.image.repository = "lscr.io/linuxserver/obsidian" and proc.name = sed)
 
-# "Drop and execute new binary in container" fires on every git push/pull
-# to gitea over SSH - gitea's own binary re-executes itself for git-shell
-# commands (serv/hook/pre-receive/post-receive), which looks identical to
-# drift-detection's "new binary written to the writable layer" pattern.
-# Scoped to proc.name=gitea specifically (not the whole container via
-# known_drop_and_execute_containers) so this container - the one that was
-# actually compromised - still gets checked for any OTHER unexpected
-# binary, just not its own expected self-invocation.
+# "Fileless execution via memfd_create" fires from nvidia-ctk's
+# ldconfig-refresh hook, which runs via memfd_create by design every time
+# an NVIDIA-GPU container (e.g. ollama) starts - normal container-toolkit
+# behavior, not defense evasion. Scoped to the hook's own parent process
+# names rather than the ollama/ollama image, so drift detection stays live
+# for anything else that image does.
+- macro: known_memfd_execution_processes
+  condition: (proc.pname in (nvidia-containe, nvidia-ctk))
+
+# "Drop and execute new binary in container" (output text: "Executing binary
+# not part of base image") false-positives on three known-benign sources,
+# all confirmed via docker logs falco (2026-08-08 to 2026-08-16):
+# - gitea: re-executes itself for git-shell commands (serv/hook/pre-receive/
+#   post-receive) over SSH, which looks identical to a dropped binary.
+#   Scoped to proc.name=gitea, not the whole container, so this
+#   previously-compromised container still gets checked for any OTHER
+#   unexpected binary.
+# - lscr.io/linuxserver/obsidian: Electron's normal /proc/self/exe
+#   self-re-exec pattern (zygote/renderer/utility processes), fires ~6x
+#   every time the container is recreated (~daily, likely watchtower).
+#   Scoped to the whole image since this is normal Electron startup
+#   behavior end to end, not one specific binary.
+# - tsl0922/ttyd (Synchronet BBS web terminal): telnet/pv/busybox-extras
+#   installed via apk at container start and then used for the BBS's
+#   normal telnet workflow. Scoped to those three binaries, not the image,
+#   since this is a shell-access container where an unexpected binary is
+#   more worth knowing about.
 - macro: known_drop_and_execute_activities
-  condition: (container.image.repository = "docker.gitea.com/gitea" and proc.name = gitea)
+  condition: >
+    (container.image.repository = "docker.gitea.com/gitea" and proc.name = gitea)
+    or (container.image.repository = "lscr.io/linuxserver/obsidian")
+    or (container.image.repository = "tsl0922/ttyd" and proc.name in (telnet, pv, busybox-extras))
diff --git a/netdata/health.d/swap.conf b/netdata/health.d/swap.conf
new file mode 100644
index 0000000..1269a7f
--- /dev/null
+++ b/netdata/health.d/swap.conf
@@ -0,0 +1,24 @@
+# Override of netdata's stock used_swap alarm (health.d/swap.conf). The
+# stock template recalculates $used/$free from the *instantaneous* raw
+# sample every 10s with only a 30s notification debounce, so a swap spike
+# lasting a couple of minutes was enough to page. Only the delay line
+# changes here (up 30s -> up 5m) - the rest is copied verbatim from the
+# stock template since netdata health.d overrides replace the whole
+# template, not just one line. This requires sustained swap pressure
+# (5+ continuous minutes above threshold) before notifying, instead of
+# firing on every brief spike.
+   template: used_swap
+         on: mem.swap
+      class: Utilization
+       type: System
+  component: Memory
+host labels: _os=linux freebsd
+       calc: (($used + $free) > 0) ? ($used * 100 / ($used + $free)) : 0
+      units: %
+      every: 10s
+       warn: $this > (($status >= $WARNING)  ? (80) : (90))
+       crit: $this > (($status == $CRITICAL) ? (90) : (98))
+      delay: up 5m down 15m multiplier 1.5 max 1h
+    summary: System swap memory utilization
+       info: Swap memory utilization
+         to: sysadmin