diff --git a/life-church/playbooks/thinkcenter-xrdp.yml b/life-church/playbooks/thinkcenter-xrdp.yml
index 827d2db..91ff008 100644
--- a/life-church/playbooks/thinkcenter-xrdp.yml
+++ b/life-church/playbooks/thinkcenter-xrdp.yml
@@ -111,17 +111,27 @@
 
     # Cinnamon uses D-Bus/PolicyKit; the common xrdp fix is a polkit rule so the
     # RDP session isn't blocked on colord authentication prompts.
+    # Modern polkit (>=0.106, Mint 22.3 = polkit 124) uses JS rules in
+    # /etc/polkit-1/rules.d/ — the old /etc/polkit-1/localauthority/*.pkla layout
+    # no longer exists on this host.
+    - name: "[polkit] Ensure rules.d directory exists"
+      ansible.builtin.file:
+        path: /etc/polkit-1/rules.d
+        state: directory
+        mode: "0750"
+
     - name: "[polkit] Allow colord actions in xrdp sessions (avoids auth popup loop)"
       ansible.builtin.copy:
-        dest: /etc/polkit-1/localauthority/50-local.d/45-allow-colord.pkla
+        dest: /etc/polkit-1/rules.d/45-allow-colord.rules
         mode: "0644"
         content: |
-          [Allow Colord all Users]
-          Identity=unix-user:*
-          Action=org.freedesktop.color-manager.create-device;org.freedesktop.color-manager.create-profile;org.freedesktop.color-manager.delete-device;org.freedesktop.color-manager.delete-profile;org.freedesktop.color-manager.modify-device;org.freedesktop.color-manager.modify-profile
-          ResultAny=no
-          ResultInactive=no
-          ResultActive=yes
+          // Allow any user to manage color-manager devices/profiles.
+          // Prevents the colord authentication popup loop in xrdp/Cinnamon sessions.
+          polkit.addRule(function(action, subject) {
+              if (action.id.indexOf("org.freedesktop.color-manager.") === 0) {
+                  return polkit.Result.YES;
+              }
+          });
       register: polkit_rule
 
     - name: "[services] Enable + start xrdp and xrdp-sesman"