diff --git a/.gear/doskast.spec b/.gear/doskast.spec
index 11f5949..4dd907f 100644
--- a/.gear/doskast.spec
+++ b/.gear/doskast.spec
@@ -1,3 +1,5 @@
+%define _unpackaged_files_terminate_build 1
+
 Summary: Cast screen
 Name: doskast
 License: GPL-3.0
@@ -29,7 +31,7 @@ Requires(pre): apache2-base
 %files board
 /var/www/cgi-bin/doskast-trigger-connect.cgi
 %{_bindir}/doskast-server-watcher
-/etc/xdg/autostart/doskast-server-watcher.desktop
+%{_sysconfdir}/xdg/autostart/doskast-server-watcher.desktop
 %attr(0775,root,apache2) /var/spool/doskast
 
 #--------------------------------------------------------------
@@ -47,17 +49,22 @@ Requires: %{_bindir}/pkexec
 
 %files student
 %{_bindir}/doskast-student-config
+%{_bindir}/doskast-xpra-shadow
 %{_sbindir}/doskast-student-config
-%{_unitdir}/doskast-student.service
+%{_unitdir}/doskast-xpra-shadow.service
+%{_unitdir}/doskast-xpra-shadow.socket
+%{_datadir}/applications/doskast-student-config.desktop
 %{_datadir}/polkit-1/actions/ru.mos.doskast-student-config.policy
-%config(noreplace) %{_sysconfdir}/systemd/system/doskast-student.service.d/doskast-student-firewall.conf
+%{_sysconfdir}/xdg/autostart/doskast-xpra-shadow.desktop
+%config(noreplace) %{_sysconfdir}/systemd/system/doskast-xpra-shadow.service.d/xpra-shadow-firewall.conf
 %config(noreplace) %{_sysconfdir}/doskastrc
 
 %post student
-%post_service doskast-student.service
+%post_service doskast-xpra-shadow.socket
 
 %preun student
-%preun_service doskast-student.service
+%preun_service doskast-xpra-shadow.service
+%preun_service doskast-xpra-shadow.socket
 
 #--------------------------------------------------------------
 
@@ -67,6 +74,7 @@ Requires: %{_bindir}/pkexec
 %build
 %install
 desktop-file-validate *.desktop
+desktop-file-validate xpra-shadow/*.desktop
 %makeinstall_std
 
 mkdir -p %{buildroot}/var/spool/doskast
diff --git a/Makefile b/Makefile
index 0aade25..7fb2e6f 100644
--- a/Makefile
+++ b/Makefile
@@ -14,21 +14,26 @@ install:
 	install -m0755 doskast-trigger-connect.cgi $(DESTDIR)$(CGI_DIR)
 
 	mkdir -p --mode=0755 $(DESTDIR)$(UNITDIR)
-	install -m0644 doskast-student.service $(DESTDIR)$(UNITDIR)
+	install -m0644 xpra-shadow/doskast-xpra-shadow.socket $(DESTDIR)$(UNITDIR)
+	install -m0644 xpra-shadow/doskast-xpra-shadow.service $(DESTDIR)$(UNITDIR)
 
-	mkdir -p --mode=0755 $(DESTDIR)/etc/systemd/system/doskast-student.service.d
-	install -m0644 doskast-student-firewall.conf $(DESTDIR)/etc/systemd/system/doskast-student.service.d
+	mkdir -p --mode=0755 $(DESTDIR)/etc/systemd/system/doskast-xpra-shadow.service.d
+	install -m0644 xpra-shadow/xpra-shadow-firewall.conf $(DESTDIR)/etc/systemd/system/doskast-xpra-shadow.service.d
 
 	mkdir -p --mode=0755 $(DESTDIR)$(BINDIR)
 	mkdir -p --mode=0755 $(DESTDIR)$(SBINDIR)
 	install -m0755 doskast-server-watcher.sh $(DESTDIR)$(BINDIR)/doskast-server-watcher
-	install -m0755 doskast-student-config.sh $(DESTDIR)$(SBINDIR)/doskast-student-config
+	install -m0755 student-config/doskast-student-config.sh $(DESTDIR)$(SBINDIR)/doskast-student-config
 	echo -e '#!/bin/sh\npkexec $(SBINDIR)/doskast-student-config "$$@"' > $(DESTDIR)$(BINDIR)/doskast-student-config
 	chmod 0755 $(DESTDIR)$(BINDIR)/doskast-student-config
+	install -m0755 xpra-shadow/doskast-xpra-shadow.sh $(DESTDIR)$(BINDIR)/doskast-xpra-shadow
 
 	mkdir -p --mode=0755 $(DESTDIR)$(SYSCONFDIR)/xdg/autostart
 	install -m0644 doskast-server-watcher.desktop $(DESTDIR)$(SYSCONFDIR)/xdg/autostart
+	install -m0644 xpra-shadow/doskast-xpra-shadow.desktop $(DESTDIR)$(SYSCONFDIR)/xdg/autostart
 
 	mkdir -p --mode=0755 $(DESTDIR)$(DATADIR)/polkit-1/actions
-	install -m0644 ru.mos.doskast-student-config.policy $(DESTDIR)$(DATADIR)/polkit-1/actions
+	install -m0644 student-config/ru.mos.doskast-student-config.policy $(DESTDIR)$(DATADIR)/polkit-1/actions
 
+	mkdir -p --mode=0755 $(DESTDIR)$(DATADIR)/applications
+	install -m0644 student-config/doskast-student-config.desktop $(DESTDIR)$(DATADIR)/applications
diff --git a/doskast-student.service b/doskast-student.service
deleted file mode 100644
index e7c0596..0000000
--- a/doskast-student.service
+++ /dev/null
@@ -1,21 +0,0 @@
-[Unit]
-Description=Xpra Socket on Student's computer (server)
-After=network.target
-
-[Service]
-Type=simple
-ExecStart=/usr/bin/xpra \
-	--bind-tcp=0.0.0.0:4648 \
-	--pidfile=/run/xpra/proxy/server.pid \
-	--daemon=no \
-	shadow
-#rely on SIGKILL which returns 128+15=143
-SuccessExitStatus=0 143
-Restart=always
-PIDFile=/run/xpra/proxy/server.pid
-ProtectKernelTunables=true
-ProtectControlGroups=true
-
-[Install]
-WantedBy=multi-user.target
-# based on xpra.service from upstream of xpra
diff --git a/student-config/doskast-student-config.desktop b/student-config/doskast-student-config.desktop
new file mode 100755
index 0000000..5c93e24
--- /dev/null
+++ b/student-config/doskast-student-config.desktop
@@ -0,0 +1,11 @@
+[Desktop Entry]
+Name=Doskast Settings
+Name[ru]=Настройка Doskast
+Comment=Setup Doskast on student's computer
+Comment[ru]=Настройка Doskast у ученика
+Exec=doskast-student-config
+# TODO: a better icon
+Icon=document-page-setup
+Type=Application
+Terminal=false
+Categories=Settings;
diff --git a/doskast-student-config.sh b/student-config/doskast-student-config.sh
similarity index 95%
rename from doskast-student-config.sh
rename to student-config/doskast-student-config.sh
index 64ff595..aeaad65 100755
--- a/doskast-student-config.sh
+++ b/student-config/doskast-student-config.sh
@@ -29,7 +29,7 @@ _create_config(){
 # $1: IP
 _write_systemd_config(){
 	mkdir -p /etc/systemd/system/doskast-student.service.d
-	cat > /etc/systemd/system/doskast-student.service.d/doskast-student-firewall.conf << EOF
+	cat > /etc/systemd/system/doskast-xpra-shadow.service.d/xpra-shadow-firewall.conf << EOF
 [Service]
 IPAddressDeny=any
 # IP-адрес доски
diff --git a/ru.mos.doskast-student-config.policy b/student-config/ru.mos.doskast-student-config.policy
similarity index 100%
rename from ru.mos.doskast-student-config.policy
rename to student-config/ru.mos.doskast-student-config.policy
diff --git a/xpra-shadow/doskast-xpra-shadow.desktop b/xpra-shadow/doskast-xpra-shadow.desktop
new file mode 100644
index 0000000..830299b
--- /dev/null
+++ b/xpra-shadow/doskast-xpra-shadow.desktop
@@ -0,0 +1,4 @@
+[Desktop Entry]
+Name=Doskast shadow
+Type=Application
+Exec=doskast-xpra-shadow
diff --git a/xpra-shadow/doskast-xpra-shadow.service b/xpra-shadow/doskast-xpra-shadow.service
new file mode 100644
index 0000000..4106dcd
--- /dev/null
+++ b/xpra-shadow/doskast-xpra-shadow.service
@@ -0,0 +1,8 @@
+[Unit]
+Requires=doskast-xpra-shadow.socket
+After=doskast-xpra-shadow.socket
+
+[Service]
+ExecStart=/lib/systemd/systemd-socket-proxyd /tmp/xpra-shadow.socket
+# `xpra shadow` is run inside a DE in another namespace
+PrivateNetwork=no
diff --git a/xpra-shadow/doskast-xpra-shadow.sh b/xpra-shadow/doskast-xpra-shadow.sh
new file mode 100755
index 0000000..3b34a70
--- /dev/null
+++ b/xpra-shadow/doskast-xpra-shadow.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+id="$(id -u)"
+
+if systemctl --user -q is-active xpra-shadow-"$id".scope; then
+	echo "Stopping already running XPRA shadow server"
+	systemctl stop xpra-shadow-"$id".scope
+fi
+
+xpra \
+	--bind=/tmp/xpra-shadow.socket \
+	--systemd-run=yes \
+	--systemd-run-args="--unit=xpra-shadow-${id}" \
+	--daemon=no \
+	shadow
diff --git a/xpra-shadow/doskast-xpra-shadow.socket b/xpra-shadow/doskast-xpra-shadow.socket
new file mode 100644
index 0000000..ec0b016
--- /dev/null
+++ b/xpra-shadow/doskast-xpra-shadow.socket
@@ -0,0 +1,5 @@
+[Socket]
+ListenStream=4648
+
+[Install]
+WantedBy=sockets.target
diff --git a/doskast-student-firewall.conf b/xpra-shadow/xpra-shadow-firewall.conf
similarity index 100%
rename from doskast-student-firewall.conf
rename to xpra-shadow/xpra-shadow-firewall.conf