Hi, I use Qubes on a laptop, and I'm very fond of using an external mouse, and sometimes even an external keyboard. I wasn't very happy with the security issues related to mouse/keyboard being routed via usb qube, so I looked for another way: add an extra USB controller inside my laptop and keep that controller assigned to dom0. I thought it might be worth sharing.. The trick is to have a free ngff / nvme slot in the laptop. For me it was a spare slot for an ssd. It might also work with a slot for wifi cards, but with slightly different hardware. Basically, what is needed is an nvme to USB card. This plugs into an M2 slot and provides USB ports. This can be found easily on the web, cost is around 10 euros. The one I use has a 19 pin usb3 header and an extra power header. To make it fit in the laptop, some trimming is required: cut the power header (not used anyway), cut the usb header if needed. Next step is to solder a USB cable on the header (4 pins per port, up to 2 ports usable). This requires some care, but is doable with basic soldering skills. USB header pinout is one search engine's query away. Then you get 2 new USB ports inside the laptop, on a brand new usb controller. Plug in the mouse and/or keyboard dongles. Make everything fit in the laptop, close it. It might seem crazy, but I've been able to do this on two different laptops: a somewhat old acer aspire and a novacustom NV56. Once the hardware is in place, two things need to be checked in qubes. The PCI device list numbering may change, you might need to update devices passed to qubes. (Initially I had lost wifi connectivity due to this..). Also, make sure dom0 allows a USB controller ( check the friendly manual for details) Now, the dongles are inside the laptop, so RF range is probably not great, but in practice it's not an issue unless you want to have your mouse/keyboard several meters from the laptop... Bottom line: a brand new USB controller for dom0 use only, with no external physical access, for less than 20 euros.