diff --git a/.gemini/config.yaml b/.gemini/config.yaml
deleted file mode 100644
index 919f45a..0000000
--- a/.gemini/config.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-have_fun: true
-memory_config:
-  disabled: true
-code_review:
-  disable: false
-  comment_severity_threshold: HIGH
-  max_review_comments: -1
-  pull_request_opened:
-    help: false
-    summary: false
-    code_review: true
-    include_drafts: true
-ignore_patterns: []
diff --git a/.gemini/style-guide.md b/.gemini/style-guide.md
deleted file mode 100644
index 15f7184..0000000
--- a/.gemini/style-guide.md
+++ /dev/null
@@ -1,375 +0,0 @@
-# Aurora-Common Style Guide
-
-This document defines the coding and configuration standards for the aurora-common repository.
-
-## Repository Overview
-
-Aurora-common is a minimal OCI layer containing shared configuration files for Aurora and Aurora-DX variants. It builds on top of projectbluefin/common and contains no compiled code—only configuration files, shell scripts, and Just recipes.
-
-## File Organization
-
-### Directory Structure Standards
-
-**Always maintain the two-tier structure:**
-- `system_files/shared/` - Configuration shared between Aurora and Aurora-DX
-- `system_files/dx/` - Aurora-DX specific configurations (developer experience tools)
-
-**Placement rules:**
-- DX/developer-specific files → `system_files/dx/`
-- Reusable system configurations → `system_files/shared/`
-- When in doubt, prefer `shared/` unless it requires DX-specific functionality
-
-**Preserve target system paths:**
-Files must mirror their final destination paths:
-```
-system_files/shared/usr/share/ublue-os/just/example.just
-system_files/dx/etc/profile.d/dx-env.sh
-```
-
-## Shell Scripts (.sh)
-
-### Shebang
-Use `#!/usr/bin/bash` or `#!/usr/bin/env bash` consistently.
-
-### Style
-- Use lowercase for local variables: `local_var="value"`
-- Use UPPERCASE for environment variables: `SETUP_CHECKER_FILE="${HOME}/.local/share/ublue/setup_versioning.json"`
-- Always quote variable expansions: `"${VARIABLE}"`
-- Use `[[ ]]` for conditionals, not `[ ]`
-
-### Example
-```bash
-#!/usr/bin/bash
-
-TARGET_VERSION=1
-CONFIG_FILE="${HOME}/.config/myapp.conf"
-
-if [[ -f "${CONFIG_FILE}" ]]; then
-    echo "Configuration found"
-fi
-```
-
-### Error Handling
-Include basic error checking for critical operations:
-```bash
-if [[ ! -e "${SETUP_CHECKER_FILE}" ]]; then
-    mkdir -p "$(dirname "${SETUP_CHECKER_FILE}")"
-    echo "{}" > "${SETUP_CHECKER_FILE}"
-fi
-```
-
-## Just Recipes (.just)
-
-### File Header
-Start Just files with:
-```just
-# vim: set ft=make :
-```
-
-### Recipe Naming
-- Use lowercase with hyphens: `toggle-tpm2`, `install-flatpaks`
-- Be descriptive: prefer `configure-nvidia` over `nvidia`
-
-### Recipe Groups
-Organize recipes with group annotations:
-```just
-[group('System')]
-toggle-tpm2:
-    @/usr/bin/luks-tpm2-autounlock
-```
-
-Common groups: `System`, `Apps`, `Update`, `Developer`
-
-### Recipe Documentation
-Add a brief comment above each recipe:
-```just
-# Factory reset this device (experimental)
-[group('System')]
-powerwash:
-    #!/usr/bin/bash
-    # ... implementation
-```
-
-### Inline Scripts
-For multi-line recipes, use bash shebang:
-```just
-example-recipe:
-    #!/usr/bin/bash
-    echo "Step 1"
-    echo "Step 2"
-```
-
-### Settings
-Standard settings for entry-point Just files:
-```just
-set allow-duplicate-recipes := true
-set ignore-comments := true
-```
-
-## JSON Configuration Files
-
-### Formatting
-- Use **tabs** for indentation (matching existing files)
-- Keep JSON minimal and readable
-- One property per line
-
-### Example
-```json
-{
-	"logo-directory": "/usr/share/ublue-os/aurora-logos/symbols",
-	"shuffle-logo": true
-}
-```
-
-### Validation
-All JSON files must be valid. Check with:
-```bash
-jq . < file.json
-```
-
-## YAML Configuration Files
-
-### Formatting
-- Use **2 spaces** for indentation
-- Use kebab-case for keys: `yaml-blocklist-paths`
-- Keep files focused on a single configuration purpose
-
-### Example
-```yaml
-yaml-blocklist-paths:
-  - /run/host/etc/bazaar/blocklist.yaml
-
-curated-config-paths:
-  - /run/host/etc/bazaar/curated.yaml
-```
-
-## Containerfile
-
-### Style
-- Use explicit tags for base images: `FROM docker.io/library/alpine:latest`
-- Use uppercase for Dockerfile instructions: `COPY`, `RUN`, `FROM`
-- Group related `RUN` commands with `&&` for layer efficiency
-- Add line continuations for readability with `\`
-
-### Multi-stage Pattern
-```dockerfile
-FROM docker.io/library/alpine:latest AS build
-RUN apk add just curl
-
-# Processing steps...
-RUN install -d /out/shared/usr/share && \
-  just --completions bash > /out/shared/usr/share/bash-completion/completions/ujust
-
-FROM scratch AS ctx
-COPY /system_files/shared /system_files/shared
-COPY /system_files/dx /system_files/dx
-COPY --from=build /out/shared /system_files/shared
-```
-
-### Comments
-Add comments for non-obvious operations:
-```dockerfile
-# artwork repo points to ~/.local/share for metadata
-RUN sed -i 's|~/\.local/share|/usr/share|' /out/shared/usr/share/backgrounds/aurora/*.xml
-```
-
-## Homebrew Brewfiles
-
-### Naming Convention
-- Use lowercase with hyphens: `system-flatpaks.Brewfile`
-- Be descriptive: `full-desktop.Brewfile`, `ai-tools.Brewfile`
-
-### Format
-One application per line, grouped by type with comments:
-```ruby
-# Core Applications
-cask "firefox"
-cask "thunderbird"
-
-# Development Tools
-cask "visual-studio-code"
-```
-
-### Location
-Place Brewfiles in `system_files/shared/usr/share/ublue-os/homebrew/`
-
-## Git Commit Messages
-
-### Format
-Follow [Conventional Commits](https://www.conventionalcommits.org/):
-```
-<type>(<scope>): <description>
-
-[optional body]
-
-[optional footer(s)]
-```
-
-### Types
-- `feat:` - New feature or configuration
-- `fix:` - Bug fix
-- `docs:` - Documentation changes
-- `chore:` - Maintenance (dependencies, cleanup)
-- `refactor:` - Code restructuring
-- `ci:` - CI/CD changes
-
-### Scope
-Use meaningful scopes:
-- `just` - Just recipe changes
-- `flatpak` - Flatpak configurations
-- `firefox` - Firefox settings
-- `gnome` - GNOME/desktop settings
-- `setup` - Setup hook scripts
-- `brew` - Homebrew Brewfile changes
-- `dx` - Aurora-DX specific changes
-
-### Examples
-```
-feat(flatpak): add VSCode Wayland support override
-
-fix(just): correct path to system-flatpaks Brewfile
-
-docs(readme): update directory structure documentation
-
-chore(deps): update aurora-wallpapers to latest
-
-feat(dx): add development environment configuration
-```
-
-### AI Attribution
-AI-assisted commits must include attribution:
-```
-feat(just): add new system management recipe
-
-Assisted-by: Claude 3.5 Sonnet via GitHub Copilot
-```
-
-## Comments and Documentation
-
-### When to Comment
-- Configuration files: Explain non-obvious settings
-- Shell scripts: Document complex logic or version-based behavior
-- Just recipes: Brief description of what the recipe does
-- Containerfile: Clarify transformations or path changes
-
-### When NOT to Comment
-- Self-explanatory code
-- Simple variable assignments
-- Standard patterns
-
-### Example - Good Comments
-```bash
-# Meant to be used at the start of any setup service script
-# Will version your script accordingly on $SETUP_CHECKER_FILE
-function version-script() {
-    # ... implementation
-}
-```
-
-## File Permissions
-
-### Executable Scripts
-Scripts intended to be executed must be executable:
-```bash
-chmod +x system_files/shared/usr/bin/ublue-image-info.sh
-```
-
-### Configuration Files
-Non-executable files (JSON, YAML, text) should be 644:
-```bash
-chmod 644 system_files/shared/etc/ublue-os/fastfetch.json
-```
-
-## Testing and Validation
-
-### Local Build Testing
-Always test builds locally before pushing:
-```bash
-just build
-```
-
-### Syntax Validation
-- **Just files**: `just check`
-- **JSON files**: `find system_files -name "*.json" -exec jq . {} \;`
-- **Shell scripts**: `bash -n script.sh`
-
-### Structure Inspection
-Verify the built image structure:
-```bash
-just tree
-```
-
-## Pull Request Guidelines
-
-### PR Title
-Use conventional commit format:
-```
-feat(flatpak): add system flatpak overrides for Bazaar
-```
-
-### PR Description
-Include:
-1. What changed
-2. Why it changed
-3. Testing performed (local build, validation)
-
-### Changes
-- Keep PRs focused on a single logical change
-- Maintain existing file structure
-- Don't mix refactoring with feature changes
-
-## Naming Conventions
-
-### Files
-- **Just recipes**: lowercase with hyphens (`system.just`, `toggle-tpm2`)
-- **Shell scripts**: lowercase with hyphens (`libsetup.sh`, `ublue-image-info.sh`)
-- **Config files**: lowercase with hyphens or dots (`fastfetch.json`, `mimeapps.list`)
-- **Brewfiles**: descriptive with hyphens (`system-flatpaks.Brewfile`, `full-desktop.Brewfile`)
-
-### Variables (Shell)
-- Local: `lowercase_with_underscores`
-- Environment: `UPPERCASE_WITH_UNDERSCORES`
-- Consistent naming: `TARGET_VERSION`, `SETUP_CHECKER_FILE`
-
-### Functions (Shell)
-- Use lowercase with hyphens: `version-script`
-- Be descriptive: `check-version`, `install-flatpaks`
-
-## What NOT to Do
-
-❌ **Don't add complex build dependencies** - This repo is intentionally minimal
-❌ **Don't compile code** - This is a configuration-only layer
-❌ **Don't modify the scratch→ctx build pattern** - It's essential for the OCI layer
-❌ **Don't add linters/formatters** - Keep tooling minimal (Just, jq, bash only)
-❌ **Don't break existing directory structure** - Maintain `shared/` vs `dx/` separation
-❌ **Don't add unnecessary comments** - Comment only when clarification is needed
-
-## Editor Configuration
-
-### Vim Modelines
-Include for Just files:
-```just
-# vim: set ft=make :
-```
-
-### Recommended Settings
-- **Tabs for JSON**: 1 tab = indentation unit
-- **Spaces for YAML**: 2 spaces per level
-- **Shell scripts**: 2 or 4 space indentation (be consistent within file)
-- **Just recipes**: 4 space indentation
-
-## Consistency Principles
-
-1. **Follow existing patterns** - Look at similar files in the repo
-2. **Mirror destination paths** - Maintain the target filesystem structure
-3. **Keep it simple** - This is intentionally a minimal repository
-4. **Validate before committing** - Run local builds and syntax checks
-5. **Preserve the two-tier structure** - `shared/` vs `dx/` is fundamental
-
-## Questions?
-
-When unsure about where a file belongs or how to structure it:
-1. Check similar existing files in the repository
-2. Refer to `AGENTS.md` for detailed repository context
-3. Default to simplicity and existing patterns
-4. Ask in pull request reviews
diff --git a/.github/workflows/validate-brewfiles.yml b/.github/workflows/validate-brewfiles.yml
index f76dde6..4618f46 100644
--- a/.github/workflows/validate-brewfiles.yml
+++ b/.github/workflows/validate-brewfiles.yml
@@ -1,6 +1,6 @@
 name: Validate Brewfiles
-permissions:
-  contents: read
+
+permissions: {}
 
 on:
   pull_request:
@@ -9,58 +9,24 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - name: Set up Homebrew
-        uses: Homebrew/actions/setup-homebrew@main
+      - name: Install Just
+        run: |
+          /home/linuxbrew/.linuxbrew/bin/brew install just
+          echo "/home/linuxbrew/.linuxbrew/bin" >> $GITHUB_PATH
+
+      - name: Add Homebrew to PATH
+        run: |
+          echo "/home/linuxbrew/.linuxbrew/bin" >> $GITHUB_PATH
 
       - name: Validate Brewfiles
         shell: bash
         run: |
-          echo "Validating Brewfiles in homebrew directory..."
-
-          STATUS_FILE=$(mktemp)
-          echo "PASS" > "$STATUS_FILE"
-
-          while IFS= read -r -d '' brewfile ; do
-            echo "::group:: ===$(basename $brewfile)==="
-
-            grep -E -e "^tap" "$brewfile" > taps.Brewfile || true
-            echo "Syncing taps..."
-            brew bundle --file=./taps.Brewfile > /dev/null 2>&1 || true
-
-            # Extract combined list for parallel check
-            FORMULAS=$(grep -E '^\s*brew\s+["'\'']' "$brewfile" | sed -E 's/^\s*brew\s+["'\'']([^"'\'']+)["'\''].*/formula \1/' || true)
-            CASKS=$(grep -E '^\s*cask\s+["'\'']' "$brewfile" | sed -E 's/^\s*cask\s+["'\'']([^"'\'']+)["'\''].*/cask \1/' || true)
-
-            ENTRIES=$(printf "%s\n%s" "$FORMULAS" "$CASKS" | grep -v '^\s*$' || true)
-
-            if [ -n "$ENTRIES" ]; then
-              echo "$ENTRIES" | xargs -P 8 -I {} bash -c '
-                TYPE=$(echo "{}" | cut -d" " -f1)
-                NAME=$(echo "{}" | cut -d" " -f2)
-                if ! brew info --$TYPE "$NAME" &> /dev/null; then
-                  echo "✗ $TYPE \"$NAME\" is invalid or missing tap"
-                  echo "FAIL" >> "'"$STATUS_FILE"'"
-                else
-                  echo "✓ $TYPE \"$NAME\" is valid"
-                fi
-              '
-            else
-              echo "No formulas or casks found."
-            fi
-
-            echo "::endgroup::"
-          done < <(find "system_files/shared/usr/share/ublue-os/homebrew" -iname '*\.Brewfile*' -print0)
-
-          rm -f taps.Brewfile
-
-          if grep -q "FAIL" "$STATUS_FILE"; then
-            echo "Validation complete. Some Brewfiles FAILED."
-            exit 1
-          else
-            echo "Validation complete. All Brewfiles PASSED."
-            exit 0
-          fi
+          just brew-lint
diff --git a/.gitignore b/.gitignore
index 2de16c8..c38bc5a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 dump*
+*.raw
diff --git a/.gitmodules b/.gitmodules
index 919ee4b..2ffbd9c 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,6 +1,3 @@
 [submodule "branding"]
 	path = branding
 	url = https://github.com/get-aurora-dev/branding.git
-[submodule "aurorafin-shared"]
-	path = aurorafin-shared
-	url = https://github.com/ublue-os/aurorafin-shared.git
diff --git a/AGENTS.md b/AGENTS.md
deleted file mode 100644
index 13954d3..0000000
--- a/AGENTS.md
+++ /dev/null
@@ -1,196 +0,0 @@
-# Aurora-Common Copilot Instructions
-
-This document provides essential information for coding agents working with the aurora-common repository.
-
-## Repository Overview
-
-**Aurora-Common** is a shared OCI layer containing configuration files for Aurora and Aurora-DX variants.
-
-- **Type**: OCI container layer built on top of projectbluefin/common
-- **Purpose**: Provide Aurora-specific configuration and assets while inheriting shared Bluefin configuration
-- **Base**: Multi-stage build pulling from aurora-wallpapers, projectbluefin/common, and local files
-- **Languages**: Configuration files (JSON, shell scripts, markdown)
-- **Build System**: GitHub Actions with podman/buildah, Just for local convenience
-
-## Repository Structure
-
-### Root Directory Files
-- `Containerfile` - Multi-stage build pulling wallpapers, projectbluefin/common, and local files
-- `Justfile` - Convenience commands for building and inspecting the image
-- `cosign.pub` - Container signing public key
-- `image-versions.yml` - Version tracking for dependencies
-- `README.md` - Repository documentation
-- `.pre-commit-config.yaml` - Pre-commit hooks configuration
-
-### Key Directories
-- `system_files/` - Configuration files organized by variant
-  - `shared/` - Configuration shared between Aurora and Aurora-DX
-    - `etc/` - System-level configuration (bazaar, dconf, geoclue, profile.d, skel, systemd, ublue-os, zsh)
-    - `usr/` - User-space configuration (bin, lib, libexec, share)
-  - `dx/` - Aurora-DX specific configuration
-    - `etc/` - DX system-level configuration
-    - `usr/` - DX user-space configuration
-- `flatpaks/` - Flatpak definitions for Aurora images
-- `logos/` - Aurora branding and logo assets
-
-### GitHub Actions
-- `.github/workflows/build.yml` - Build workflow using podman/buildah
-
-## Build Instructions
-
-### Prerequisites
-- **podman** and **buildah** for building containers
-- **just** for convenience commands (optional)
-- **pre-commit** for development hooks (optional)
-
-### Build Commands
-
-**Build locally:**
-```bash
-# Using Just
-just build
-
-# Or directly with podman
-podman build -t localhost/aurora-common:latest -f ./Containerfile .
-```
-
-**Inspect the image:**
-```bash
-# View directory structure
-just tree
-
-# Dump all contents to ./dump directory
-just dump
-```
-
-**Validate Just syntax:**
-```bash
-# Check syntax
-just check
-
-# Fix formatting
-just fix
-```
-
-### Build Process
-1. Builder stage pulls aurora-wallpapers and processes them
-2. Scratch stage pulls projectbluefin/common shared files
-3. Local files (flatpaks, logos, system_files) are added
-4. Final image is pushed to `ghcr.io/ublue-os/aurora-common:latest`
-5. Aurora and Aurora-DX images reference this layer in their builds
-
-## Usage in Downstream Projects
-
-Aurora images use this layer in their Containerfiles:
-
-```dockerfile
-FROM ghcr.io/ublue-os/aurora-common:latest AS aurora-common
-
-# Copy shared configuration
-COPY --from=aurora-common /system_files/shared /
-
-# Aurora-DX also copies DX-specific configuration
-COPY --from=aurora-common /system_files/dx /
-
-# Copy wallpapers and other assets
-COPY --from=aurora-common /wallpapers /
-COPY --from=aurora-common /flatpaks /tmp/flatpaks
-COPY --from=aurora-common /logos /tmp/logos
-```
-
-## Making Changes
-
-### Modifying Configuration Files
-
-1. **Edit files in `system_files/`** - Maintain the existing directory structure
-2. **Test locally** with `just build` to ensure no syntax errors
-3. **Create PR** - GitHub Actions will build and validate
-
-### Adding New Configuration Files
-
-1. Determine if the configuration is shared or DX-specific
-2. Place files in the appropriate subdirectory:
-   - Shared configs: `system_files/shared/`
-   - DX-specific: `system_files/dx/`
-3. Follow the existing path structure (etc/ or usr/)
-4. Ensure file permissions are correct (executables for scripts)
-
-### Common Modification Patterns
-- **Shared system configs**: Edit files in `system_files/shared/etc/`
-- **Shared user configs**: Edit files in `system_files/shared/usr/`
-- **DX-specific configs**: Edit files in `system_files/dx/`
-- **Flatpak definitions**: Modify `flatpaks/` directory
-- **Branding assets**: Update `logos/` directory
-
-## Validation
-
-### Manual Validation
-```bash
-# Build locally to check for errors
-just build
-
-# Check Just syntax
-just check
-
-# Validate JSON files
-find system_files -name "*.json" -exec sh -c 'echo "Checking {}"; cat {} | jq . > /dev/null' \;
-
-# Check shell script syntax
-find system_files -name "*.sh" -exec bash -n {} \;
-
-# Inspect built image
-just tree
-```
-
-### GitHub Actions
-The build workflow automatically:
-- Builds the container with podman/buildah
-- Pushes to GHCR on merge to main
-- Validates build succeeds on PRs
-
-## Development Guidelines
-
-### Making Changes
-1. **Understand shared vs DX** - Place configs in the correct system_files subdirectory
-2. **Maintain structure** - Follow existing directory patterns
-3. **Test locally** - Build with `just build` before pushing
-4. **Use pre-commit hooks** - Run before committing if configured
-
-### File Editing Best Practices
-- **JSON files**: Validate syntax with `jq` before committing
-- **Shell scripts**: Check syntax with `bash -n script.sh`
-- **Just files**: Use `just check` and `just fix` for syntax validation
-- **Keep files small** - Each file should have a single, clear purpose
-- **Document changes** - Update comments in configuration files
-
-## Trust These Instructions
-
-**This repository structure:**
-- Configuration files in `system_files/shared/` and `system_files/dx/`
-- Flatpak definitions in `flatpaks/`
-- Branding assets in `logos/`
-- Multi-stage Containerfile pulling from aurora-wallpapers and projectbluefin/common
-- Justfile with convenience commands
-- GitHub Actions workflow for automated builds
-
-## Other Rules
-
-- Use [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/#specification) for all commits and PR titles
-- Keep changes minimal and surgical
-- This layer is used by Aurora and Aurora-DX
-- Changes to `system_files/shared/` affect both variants
-- Changes to `system_files/dx/` only affect Aurora-DX
-
-## Attribution Requirements
-
-AI agents must disclose what tool and model they are using in the "Assisted-by" commit footer:
-
-```text
-Assisted-by: [Model Name] via [Tool Name]
-```
-
-Example:
-
-```text
-Assisted-by: Claude 3.5 Sonnet via GitHub Copilot
-```
diff --git a/Containerfile b/Containerfile
index 9bba86b..85c4d10 100644
--- a/Containerfile
+++ b/Containerfile
@@ -115,8 +115,7 @@ curl -fsSLo /out/system_files/shared/usr/lib/udev/rules.d/70-u2f.rules https://r
 EOF
 
 FROM scratch AS ctx
-COPY aurorafin-shared/system_files/shared /system_files/shared
-COPY aurorafin-shared/system_files/nvidia /system_files/nvidia
+COPY system_files/nvidia /system_files/nvidia
 COPY --from=builder /out/wallpapers /wallpapers
 COPY --from=builder /out/logos /logos
 COPY --from=builder /out/system_files/shared /system_files/shared
diff --git a/Justfile b/Justfile
index 0ab767e..4f3f8ce 100644
--- a/Justfile
+++ b/Justfile
@@ -48,3 +48,54 @@ dump IMAGE="localhost/aurora-common:latest":
     mkdir -p dump
     podman cp "$cid:/." dump/
     podman rm "$cid"
+
+# Validate Brewfiles
+brew-lint dir="system_files/shared/usr/share/ublue-os/homebrew":
+    #!/usr/bin/env bash
+    set -eou pipefail
+
+    system_files/shared/usr/libexec/ublue-brew-trust-brewfile system_files/shared/usr/share/ublue-os/homebrew/*.Brewfile
+
+    STATUS_FILE=$(mktemp)
+    echo "PASS" > "$STATUS_FILE"
+
+    while IFS= read -r -d '' brewfile ; do
+      echo "::group:: ===$(basename $brewfile)==="
+
+      grep -E -e "^tap" "$brewfile" > taps.Brewfile || true
+      echo "Syncing taps..."
+      brew bundle --file=./taps.Brewfile > /dev/null 2>&1 || true
+
+      # Extract combined list for parallel check
+      FORMULAS=$(grep -E '^\s*brew\s+["'\'']' "$brewfile" | sed -E 's/^\s*brew\s+["'\'']([^"'\'']+)["'\''].*/formula \1/' || true)
+      CASKS=$(grep -E '^\s*cask\s+["'\'']' "$brewfile" | sed -E 's/^\s*cask\s+["'\'']([^"'\'']+)["'\''].*/cask \1/' || true)
+
+      ENTRIES=$(printf "%s\n%s" "$FORMULAS" "$CASKS" | grep -v '^\s*$' || true)
+
+      if [ -n "$ENTRIES" ]; then
+        echo "$ENTRIES" | xargs -P 8 -I {} bash -c '
+          TYPE=$(echo "{}" | cut -d" " -f1)
+          NAME=$(echo "{}" | cut -d" " -f2)
+          if ! brew info --$TYPE "$NAME" &> /dev/null; then
+            echo "✗ $TYPE \"$NAME\" is invalid or missing tap"
+            echo "FAIL" >> "'"$STATUS_FILE"'"
+          else
+            echo "✓ $TYPE \"$NAME\" is valid"
+          fi
+        '
+      else
+        echo "No formulas or casks found."
+      fi
+
+      echo "::endgroup::"
+    done < <(find "{{ dir }}" -iname '*\.Brewfile*' -print0)
+
+    rm -f taps.Brewfile
+
+    if grep -q "FAIL" "$STATUS_FILE"; then
+      echo "Validation complete. Some Brewfiles FAILED."
+      exit 1
+    else
+      echo "Validation complete. All Brewfiles PASSED."
+      exit 0
+    fi
diff --git a/aurorafin-shared b/aurorafin-shared
deleted file mode 160000
index 81fae17..0000000
--- a/aurorafin-shared
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 81fae1734f0d909e6d8b3d6d3695cbaf1f7ed1f2
diff --git a/system_files/nvidia/usr/lib/systemd/system/ublue-nvidia-flatpak-runtime-sync.service b/system_files/nvidia/usr/lib/systemd/system/ublue-nvidia-flatpak-runtime-sync.service
new file mode 100644
index 0000000..b9b5e28
--- /dev/null
+++ b/system_files/nvidia/usr/lib/systemd/system/ublue-nvidia-flatpak-runtime-sync.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Sync NVIDIA system drivers with Flatpak runtime
+After=network-online.target flatpak-system-helper.service
+Wants=network-online.target
+ConditionPathExists=/sys/module/nvidia/version
+# To not run on live ISO
+ConditionPathExists=/run/ostree-booted
+
+[Service]
+Type=oneshot
+ExecCondition=/usr/libexec/ublue-nvidia-flatpak-runtime-sync check
+ExecStart=/usr/libexec/ublue-nvidia-flatpak-runtime-sync sync
+RemainAfterExit=yes
+Restart=on-failure
+RestartSec=30
+TimeoutStartSec=600
+
+[Install]
+WantedBy=multi-user.target
diff --git a/system_files/nvidia/usr/libexec/ublue-nvidia-flatpak-runtime-sync b/system_files/nvidia/usr/libexec/ublue-nvidia-flatpak-runtime-sync
new file mode 100755
index 0000000..44631f2
--- /dev/null
+++ b/system_files/nvidia/usr/libexec/ublue-nvidia-flatpak-runtime-sync
@@ -0,0 +1,31 @@
+#!/usr/bin/bash
+
+# Workaround for: https://github.com/flatpak/flatpak/issues/3907
+set -euo pipefail
+
+SYSTEM_NVIDIA_VERSION=$(cat /sys/module/nvidia/version)
+FLATPAK_NVIDIA_VERSION=$(echo "${SYSTEM_NVIDIA_VERSION}" | tr '.' '-')
+
+case "${1}" in
+    check)
+        # Exit 0 if sync is needed (versions mismatch), exit 1 if already in sync
+        if flatpak info --system org.freedesktop.Platform.GL.nvidia-"${FLATPAK_NVIDIA_VERSION}" >/dev/null 2>&1 && \
+           flatpak info --system org.freedesktop.Platform.GL32.nvidia-"${FLATPAK_NVIDIA_VERSION}" >/dev/null 2>&1; then
+            echo "NVIDIA Flatpak runtime ${SYSTEM_NVIDIA_VERSION} already installed"
+            exit 1
+        fi
+        echo "NVIDIA Flatpak runtime ${SYSTEM_NVIDIA_VERSION} needs to be installed"
+        exit 0
+        ;;
+    sync)
+        echo "Installing NVIDIA Flatpak runtime version ${SYSTEM_NVIDIA_VERSION}"
+        flatpak remote-add --system --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
+        flatpak install --system --noninteractive -y flathub \
+            org.freedesktop.Platform.GL.nvidia-"${FLATPAK_NVIDIA_VERSION}" \
+            org.freedesktop.Platform.GL32.nvidia-"${FLATPAK_NVIDIA_VERSION}"
+        ;;
+    *)
+        echo "Usage: $0 {check|sync}"
+        exit 1
+        ;;
+esac
diff --git a/system_files/shared/etc/containers/policy.json b/system_files/shared/etc/containers/policy.json
new file mode 100644
index 0000000..20be49f
--- /dev/null
+++ b/system_files/shared/etc/containers/policy.json
@@ -0,0 +1,107 @@
+{
+    "default": [
+        {
+            "type": "reject"
+        }
+    ],
+    "transports": {
+        "docker": {
+            "registry.access.redhat.com": [
+                {
+                    "type": "signedBy",
+                    "keyType": "GPGKeys",
+                    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+                }
+            ],
+            "registry.redhat.io": [
+                {
+                    "type": "signedBy",
+                    "keyType": "GPGKeys",
+                    "keyPath": "/etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release"
+                }
+            ],
+            "quay.io/toolbx-images": [
+                {
+                    "type": "sigstoreSigned",
+                    "keyPath": "/usr/lib/pki/containers/quay.io-toolbx-images.pub",
+                    "signedIdentity": {
+                        "type": "matchRepository"
+                    }
+                }
+            ],
+            "ghcr.io/ublue-os": [
+                {
+                    "type": "sigstoreSigned",
+                    "keyPaths": [
+                        "/usr/lib/pki/containers/ublue-os.pub",
+                        "/usr/lib/pki/containers/ublue-os-backup.pub"
+                    ],
+                    "signedIdentity": {
+                        "type": "matchRepository"
+                    }
+                }
+            ],
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "docker-daemon": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "atomic": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "containers-storage": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "dir": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "oci": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "oci-archive": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "docker-archive": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        },
+        "tarball": {
+            "": [
+                {
+                    "type": "insecureAcceptAnything"
+                }
+            ]
+        }
+    }
+}
diff --git a/system_files/shared/etc/containers/registries.d/quay.io-toolbx-images.yaml b/system_files/shared/etc/containers/registries.d/quay.io-toolbx-images.yaml
new file mode 100644
index 0000000..6f1b9b5
--- /dev/null
+++ b/system_files/shared/etc/containers/registries.d/quay.io-toolbx-images.yaml
@@ -0,0 +1,3 @@
+docker:
+  quay.io/toolbx-images:
+    use-sigstore-attachments: true
\ No newline at end of file
diff --git a/system_files/shared/etc/containers/registries.d/ublue-os.yaml b/system_files/shared/etc/containers/registries.d/ublue-os.yaml
new file mode 100644
index 0000000..f314b0a
--- /dev/null
+++ b/system_files/shared/etc/containers/registries.d/ublue-os.yaml
@@ -0,0 +1,3 @@
+docker:
+  ghcr.io/ublue-os:
+    use-sigstore-attachments: true
\ No newline at end of file
diff --git a/system_files/shared/etc/geoclue/conf.d/99-beacondb.conf b/system_files/shared/etc/geoclue/conf.d/99-beacondb.conf
new file mode 100644
index 0000000..95d6996
--- /dev/null
+++ b/system_files/shared/etc/geoclue/conf.d/99-beacondb.conf
@@ -0,0 +1,3 @@
+[wifi]
+enable=true
+url=https://api.beacondb.net/v1/geolocate
diff --git a/system_files/shared/etc/profile.d/ublue-fastfetch.sh b/system_files/shared/etc/profile.d/ublue-fastfetch.sh
new file mode 100644
index 0000000..5a57b47
--- /dev/null
+++ b/system_files/shared/etc/profile.d/ublue-fastfetch.sh
@@ -0,0 +1,3 @@
+alias neofetch='ublue-fastfetch'
+alias neowofetch='ublue-fastfetch'
+alias fastfetch='ublue-fastfetch'
diff --git a/system_files/shared/etc/profile.d/ublue-motd.sh b/system_files/shared/etc/profile.d/ublue-motd.sh
new file mode 100644
index 0000000..2cdb46a
--- /dev/null
+++ b/system_files/shared/etc/profile.d/ublue-motd.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+[ ! -e "$HOME"/.config/no-show-user-motd ] && ublue-motd
diff --git a/system_files/shared/etc/uupd/config.json b/system_files/shared/etc/uupd/config.json
new file mode 100644
index 0000000..259d91d
--- /dev/null
+++ b/system_files/shared/etc/uupd/config.json
@@ -0,0 +1,7 @@
+{
+    "modules": {
+        "distrobox": {
+            "disable": true
+        }
+    }
+}
diff --git a/system_files/shared/usr/bin/luks-tpm2-autounlock b/system_files/shared/usr/bin/luks-tpm2-autounlock
new file mode 100755
index 0000000..6a06473
--- /dev/null
+++ b/system_files/shared/usr/bin/luks-tpm2-autounlock
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+# References:
+#  https://os.gnome.org/install
+#  https://www.reddit.com/r/Fedora/comments/uo4ufq/any_way_to_get_systemdcryptenroll_working_on/
+#  https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html
+
+gum confirm --affirmative="Enable" --negative="Disable" "Toggle TPM2 auto-unlock"
+EXIT_CODE="$?"
+case "${EXIT_CODE}" in
+  0|1)
+    ;;
+  *)
+    exit 0
+esac
+
+RD_LUKS_UUID="$(xargs -n1 -a /proc/cmdline | grep -E -e "rd.luks.(uuid|name)" | head -n 1 | cut -d= -f 2 | sed "s/^luks-//" )"
+CRYPT_DISK="$(realpath "/dev/disk/by-uuid/${RD_LUKS_UUID}")"
+
+if ! find /dev -iname "${RD_LUKS_UUID:-INVALIDINVALID}" | grep -F -e "${RD_LUKS_UUID}" &>/dev/null; then
+  echo "Could not find LUKS device used to boot system on system mount table. Is your drive encrypted?"
+  exit 1
+fi
+
+if [ "${EXIT_CODE}" == 1 ] ; then
+  sudo systemd-cryptenroll --wipe-slot=tpm2 "${CRYPT_DISK}"
+  exit 0
+fi
+
+gum confirm "Would you like to set up a PIN?"
+EXIT_CODE="$?"
+SET_PIN_ARG=""
+case "${EXIT_CODE}" in
+  0)
+    export SET_PIN_ARG="--tpm2-with-pin=yes"
+    ;;
+  1)
+    ;;
+  *)
+    exit 0
+esac
+
+if sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs='' ${SET_PIN_ARG} "${CRYPT_DISK}" ; then
+  echo "TPM2 LUKS auto-unlock configured for next reboot."
+fi
diff --git a/system_files/shared/usr/bin/ublue-bling b/system_files/shared/usr/bin/ublue-bling
new file mode 100755
index 0000000..0cd067b
--- /dev/null
+++ b/system_files/shared/usr/bin/ublue-bling
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+set -eoux pipefail
+
+BLING_CLI_DIRECTORY="/usr/share/ublue-os/bling"
+
+BLING_SCRIPT_SOURCE=""
+TARGET_CONFIG_FILE=""
+shell="$(basename "${SHELL}")"
+case "${shell}" in
+    "fish")
+        BLING_SCRIPT_SOURCE="bling.fish"
+        TARGET_CONFIG_FILE="${XDG_CONFIG_HOME:-$HOME/.config}/fish/config.fish"
+    ;;
+    "zsh")
+        BLING_SCRIPT_SOURCE="bling.sh"
+        TARGET_CONFIG_FILE="${ZDOTDIR:-$HOME}/.zshrc"
+    ;;
+    "bash")
+        BLING_SCRIPT_SOURCE="bling.sh"
+        TARGET_CONFIG_FILE="${HOME}/.bashrc"
+    ;;
+    *)
+        echo 'Unknown shell. You are on your own.'
+        exit 1
+    ;;
+esac
+
+function is-bling-installed() {
+    echo "hello"
+    [ -f "$TARGET_CONFIG_FILE" ] || return 1
+
+    if [ -n "$(grep -n "source $BLING_CLI_DIRECTORY/$BLING_SCRIPT_SOURCE" "$TARGET_CONFIG_FILE" | grep -Eo '^[^:]+')" ]; then
+        return 0
+    fi
+    return 1
+}
+
+[ -f "${BLING_ENV_SCRIPT:-/usr/share/ublue-os/bling/env.sh}" ] && . "${BLING_ENV_SCRIPT:-/usr/share/ublue-os/bling/env.sh}"
+
+BLING_MESSAGE_ENABLE="${BLING_MESSAGE_ENABLE:-Enable bling for ${shell}?}"
+BLING_MESSAGE_DISABLE="${BLING_MESSAGE_DISABLE:-Disable bling for ${shell}?}"
+
+if is-bling-installed "${shell}" ; then
+    gum confirm "${BLING_MESSAGE_DISABLE}"
+    if ! sed -i "/### ${BLING_SCRIPT_SOURCE} source start/,/### ${BLING_SCRIPT_SOURCE} source end/d" "${TARGET_CONFIG_FILE}" ; then
+        sed -i "$(grep -n "source ${BLING_SCRIPT_SOURCE}" "${TARGET_CONFIG_FILE}" | grep -Eo '^[^:]+')"d "${HOME}/.bashrc"
+    fi
+    echo "Bling removed. Reopen your terminal so that the configurations may be removed"
+else
+    gum confirm "${BLING_MESSAGE_ENABLE}" --affirmative="Bling me up!" --negative "No, I'm boring"
+    echo "Adding bling to your $(basename "${TARGET_CONFIG_FILE}")"
+    cat<<EOF >> "${TARGET_CONFIG_FILE}"
+### ${BLING_SCRIPT_SOURCE} source start
+test -f ${BLING_CLI_DIRECTORY}/${BLING_SCRIPT_SOURCE} && source ${BLING_CLI_DIRECTORY}/${BLING_SCRIPT_SOURCE}
+### ${BLING_SCRIPT_SOURCE} source end
+EOF
+    echo "Installation complete. Reopen your terminal so that the configurations may be applied"
+fi
diff --git a/system_files/shared/usr/bin/ublue-bling-fastfetch b/system_files/shared/usr/bin/ublue-bling-fastfetch
new file mode 100755
index 0000000..f310dad
--- /dev/null
+++ b/system_files/shared/usr/bin/ublue-bling-fastfetch
@@ -0,0 +1,44 @@
+#!/usr/bin/bash
+
+THEME="$(dconf read /org/gnome/desktop/interface/accent-color 2>/dev/null || echo -e "$DEFAULT_THEME")"
+# Dconf will fail if the accent-color has not been changed yet
+if [ "$THEME" == "" ] ; then
+	# Gsettings will not update if the system's schemas have not been configured properly
+	THEME="$(gsettings get org.gnome.desktop.interface accent-color 2>/dev/null || echo -e "$DEFAULT_THEME")"
+fi
+THEME="${THEME//\'/}"
+THEME="${FASTFETCH_FORCE_THEME:-$THEME}"
+
+FASTFETCH_COLOR_SET="38;2;53;132;228"
+case $THEME in
+  "blue")
+    FASTFETCH_COLOR_SET="38;2;53;132;228"
+    ;;
+  "green")
+    FASTFETCH_COLOR_SET="38;2;58;148;74"
+    ;;
+  "orange")
+    FASTFETCH_COLOR_SET="38;2;237;91;0"
+    ;;
+  "pink")
+    FASTFETCH_COLOR_SET="38;2;213;97;153"
+    ;;
+  "purple")
+    FASTFETCH_COLOR_SET="38;2;139;62;165"
+    ;;
+  "red")
+    FASTFETCH_COLOR_SET="38;2;230;45;66"
+    ;;
+  "slate")
+    FASTFETCH_COLOR_SET="38;2;111;131;150"
+    ;;
+  "teal")
+    FASTFETCH_COLOR_SET="38;2;33;144;164"
+    ;;
+  "yellow")
+    FASTFETCH_COLOR_SET="38;2;200;136;0"
+    ;;
+esac
+
+echo $FASTFETCH_COLOR_SET
+exit 0
diff --git a/system_files/shared/usr/bin/ublue-fastfetch b/system_files/shared/usr/bin/ublue-fastfetch
new file mode 100755
index 0000000..ec1e281
--- /dev/null
+++ b/system_files/shared/usr/bin/ublue-fastfetch
@@ -0,0 +1,30 @@
+#!/usr/bin/bash
+
+get_config() {
+	FASTFETCH_CONFIG_FILE="${FASTFETCH_CONFIG_FILE:-/etc/ublue-os/fastfetch.json}"
+	QUERY="$1"
+	FALLBACK="$2"
+	shift
+	shift
+	OUTPUT="$(jq -r "${QUERY}" "${FASTFETCH_CONFIG_FILE}" 2>/dev/null || echo "${FALLBACK}")"
+	if [ "${OUTPUT}" == "null" ] ; then
+		echo "${FALLBACK}"
+		return
+	fi
+	echo "${OUTPUT}"
+}
+
+FASTFETCH_CONFIG="$(get_config '."fastfetch-config"' "/usr/share/ublue-os/fastfetch.jsonc")"
+SHUFFLE_LOGO="$(get_config '."shuffle-logo"' "false")"
+LOGO_DIRECTORY="$(get_config '."logo-directory"' "/usr/share/ublue-os/fastfetch")"
+
+export DEFAULT_THEME # Gets passed to `ublue-bling-fastfetch`
+DEFAULT_THEME="$(get_config '."default-theme"' "slate")"
+if [ "$SHUFFLE_LOGO" == "true" ] ; then
+  FETCH_LOGO="$(find "$LOGO_DIRECTORY" -type f | shuf -n 1)"
+  exec fastfetch --logo "$FETCH_LOGO" --color "$(ublue-bling-fastfetch)" --config "${FASTFETCH_CONFIG}" "${@}"
+else
+  exec fastfetch --color "$(ublue-bling-fastfetch)" --config "${FASTFETCH_CONFIG}" "${@}"
+fi
+
+
diff --git a/system_files/shared/usr/bin/ublue-image-info.sh b/system_files/shared/usr/bin/ublue-image-info.sh
new file mode 100755
index 0000000..b171990
--- /dev/null
+++ b/system_files/shared/usr/bin/ublue-image-info.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+# shellcheck disable=2046
+echo -n "$(jq -r '"\(.["image-name"]):\(.["image-tag"])"' < /usr/share/ublue-os/image-info.json)"
+
+if [[ "$(rpm-ostree status --booted)" =~ "signed" ]]; then
+	echo -n " 🔐"
+else
+	echo -n -e " \033[5m🔓\033[0m"
+fi
diff --git a/system_files/shared/usr/bin/ublue-motd b/system_files/shared/usr/bin/ublue-motd
new file mode 100755
index 0000000..7749a91
--- /dev/null
+++ b/system_files/shared/usr/bin/ublue-motd
@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+
+MOTD_TEMPLATE_FILE="${MOTD_TEMPLATE_FILE:-/usr/share/ublue-os/motd/template.md}"
+. "${MOTD_ENV_SCRIPT:-/usr/share/ublue-os/motd/env.sh}"
+
+if command -v tput >/dev/null 2>&1 && [ -t 1 ]; then
+  cols=$(tput cols 2>/dev/null)
+  envsubst < "${MOTD_TEMPLATE_FILE}" | glow -w $cols -
+else
+  envsubst < "${MOTD_TEMPLATE_FILE}" | glow -
+fi
diff --git a/system_files/shared/usr/bin/ublue-privileged-setup b/system_files/shared/usr/bin/ublue-privileged-setup
new file mode 100755
index 0000000..174d156
--- /dev/null
+++ b/system_files/shared/usr/bin/ublue-privileged-setup
@@ -0,0 +1,28 @@
+#!/usr/bin/bash
+
+get_config() {
+	SETUP_CONFIG_FILE="${SETUP_CONFIG_FILE:-/etc/ublue-os/setup.json}"
+	QUERY="$1"
+	FALLBACK="$2"
+	shift
+	shift
+	OUTPUT="$(jq -r "$QUERY" "$SETUP_CONFIG_FILE" 2>/dev/null || echo "$FALLBACK")"
+	if [ "$OUTPUT" == "null" ] ; then
+		echo "$FALLBACK"
+		return
+	fi
+	echo "$OUTPUT"
+}
+
+PRIVILEGED_HOOKS_DIRECTORY="$(get_config '."privileged-hooks-directory"' "/usr/share/ublue-os/privileged-setup.hooks.d")"
+HOOKS_VERBOSE="${HOOKS_VERBOSE:-$(get_config '."verbose"' "false")}"
+
+if [ "${HOOKS_VERBOSE}" == "true" ] ; then
+	set -x
+fi
+
+if [ -d "${PRIVILEGED_HOOKS_DIRECTORY}" ] ; then
+	for script in $PRIVILEGED_HOOKS_DIRECTORY/* ; do
+		bash $script
+	done
+fi
diff --git a/system_files/shared/usr/bin/ublue-system-setup b/system_files/shared/usr/bin/ublue-system-setup
new file mode 100755
index 0000000..af88110
--- /dev/null
+++ b/system_files/shared/usr/bin/ublue-system-setup
@@ -0,0 +1,29 @@
+#!/usr/bin/bash
+
+get_config() {
+	SETUP_CONFIG_FILE="${SETUP_CONFIG_FILE:-/etc/ublue-os/setup.json}"
+	QUERY="$1"
+	FALLBACK="$2"
+	shift
+	shift
+	OUTPUT="$(jq -r "$QUERY" "$SETUP_CONFIG_FILE" 2>/dev/null || echo "$FALLBACK")"
+	if [ "$OUTPUT" == "null" ] ; then
+		echo "$FALLBACK"
+		return
+	fi
+	echo "$OUTPUT"
+}
+
+SYSTEM_HOOKS_DIRECTORY="$(get_config '."system-hooks-directory"' "/usr/share/ublue-os/system-setup.hooks.d")"
+HOOKS_VERBOSE="${HOOKS_VERBOSE:-$(get_config '."verbose"' "false")}"
+
+if [ "${HOOKS_VERBOSE}" == "true" ] ; then
+	set -x
+fi
+
+if [ -d "${SYSTEM_HOOKS_DIRECTORY}" ] ; then
+	for script in $SYSTEM_HOOKS_DIRECTORY/* ; do
+		bash $script
+	done
+fi
+
diff --git a/system_files/shared/usr/bin/ublue-user-setup b/system_files/shared/usr/bin/ublue-user-setup
new file mode 100755
index 0000000..ee98376
--- /dev/null
+++ b/system_files/shared/usr/bin/ublue-user-setup
@@ -0,0 +1,29 @@
+#!/usr/bin/bash
+
+get_config() {
+	SETUP_CONFIG_FILE="${SETUP_CONFIG_FILE:-/etc/ublue-os/setup.json}"
+	QUERY="$1"
+	FALLBACK="$2"
+	shift
+	shift
+	OUTPUT="$(jq -r "$QUERY" "$SETUP_CONFIG_FILE" 2>/dev/null || echo "$FALLBACK")"
+	if [ "$OUTPUT" == "null" ] ; then
+		echo "$FALLBACK"
+		return
+	fi
+	echo "$OUTPUT"
+}
+
+USER_HOOKS_DIRECTORY="$(get_config '."user-hooks-directory"' "/usr/share/ublue-os/user-setup.hooks.d")"
+HOOKS_VERBOSE="${HOOKS_VERBOSE:-$(get_config '."verbose"' "false")}"
+
+if [ "${HOOKS_VERBOSE}" == "true" ] ; then
+	set -x
+fi
+
+# Privileged setup can be called via user services
+if [ -d "$USER_HOOKS_DIRECTORY" ] ; then
+	for script in $USER_HOOKS_DIRECTORY/* ; do
+		bash $script
+	done
+fi
diff --git a/system_files/shared/usr/bin/ujust b/system_files/shared/usr/bin/ujust
new file mode 100755
index 0000000..28ea130
--- /dev/null
+++ b/system_files/shared/usr/bin/ujust
@@ -0,0 +1,3 @@
+#!/usr/bin/bash
+
+just --justfile /usr/share/ublue-os/just/00-entry.just "${@}"
diff --git a/system_files/shared/usr/lib/modprobe.d/amd-legacy.conf b/system_files/shared/usr/lib/modprobe.d/amd-legacy.conf
new file mode 100644
index 0000000..8f659aa
--- /dev/null
+++ b/system_files/shared/usr/lib/modprobe.d/amd-legacy.conf
@@ -0,0 +1,6 @@
+# Enable Legacy AMD hardware support
+options amdgpu si_support=1
+options amdgpu cik_support=1
+
+options radeon si_support=0
+options radeon cik_support=0
diff --git a/system_files/shared/usr/lib/pki/containers/quay.io-toolbx-images.pub b/system_files/shared/usr/lib/pki/containers/quay.io-toolbx-images.pub
new file mode 100644
index 0000000..ebc85da
--- /dev/null
+++ b/system_files/shared/usr/lib/pki/containers/quay.io-toolbx-images.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQr63Nsc66mA3oGMArrQPm8/AkuTO
+K+ZrK3WCWzx00LW5K1qu+BS3U4eyMmXaFKIsX69PEFZWzXKy9psum8wj9Q==
+-----END PUBLIC KEY-----
\ No newline at end of file
diff --git a/system_files/shared/usr/lib/pki/containers/ublue-os-backup.pub b/system_files/shared/usr/lib/pki/containers/ublue-os-backup.pub
new file mode 100644
index 0000000..70c9933
--- /dev/null
+++ b/system_files/shared/usr/lib/pki/containers/ublue-os-backup.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERTMY78++NW5twobx8+Fwd+wqrTwd
+U8+Jv+r7QS+jwbl4VZ4GDbHjz01dRsqTbzdRjlYK+ERXTm9NfJJ5IlFFtw==
+-----END PUBLIC KEY-----
diff --git a/system_files/shared/usr/lib/pki/containers/ublue-os.pub b/system_files/shared/usr/lib/pki/containers/ublue-os.pub
new file mode 100644
index 0000000..bd5b192
--- /dev/null
+++ b/system_files/shared/usr/lib/pki/containers/ublue-os.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHLRpBfPRYiMl9wb7s6fx47PzzNWu
+3zyJgXhWEvxoOgwv9CpwjbvUwR9qHxNMWkJhuGE6cjDA2hpy1I6NbA+24Q==
+-----END PUBLIC KEY-----
diff --git a/system_files/shared/usr/lib/systemd/system-preset/01-uupd.preset b/system_files/shared/usr/lib/systemd/system-preset/01-uupd.preset
new file mode 100644
index 0000000..3a12e2e
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/system-preset/01-uupd.preset
@@ -0,0 +1 @@
+enable uupd.timer
diff --git a/system_files/shared/usr/lib/systemd/system/flatpak-preinstall.service b/system_files/shared/usr/lib/systemd/system/flatpak-preinstall.service
new file mode 100644
index 0000000..5badadc
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/system/flatpak-preinstall.service
@@ -0,0 +1,19 @@
+[Unit]
+Description=Preinstall Flatpaks
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=/usr/bin/flatpak
+Documentation=man:flatpak-preinstall(1)
+StartLimitIntervalSec=600
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/flatpak preinstall -y
+RemainAfterExit=true
+Restart=on-failure
+RestartSec=30
+
+StartLimitBurst=3
+
+[Install]
+WantedBy=multi-user.target
diff --git a/system_files/shared/usr/lib/systemd/system/ublue-system-setup.service b/system_files/shared/usr/lib/systemd/system/ublue-system-setup.service
new file mode 100644
index 0000000..26b315d
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/system/ublue-system-setup.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Configure system
+After=rpm-ostreed.service
+Before=systemd-user-sessions.service
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/ublue-system-setup
+User=root
+
+[Install]
+WantedBy=multi-user.target
diff --git a/system_files/shared/usr/lib/systemd/user/ublue-user-setup.service b/system_files/shared/usr/lib/systemd/user/ublue-user-setup.service
new file mode 100644
index 0000000..6fe361c
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/user/ublue-user-setup.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Configure system for current user
+Wants=network-online.target
+After=network-online.target
+ConditionUser=!@system
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/ublue-user-setup
+
+[Install]
+WantedBy=graphical-session.target
diff --git a/system_files/shared/usr/lib/ublue/setup-services/libsetup.sh b/system_files/shared/usr/lib/ublue/setup-services/libsetup.sh
new file mode 100644
index 0000000..dd6de25
--- /dev/null
+++ b/system_files/shared/usr/lib/ublue/setup-services/libsetup.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+SETUP_CHECKER_FILE="${SETUP_CHECKER_FILE:-$HOME/.local/share/ublue/setup_versioning.json}"
+
+# Meant to be used at the start of any setup service script. Will version your script accordingly on $SETUP_CHECKER_FILE
+# :target_versioning_name: Whatever you want to name your versioning tag. Please keep it always the same
+# :type_of_service: Must be either `user`, `privileged`, or `system`
+# :version: Target version to check/apply to your file
+#
+# Meant to be used as follows (or similar):
+# version-script tailscale user 1 || exit 0
+function version-script() {
+  TARGET_VERSIONING_NAME=$1
+  TYPE_OF_SERVICE=$2
+  VERSION=$3
+  shift
+  shift
+  shift
+
+  if [ ! -e "${SETUP_CHECKER_FILE}" ] ; then
+    mkdir -p "$(dirname "${SETUP_CHECKER_FILE}")"
+    echo "{}" > "${SETUP_CHECKER_FILE}"
+  fi
+
+  if [ "$(jq -r -c ".version.${TYPE_OF_SERVICE}.\"${TARGET_VERSIONING_NAME}\"" "${SETUP_CHECKER_FILE}")" == "${VERSION}" ] ; then
+    echo "Exiting as current version (${VERSION}) for ${TYPE_OF_SERVICE}-${TARGET_VERSIONING_NAME} is the same as latest version recorded on ${SETUP_CHECKER_FILE}"
+    return 1
+  fi
+  ANNOYING_JQ_WORKAROUND=$(mktemp)
+  jq ".version.${TYPE_OF_SERVICE}.\"${TARGET_VERSIONING_NAME}\" = \"${VERSION}\"" "${SETUP_CHECKER_FILE}" >"${ANNOYING_JQ_WORKAROUND}"
+  mv "${ANNOYING_JQ_WORKAROUND}" "${SETUP_CHECKER_FILE}"
+  set +x
+  return 0
+}
diff --git a/system_files/shared/usr/lib/udev/rules.d/10-switch.rules b/system_files/shared/usr/lib/udev/rules.d/10-switch.rules
new file mode 100644
index 0000000..f497c83
--- /dev/null
+++ b/system_files/shared/usr/lib/udev/rules.d/10-switch.rules
@@ -0,0 +1,4 @@
+# This got added on https://github.com/ublue-os/config/pull/154
+# Written by https://github.com/badlydrawnface
+# Makes restarting a jigged switch easier
+SUBSYSTEMS=="usb", ATTRS{manufacturer}=="NVIDIA Corp.", ATTRS{product}=="APX", GROUP="nintendo_switch"
diff --git a/system_files/shared/usr/lib/udev/rules.d/50-framework16.rules b/system_files/shared/usr/lib/udev/rules.d/50-framework16.rules
new file mode 100644
index 0000000..100d007
--- /dev/null
+++ b/system_files/shared/usr/lib/udev/rules.d/50-framework16.rules
@@ -0,0 +1,15 @@
+# Written by https://github.com/kylegospo
+
+# Audio Expansion Card
+ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="32ac", ATTR{idProduct}=="0010", ATTR{power/autosuspend}="10", ATTR{power/control}="auto", GOTO="rules_end"
+
+# Framework Laptop 16 Keyboard Module - ANSI
+ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="32ac", ATTR{idProduct}=="0012", ATTR{power/autosuspend}="-1", ATTR{power/control}="on", ATTR{power/wakeup}="disabled", GOTO="rules_end"
+
+# Framework Laptop 16 Numpad Module
+ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="32ac", ATTR{idProduct}=="0014", ATTR{power/autosuspend}="-1", ATTR{power/control}="on", ATTR{power/wakeup}="disabled", GOTO="rules_end"
+
+# Framework Laptop 16 Keyboard Module
+ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="32ac", ATTR{idProduct}=="0018", ATTR{power/autosuspend}="-1", ATTR{power/control}="on", ATTR{power/wakeup}="disabled", GOTO="rules_end"
+
+LABEL="rules_end"
diff --git a/system_files/shared/usr/lib/udev/rules.d/50-steam-horipad-controller.rules b/system_files/shared/usr/lib/udev/rules.d/50-steam-horipad-controller.rules
new file mode 100644
index 0000000..75609ec
--- /dev/null
+++ b/system_files/shared/usr/lib/udev/rules.d/50-steam-horipad-controller.rules
@@ -0,0 +1,11 @@
+# Added to config on https://github.com/ublue-os/config/pull/354
+# Commit from https://github.com/aarron-lee
+# udev rules from GloriousEggroll
+
+# Wireless HORIPAD STEAM; Bluetooth
+KERNEL=="hidraw*", KERNELS=="*0F0D:0196*", MODE="0660", TAG+="uaccess"
+KERNEL=="hidraw*", ATTRS{idVendor}=="0f0d", ATTRS{idProduct}=="0196", MODE="0660", TAG+="uaccess"
+
+# Wired HORIPAD STEAM; USB
+KERNEL=="hidraw*", KERNELS=="*0F0D:01AB*", MODE="0660", TAG+="uaccess"
+KERNEL=="hidraw*", ATTRS{idVendor}=="0f0d", ATTRS{idProduct}=="01ab", MODE="0660", TAG+="uaccess"
diff --git a/system_files/shared/usr/lib/udev/rules.d/50-usb-realtek-net.rules b/system_files/shared/usr/lib/udev/rules.d/50-usb-realtek-net.rules
new file mode 100644
index 0000000..eac5ba9
--- /dev/null
+++ b/system_files/shared/usr/lib/udev/rules.d/50-usb-realtek-net.rules
@@ -0,0 +1,48 @@
+# This is used to change the default configuration of Realtek USB ethernet adapters
+# First added on https://github.com/ublue-os/config/commit/34ee4b21ad34ca80115a95d8a18fd735c4cb29ad
+# Added by https://github.com/bsherman
+
+ACTION!="add", GOTO="usb_realtek_net_end"
+SUBSYSTEM!="usb", GOTO="usb_realtek_net_end"
+ENV{DEVTYPE}!="usb_device", GOTO="usb_realtek_net_end"
+
+# Modify this to change the default value
+ENV{REALTEK_MODE1}="1"
+ENV{REALTEK_MODE2}="3"
+
+# Realtek
+ATTR{idVendor}=="0bda", ATTR{idProduct}=="815[2,3,5,6]", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="0bda", ATTR{idProduct}=="8053", ATTR{bcdDevice}=="e???", ATTR{bConfigurationValue}!="$env{REALTEK_MODE2}", ATTR{bConfigurationValue}="$env{REALTEK_MODE2}"
+
+# Samsung
+ATTR{idVendor}=="04e8", ATTR{idProduct}=="a101", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+
+# Lenovo
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="304f", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3052", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3054", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3057", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3062", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3069", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3082", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="3098", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="7205", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="720a", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="720b", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="720c", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="7214", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="721e", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="8153", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="a359", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+ATTR{idVendor}=="17ef", ATTR{idProduct}=="a387", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+
+# TP-LINK
+ATTR{idVendor}=="2357", ATTR{idProduct}=="0601", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+
+# Nvidia
+ATTR{idVendor}=="0955", ATTR{idProduct}=="09ff", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+
+# LINKSYS
+ATTR{idVendor}=="13b1", ATTR{idProduct}=="0041", ATTR{bConfigurationValue}!="$env{REALTEK_MODE1}", ATTR{bConfigurationValue}="$env{REALTEK_MODE1}"
+
+LABEL="usb_realtek_net_end"
diff --git a/system_files/shared/usr/lib/udev/rules.d/50-zsa.rules b/system_files/shared/usr/lib/udev/rules.d/50-zsa.rules
new file mode 100644
index 0000000..8360443
--- /dev/null
+++ b/system_files/shared/usr/lib/udev/rules.d/50-zsa.rules
@@ -0,0 +1,25 @@
+# Source: https://github.com/zsa/wally/wiki/Linux-install#2-create-a-udev-rule-file
+# Rules for Oryx web flashing and live training
+KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev"
+KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev"
+
+# Legacy rules for live training over webusb (Not needed for firmware v21+)
+  # Rule for all ZSA keyboards
+  SUBSYSTEM=="usb", ATTR{idVendor}=="3297", GROUP="plugdev"
+  # Rule for the Moonlander
+  SUBSYSTEM=="usb", ATTR{idVendor}=="3297", ATTR{idProduct}=="1969", GROUP="plugdev"
+  # Rule for the Ergodox EZ
+  SUBSYSTEM=="usb", ATTR{idVendor}=="feed", ATTR{idProduct}=="1307", GROUP="plugdev"
+  # Rule for the Planck EZ
+  SUBSYSTEM=="usb", ATTR{idVendor}=="feed", ATTR{idProduct}=="6060", GROUP="plugdev"
+
+# Wally Flashing rules for the Ergodox EZ
+ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", ENV{ID_MM_DEVICE_IGNORE}="1"
+ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789A]?", ENV{MTP_NO_PROBE}="1"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789ABCD]?", MODE:="0666"
+KERNEL=="ttyACM*", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", MODE:="0666"
+
+# Keymapp / Wally Flashing rules for the Moonlander and Planck EZ
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE:="0666", SYMLINK+="stm32_dfu"
+# Keymapp Flashing rules for the Voyager
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="3297", MODE:="0666", SYMLINK+="ignition_dfu"
diff --git a/system_files/shared/usr/lib/udev/rules.d/60-arduino-mbed.rules b/system_files/shared/usr/lib/udev/rules.d/60-arduino-mbed.rules
new file mode 100644
index 0000000..06ea7d6
--- /dev/null
+++ b/system_files/shared/usr/lib/udev/rules.d/60-arduino-mbed.rules
@@ -0,0 +1,8 @@
+# Source: https://github.com/arduino/ArduinoCore-mbed/blob/main/post_install.sh
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="2e8a", MODE:="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="2341", MODE:="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="1fc9", MODE:="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="0525", MODE:="0666"
+
+# Arduino Nano clone, @vfosnar owns one
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="1a86", ATTRS{idProduct}=="7523", MODE:="0666"
diff --git a/system_files/shared/usr/lib/udev/rules.d/70-titan-key.rules b/system_files/shared/usr/lib/udev/rules.d/70-titan-key.rules
new file mode 100644
index 0000000..9aedcef
--- /dev/null
+++ b/system_files/shared/usr/lib/udev/rules.d/70-titan-key.rules
@@ -0,0 +1,3 @@
+# First appeared on https://github.com/ublue-os/config/commit/7e539b4408e3515bb6b24e62ad5459b49f7b1bb5#diff-f47a075172a8fe955d7b173f0d6f8b298a593ef1d014d1baf65e8477f565ca77
+# Commit made by https://github.com/castrojo/
+KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="18d1|096e", ATTRS{idProduct}=="5026|0858|085b", TAG+="uaccess"
diff --git a/system_files/shared/usr/lib/udev/rules.d/70-wooting.rules b/system_files/shared/usr/lib/udev/rules.d/70-wooting.rules
new file mode 100644
index 0000000..3a95347
--- /dev/null
+++ b/system_files/shared/usr/lib/udev/rules.d/70-wooting.rules
@@ -0,0 +1,99 @@
+# This is a soft fork of the official Wooting keyboard udev rules
+# Modified by https://github.com/Arcitec on https://github.com/ublue-os/config/pull/45
+
+# Wooting One Legacy
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff01", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff01", MODE="0660", TAG+="uaccess"
+# Wooting One update mode 
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2402", MODE="0660", TAG+="uaccess"
+
+# Wooting Two Legacy
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff02", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff02", MODE="0660", TAG+="uaccess"
+# Wooting Two update mode  
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2403", MODE="0660", TAG+="uaccess"
+
+# Wooting One
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1100", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1100", MODE="0660", TAG+="uaccess"
+# Wooting One Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1101", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1101", MODE="0660", TAG+="uaccess"
+# Wooting One 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1102", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1102", MODE="0660", TAG+="uaccess"
+
+# Wooting Two
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1200", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1200", MODE="0660", TAG+="uaccess"
+# Wooting Two Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1201", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1201", MODE="0660", TAG+="uaccess"
+# Wooting Two 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1202", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1202", MODE="0660", TAG+="uaccess"
+
+# Wooting Lekker
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1210", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1210", MODE="0660", TAG+="uaccess"
+# Wooting Lekker Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1211", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1211", MODE="0660", TAG+="uaccess"
+# Wooting Lekker 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1212", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1212", MODE="0660", TAG+="uaccess"
+
+# Wooting Lekker update mode  
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="121f", MODE="0660", TAG+="uaccess"
+
+# Wooting Two HE
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1220", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1220", MODE="0660", TAG+="uaccess"
+# Wooting Two HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1221", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1221", MODE="0660", TAG+="uaccess"
+# Wooting Two HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1222", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1222", MODE="0660", TAG+="uaccess"
+
+# Wooting Two HE update mode  
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="122f", MODE="0660", TAG+="uaccess"
+
+# Wooting Two HE (ARM)
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1230", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1230", MODE="0660", TAG+="uaccess"
+# Wooting Two HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1231", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1231", MODE="0660", TAG+="uaccess"
+# Wooting Two HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1232", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1232", MODE="0660", TAG+="uaccess"
+
+# Wooting Two HE (ARM) update mode  
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="123f", MODE="0660", TAG+="uaccess"
+
+# Wooting 60HE
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1300", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1300", MODE="0660", TAG+="uaccess"
+# Wooting 60HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1301", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1301", MODE="0660", TAG+="uaccess"
+# Wooting 60HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1302", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1302", MODE="0660", TAG+="uaccess"
+
+# Wooting 60HE update mode  
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="130f", MODE="0660", TAG+="uaccess"
+
+# Wooting 60HE (ARM)
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1310", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1310", MODE="0660", TAG+="uaccess"
+# Wooting 60HE (ARM) Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1311", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1311", MODE="0660", TAG+="uaccess"
+# Wooting 60HE (ARM) 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1312", MODE="0660", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1312", MODE="0660", TAG+="uaccess"
+
+# Wooting 60HE (ARM) update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="131f", MODE="0660", TAG+="uaccess"
diff --git a/system_files/shared/usr/lib/udev/rules.d/88-neutron_hifi_dac.rules b/system_files/shared/usr/lib/udev/rules.d/88-neutron_hifi_dac.rules
new file mode 100644
index 0000000..06b7321
--- /dev/null
+++ b/system_files/shared/usr/lib/udev/rules.d/88-neutron_hifi_dac.rules
@@ -0,0 +1,6 @@
+# Source: https://github.com/ublue-os/config/pull/285
+# Written by https://github.com/fiftydinar
+# Udev rule written for unprivileged access of Neutron HiFi DAC V1 functionality
+# https://neutronhifi.com/devices/dac/v1
+
+SUBSYSTEM=="usb", ATTRS{idVendor}=="1fc9", ATTRS{idProduct}=="82f9", MODE="0666"
diff --git a/system_files/shared/usr/lib/udev/rules.d/90-apple-superdrive.rules b/system_files/shared/usr/lib/udev/rules.d/90-apple-superdrive.rules
new file mode 100644
index 0000000..c0a1200
--- /dev/null
+++ b/system_files/shared/usr/lib/udev/rules.d/90-apple-superdrive.rules
@@ -0,0 +1,5 @@
+# Apple SuperDrive udev rule
+# Credits: @yookoala from GitHub
+# See: https://gist.github.com/yookoala/818c1ff057e3d965980b7fd3bf8f77a6
+
+ACTION=="add", ATTRS{idProduct}=="1500", ATTRS{idVendor}=="05ac", DRIVERS=="usb", RUN+="/usr/bin/sg_raw %r/sr%n EA 00 00 00 00 00 01"
diff --git a/system_files/shared/usr/lib/udev/rules.d/92-viia.rules b/system_files/shared/usr/lib/udev/rules.d/92-viia.rules
new file mode 100644
index 0000000..bcd05ab
--- /dev/null
+++ b/system_files/shared/usr/lib/udev/rules.d/92-viia.rules
@@ -0,0 +1,4 @@
+# Keychron keyboard hardware enablement
+# Created on https://github.com/ublue-os/config/pull/153
+# Written by https://github.com/atimeofday
+KERNEL=="hidraw*", SUBSYSTEM=="hidraw", MODE="0666", TAG+="uaccess", TAG+="udev-acl"
diff --git a/system_files/shared/usr/libexec/ublue-brew-trust-brewfile b/system_files/shared/usr/libexec/ublue-brew-trust-brewfile
new file mode 100755
index 0000000..2d26ac1
--- /dev/null
+++ b/system_files/shared/usr/libexec/ublue-brew-trust-brewfile
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Parses a Brewfile and trusts all declared taps via `brew trust --tap`.
+#
+# Usage: ublue-brew-trust-brewfile <path-to-Brewfile>
+
+set -euo pipefail
+
+brewfile="${1:?Usage: ublue-brew-trust-brewfile <path-to-Brewfile>}"
+
+if [[ ! -f "$brewfile" ]]; then
+  echo "ublue-brew-trust-brewfile: file not found: $brewfile" >&2
+  exit 1
+fi
+
+# Matches 'tap "foo/bar"'
+tap_pattern='^tap[[:space:]]+"([^"]+)"'
+
+while IFS= read -r line; do
+  if [[ "$line" =~ $tap_pattern ]]; then
+    tap="${BASH_REMATCH[1]}"
+    brew trust --tap "$tap"
+  fi
+done <"$brewfile"
diff --git a/system_files/shared/usr/share/color/icc/colord/framework13.icc b/system_files/shared/usr/share/color/icc/colord/framework13.icc
new file mode 100644
index 0000000..c9868a1
Binary files /dev/null and b/system_files/shared/usr/share/color/icc/colord/framework13.icc differ
diff --git a/system_files/shared/usr/share/color/icc/colord/framework16.icc b/system_files/shared/usr/share/color/icc/colord/framework16.icc
new file mode 100644
index 0000000..91ad5b2
Binary files /dev/null and b/system_files/shared/usr/share/color/icc/colord/framework16.icc differ
diff --git a/system_files/shared/usr/share/fish/vendor_conf.d/fish_greeting.fish b/system_files/shared/usr/share/fish/vendor_conf.d/fish_greeting.fish
new file mode 100644
index 0000000..ab67d2d
--- /dev/null
+++ b/system_files/shared/usr/share/fish/vendor_conf.d/fish_greeting.fish
@@ -0,0 +1,5 @@
+function fish_greeting
+    if test ! -e $HOME/.config/no-show-user-motd
+        ublue-motd
+    end
+end
diff --git a/system_files/shared/usr/share/fish/vendor_conf.d/ublue-fastfetch.fish b/system_files/shared/usr/share/fish/vendor_conf.d/ublue-fastfetch.fish
new file mode 100644
index 0000000..5a57b47
--- /dev/null
+++ b/system_files/shared/usr/share/fish/vendor_conf.d/ublue-fastfetch.fish
@@ -0,0 +1,3 @@
+alias neofetch='ublue-fastfetch'
+alias neowofetch='ublue-fastfetch'
+alias fastfetch='ublue-fastfetch'
diff --git a/system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policy b/system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policy
index 8905308..ba9f26b 100644
--- a/system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policy
+++ b/system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policy
@@ -15,7 +15,7 @@
       <allow_inactive>yes</allow_inactive>
       <allow_active>yes</allow_active>
     </defaults>
-    <annotate key="org.freedesktop.policykit.exec.path">/usr/libexec/ublue-privileged-user-setup</annotate>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/ublue-privileged-setup</annotate>
   </action>
 
 </policyconfig>
diff --git a/system_files/shared/usr/share/polkit-1/rules.d/20-privileged-user-setup.rules b/system_files/shared/usr/share/polkit-1/rules.d/20-privileged-user-setup.rules
new file mode 100644
index 0000000..e211e83
--- /dev/null
+++ b/system_files/shared/usr/share/polkit-1/rules.d/20-privileged-user-setup.rules
@@ -0,0 +1,10 @@
+polkit.addRule(function(action,subject) {
+    if ( (action.id == "org.freedesktop.policykit.exec") &&
+         (action.lookup("program") == "/usr/bin/ublue-privileged-setup") &&
+         (subject.isInGroup("wheel") ) ) {
+      return polkit.Result.YES;
+    }
+
+    return polkit.Result.NOT_HANDLED;
+  }
+);
diff --git a/system_files/shared/usr/share/polkit-1/rules.d/org.debian.pcsc-lite.access_card.rules b/system_files/shared/usr/share/polkit-1/rules.d/org.debian.pcsc-lite.access_card.rules
new file mode 100644
index 0000000..eae6454
--- /dev/null
+++ b/system_files/shared/usr/share/polkit-1/rules.d/org.debian.pcsc-lite.access_card.rules
@@ -0,0 +1,16 @@
+// allow members of the wheel group to access gpg cards via pcscd service
+// this is needed for access to yubikey devices
+// installation details from https://github.com/drduh/YubiKey-Guide/issues/376
+
+polkit.addRule(function(action, subject) {
+        if (action.id == "org.debian.pcsc-lite.access_card" &&
+                subject.isInGroup("wheel")) {
+                return polkit.Result.YES;
+        }
+});
+polkit.addRule(function(action, subject) {
+        if (action.id == "org.debian.pcsc-lite.access_pcsc" &&
+                subject.isInGroup("wheel")) {
+                return polkit.Result.YES;
+        }
+});
diff --git a/system_files/shared/usr/share/ublue-os/bling/bling.fish b/system_files/shared/usr/share/ublue-os/bling/bling.fish
new file mode 100644
index 0000000..1eef03a
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/bling/bling.fish
@@ -0,0 +1,45 @@
+#!/usr/bin/env fish
+
+if status is-interactive
+    test "$BLING_SOURCED" = 1; and return; or set -g BLING_SOURCED 1
+
+    function __bling_abbr -d "Create an abbreviation or alias"
+        test "$BLING_USE_ABBR" != 0; and abbr -a $argv; or alias $argv
+    end
+
+    # ls aliases
+    if type -q eza
+        __bling_abbr ll 'eza -l --icons=auto --group-directories-first'
+        __bling_abbr l. 'eza -d .*'
+        __bling_abbr ls 'eza'
+        __bling_abbr l1 'eza -1'
+    end
+
+    # ugrep for grep
+    if type -q ug
+        __bling_abbr grep 'ug'
+        __bling_abbr egrep 'ug -E'
+        __bling_abbr fgrep 'ug -F'
+        __bling_abbr xzgrep 'ug -z'
+        __bling_abbr xzegrep 'ug -zE'
+        __bling_abbr xzfgrep 'ug -zF'
+    end
+
+    # bat for cat
+    if type -q bat
+        __bling_abbr cat 'bat --style=plain --pager=never'
+    end
+
+    type -q direnv; and direnv hook fish | source    
+
+    # Atuin shell integration is disabled by default
+    # The atuin binary is still installed and available for manual use
+    # To enable shell integration, uncomment the following line or add it to your config.fish:
+    # type -q atuin; and atuin init fish $ATUIN_INIT_FLAGS | source
+
+    type -q starship; and starship init fish | source 
+
+    type -q zoxide; and zoxide init fish | source 
+
+    type -q mise; and test "$MISE_FISH_AUTO_ACTIVATE" != 0; and mise activate fish | source
+end
diff --git a/system_files/shared/usr/share/ublue-os/bling/bling.sh b/system_files/shared/usr/share/ublue-os/bling/bling.sh
new file mode 100755
index 0000000..8ccff54
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/bling/bling.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env sh
+
+# KEEP THIS POSIX - Needs to work on Bash and ZSH
+
+# Check if bling has already been sourced so that we dont break atuin. https://github.com/atuinsh/atuin/issues/380#issuecomment-1594014644
+[ "${BLING_SOURCED:-0}" -eq 1 ] && return 
+BLING_SOURCED=1
+
+# ls aliases
+if [ "$(command -v eza)" ]; then
+    alias ll='eza -l --icons=auto --group-directories-first'
+    alias l.='eza -d .*'
+    alias ls='eza'
+    alias l1='eza -1'
+fi
+
+# ugrep for grep
+if [ "$(command -v ug)" ]; then
+    alias grep='ug'
+    alias egrep='ug -E'
+    alias fgrep='ug -F'
+    alias xzgrep='ug -z'
+    alias xzegrep='ug -zE'
+    alias xzfgrep='ug -zF'
+fi
+
+# bat for cat
+if [ "$(command -v bat)" ]; then
+    alias cat='bat --style=plain --pager=never'
+fi
+
+# set ATUIN_INIT_FLAGS in your ~/.bashrc before ublue-bling is sourced.
+# Atuin allows these flags: "--disable-up-arrow" and/or "--disable-ctrl-r"
+ATUIN_INIT_FLAGS="${ATUIN_INIT_FLAGS:-}"
+
+BLING_SHELL="$(basename "$(readlink /proc/$$/exe)")"
+
+# Initialize direnv before bash-preexec to avoid PROMPT_COMMAND conflicts
+# See: https://github.com/rcaloras/bash-preexec/pull/143
+if [ "${BLING_SHELL}" = "bash" ]; then
+    [ -f "/etc/profile.d/bash-preexec.sh" ] && . "/etc/profile.d/bash-preexec.sh"
+    [ -f "/usr/share/bash-prexec" ] && . "/usr/share/bash-prexec"
+    [ -f "/usr/share/bash-prexec.sh" ] && . "/usr/share/bash-prexec.sh"
+    [ -f "${HOMEBREW_PREFIX}/etc/profile.d/bash-preexec.sh" ] && . "${HOMEBREW_PREFIX}/etc/profile.d/bash-preexec.sh"
+fi
+
+[ "$(command -v direnv)" ] && eval "$(direnv hook "${BLING_SHELL}")"
+# Atuin shell integration is disabled by default
+# The atuin binary is still installed and available for manual use
+# To enable shell integration, uncomment the following line or add it to your shell config:
+# [ "$(command -v atuin)" ] && eval "$(atuin init "${BLING_SHELL}" ${ATUIN_INIT_FLAGS})"
+[ "$(command -v starship)" ] && eval "$(starship init "${BLING_SHELL}")"
+[ "$(command -v zoxide)" ] && eval "$(zoxide init "${BLING_SHELL}")"
+
+if command -v mise >/dev/null 2>&1; then
+  # Check for Bash
+  if [ "${BLING_SHELL}" = "bash" ]; then
+    if [ "$MISE_BASH_AUTO_ACTIVATE" != "0" ]; then
+      eval "$(mise activate bash)"
+    fi
+
+    # Check for Zsh
+  elif [ "${BLING_SHELL}" = "zsh" ]; then
+    if [ "$MISE_ZSH_AUTO_ACTIVATE" != "0" ]; then
+      eval "$(mise activate zsh)"
+    fi
+  fi
+fi
diff --git a/system_files/shared/usr/share/ublue-os/homebrew/ai-tools.Brewfile b/system_files/shared/usr/share/ublue-os/homebrew/ai-tools.Brewfile
new file mode 100644
index 0000000..c32d04a
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/homebrew/ai-tools.Brewfile
@@ -0,0 +1,25 @@
+tap "anomalyco/tap"
+tap "charmbracelet/tap"
+tap "ublue-os/tap"
+tap "ublue-os/experimental-tap"
+brew "aichat"
+brew "anomalyco/tap/opencode"
+brew "block-goose-cli"
+brew "charmbracelet/tap/crush"
+brew "gemini-cli"
+brew "kimi-cli"
+brew "llm"
+brew "llmfit"
+brew "mistral-vibe"
+brew "qwen-code"
+brew "ramalama"
+brew "ublue-os/tap/linux-mcp-server"
+brew "whisper-cpp"
+cask "claude-code"
+cask "codex"
+cask "copilot-cli"
+cask "ublue-os/tap/antigravity-linux" 
+cask "ublue-os/experimental-tap/opencode-desktop-linux"
+cask "ublue-os/tap/goose-linux"
+cask "ublue-os/tap/lm-studio-linux"
+flatpak "ai.jan.Jan"
diff --git a/system_files/shared/usr/share/ublue-os/homebrew/artwork.Brewfile b/system_files/shared/usr/share/ublue-os/homebrew/artwork.Brewfile
new file mode 100644
index 0000000..91f42b7
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/homebrew/artwork.Brewfile
@@ -0,0 +1,7 @@
+tap "ublue-os/tap"
+
+cask "aurora-wallpapers"
+cask "bazzite-wallpapers"
+cask "bluefin-wallpapers"
+cask "bluefin-wallpapers-extra"
+cask "framework-wallpapers"
diff --git a/system_files/shared/usr/share/ublue-os/homebrew/cli.Brewfile b/system_files/shared/usr/share/ublue-os/homebrew/cli.Brewfile
new file mode 100644
index 0000000..34f5e40
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/homebrew/cli.Brewfile
@@ -0,0 +1,20 @@
+brew "atuin"
+brew "bat"
+brew "bash-preexec"
+brew "bbrew"
+brew "chezmoi"
+brew "direnv"
+brew "dysk"
+brew "eza"
+brew "fd"
+brew "gh"
+brew "podman-tui"
+brew "ripgrep"
+brew "starship"
+brew "tealdeer"
+brew "trash-cli"
+brew "uutils-coreutils"
+brew "ugrep"
+brew "yq"
+brew "zoxide"
+brew "mise"
diff --git a/system_files/shared/usr/share/ublue-os/homebrew/cncf.Brewfile b/system_files/shared/usr/share/ublue-os/homebrew/cncf.Brewfile
new file mode 100644
index 0000000..e049f9f
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/homebrew/cncf.Brewfile
@@ -0,0 +1,293 @@
+# CNCF Projects Brewfile
+# Generated from CNCF Landscape data
+# https://landscape.cncf.io/
+#
+# This Brewfile contains Homebrew formulas for CNCF projects organized by maturity level.
+# To install all formulas: brew bundle --file=cncf.Brewfile
+# To install specific sections, edit this file to comment out unwanted formulas.
+
+# === TAPS ===
+# Taps for CNCF projects not in homebrew-core
+tap "dapr/tap"
+tap "buildpacks/tap"
+tap "carvel-dev/carvel"
+tap "kitops-ml/kitops"
+tap "microcks/tap"
+tap "telepresenceio/telepresence"
+tap "k0sproject/tap"
+tap "kptdev/kpt", "https://github.com/kptdev/kpt.git"
+tap "wasmcloud/wasmcloud"
+tap "artifacthub/cmd"
+tap "pingcap/brew"
+# === GRADUATED PROJECTS ===
+
+# Argo
+brew "argo"
+brew "argocd"
+
+# Cilium
+brew "cilium-cli"
+
+# CoreDNS
+brew "coredns"
+
+# Crossplane
+brew "crossplane"
+
+# CubeFS
+# brew "cubefsctl" # No Homebrew formula found
+
+# Dapr
+brew "dapr/tap/dapr-cli"
+
+# CRI-O (via cri-tools)
+brew "cri-tools"
+
+# Dragonfly
+# brew "dragonfly" # P2P system (d7y) not available via brew. 'dragonfly' is DragonflyDB.
+
+# Envoy
+brew "envoy"
+
+# Falco
+brew "falco"
+
+# Fluentd
+# Not available via brew
+# brew "td-agent" Warning: td-agent has been deprecated because it is discontinued upstream! It will be disabled on 2026-03-01.
+
+# Flux
+brew "flux"
+
+# Harbor
+brew "harbor-cli"
+
+# Helm
+brew "helm"
+
+# Istio
+brew "istioctl"
+
+# Jaeger
+# brew "jaeger" # No all-in-one formula. Use Docker or 'jaeger-client' lib.
+
+# KEDA
+# brew "keda" # Use Helm
+
+# Knative
+brew "kn"
+
+# KubeEdge
+# brew "kubeedge" # Use manual install (keadm)
+
+# Kubernetes
+brew "kubernetes-cli"
+brew "minikube"
+brew "kind"
+
+# Linkerd
+brew "linkerd"
+
+# Open Policy Agent (OPA)
+brew "opa"
+
+# Prometheus
+brew "prometheus"
+
+# SPIRE
+# brew "spire" # Use manual install (spire-server/agent)
+
+# Vitess
+brew "vitess"
+
+# cert-manager
+brew "cmctl"
+
+# containerd
+brew "nerdctl"
+
+# etcd
+brew "etcd"
+
+# in-toto
+# brew "in-toto" # Use pip install in-toto
+
+# === INCUBATING PROJECTS ===
+
+# Artifact Hub
+brew "artifacthub/cmd/ah"
+
+# Buildpacks
+brew "buildpacks/tap/pack"
+
+# Chaos Mesh
+# brew "chaos-mesh" # Use Helm
+
+# Cloud Custodian
+brew "c7n"
+
+# Container Network Interface (CNI)
+# brew "cni" # Manual install of plugins
+
+# Contour
+# brew "contour" # Use Helm/kubectl
+
+# Cortex
+brew "cortex"
+
+# Karmada
+brew "karmadactl"
+
+# Keycloak
+# brew "keycloak" # Use Docker or manual install
+
+# KubeVela
+brew "kubevela"
+
+# KubeVirt (virtctl)
+brew "virtctl"
+
+# Kubescape
+brew "kubescape"
+
+# Kyverno
+brew "kyverno"
+
+# Lima
+brew "lima"
+
+# Litmus
+brew "litmusctl"
+
+# Longhorn
+# brew "longhornctl" # Manual install or Krew
+
+# NATS
+brew "nats-server"
+
+# Notary Project
+brew "notation"
+
+# OpenCost
+# brew "opencost" # Use Helm
+
+# OpenFGA
+brew "openfga"
+
+# OpenTelemetry
+brew "opentelemetry-cpp"
+
+# Operator Framework
+brew "operator-sdk"
+
+# Thanos
+brew "thanos"
+
+# gRPC
+brew "grpc"
+
+# wasmCloud
+brew "wasmcloud/wasmcloud/wash"
+
+# === SANDBOX PROJECTS ===
+
+# Antrea
+# brew "antrea" # Use Helm. 'antctl' available via curl.
+
+# Atlantis
+brew "atlantis"
+
+# CDK for Kubernetes (CDK8s)
+brew "cdk8s"
+
+# Carvel
+brew  "carvel-dev/carvel/kwt"
+brew "carvel-dev/carvel/kctrl"
+brew "carvel-dev/carvel/ytt"
+brew "carvel-dev/carvel/kapp"
+brew "carvel-dev/carvel/kbld"
+brew "carvel-dev/carvel/imgpkg"
+brew "carvel-dev/carvel/vendir"
+
+# CloudNativePG
+brew "kubectl-cnpg"
+
+# DevSpace
+brew "devspace"
+
+# K8sGPT
+brew "k8sgpt"
+
+# KitOps
+brew "kitops-ml/kitops/kitops"
+
+# KubeArmor
+# brew "kubearmor" # Use karmor CLI via curl
+
+# Kuberhealthy
+# brew "kuberhealthy" # Use Helm
+
+# Kubewarden
+brew "kwctl"
+
+# Kuma
+brew "kumactl"
+
+# Kured
+# Kured
+# brew "kured" # Use Helm
+
+# Meshery
+brew "mesheryctl"
+
+# Microcks
+brew "microcks/tap/microcks-cli"
+
+# Porter
+brew "porter"
+
+# Telepresence
+brew "telepresenceio/telepresence/telepresence-oss"
+
+# Tremor
+# Tremor
+brew "tremor-runtime"
+
+# WasmEdge Runtime
+brew "wasmedge"
+
+# k0s
+brew "k0sproject/tap/k0sctl"
+
+# k3s (via k3d)
+brew "k3d"
+
+# k8gb
+# brew "k8gb" # Use Helm
+
+# ko
+brew "ko"
+
+# kpt
+brew "kptdev/kpt/kpt"
+
+# kube-vip
+# brew "kube-vip" # In-cluster deployment
+
+# === SUMMARY ===
+# Graduated: 31 formulas
+# Incubating: 25 formulas
+# Sandbox: 33 formulas
+# Total: 89 formulas
+
+# === FLATPAKS ===
+# Graphical tools for CNCF projects and cloud-native development
+
+# Headlamp (CNCF Sandbox) - Kubernetes UI
+flatpak "io.kinvolk.Headlamp"
+
+# OpenLens - Kubernetes IDE
+flatpak "dev.k8slens.OpenLens"
+
+# Podman Desktop - Container Management
+flatpak "io.podman_desktop.PodmanDesktop"
diff --git a/system_files/shared/usr/share/ublue-os/homebrew/experimental-ide.Brewfile b/system_files/shared/usr/share/ublue-os/homebrew/experimental-ide.Brewfile
new file mode 100644
index 0000000..1614526
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/homebrew/experimental-ide.Brewfile
@@ -0,0 +1,15 @@
+tap "ublue-os/experimental-tap"
+cask "ublue-os/experimental-tap/cursor-linux"
+cask "ublue-os/experimental-tap/clion-linux"
+cask "ublue-os/experimental-tap/datagrip-linux"
+cask "ublue-os/experimental-tap/dataspell-linux"
+cask "ublue-os/experimental-tap/emacs-app-linux"
+cask "ublue-os/experimental-tap/goland-linux"
+cask "ublue-os/experimental-tap/intellij-idea-linux"
+cask "ublue-os/experimental-tap/phpstorm-linux"
+cask "ublue-os/experimental-tap/pycharm-linux"
+cask "ublue-os/experimental-tap/rider-linux"
+cask "ublue-os/experimental-tap/rubymine-linux"
+cask "ublue-os/experimental-tap/rustrover-linux"
+cask "ublue-os/experimental-tap/webstorm-linux"
+cask "ublue-os/experimental-tap/zed-linux"
diff --git a/system_files/shared/usr/share/ublue-os/homebrew/fonts.Brewfile b/system_files/shared/usr/share/ublue-os/homebrew/fonts.Brewfile
new file mode 100644
index 0000000..909a5d4
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/homebrew/fonts.Brewfile
@@ -0,0 +1,11 @@
+cask "font-caskaydia-mono-nerd-font"
+cask "font-comic-shanns-mono-nerd-font"
+cask "font-droid-sans-mono-nerd-font"
+cask "font-go-mono-nerd-font"
+cask "font-blex-mono-nerd-font"
+cask "font-sauce-code-pro-nerd-font"
+cask "font-source-code-pro"
+cask "font-ubuntu-nerd-font"
+cask "font-fira-code-nerd-font"
+cask "font-0xproto-nerd-font"
+cask "font-jetbrains-mono-nerd-font"
diff --git a/system_files/shared/usr/share/ublue-os/homebrew/ide.Brewfile b/system_files/shared/usr/share/ublue-os/homebrew/ide.Brewfile
new file mode 100644
index 0000000..1ae61ca
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/homebrew/ide.Brewfile
@@ -0,0 +1,10 @@
+tap "ublue-os/tap"
+cask "ublue-os/tap/visual-studio-code-linux"
+cask "ublue-os/tap/visual-studio-code-linux@insiders"
+cask "ublue-os/tap/vscodium-linux"
+cask "ublue-os/tap/antigravity-linux"
+cask "ublue-os/tap/jetbrains-toolbox-linux"
+brew "nvim"
+brew "micro" 
+brew "helix" 
+brew "devcontainer"
diff --git a/system_files/shared/usr/share/ublue-os/homebrew/k8s-tools.Brewfile b/system_files/shared/usr/share/ublue-os/homebrew/k8s-tools.Brewfile
new file mode 100644
index 0000000..2ba8b47
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/homebrew/k8s-tools.Brewfile
@@ -0,0 +1,14 @@
+tap "buildpacks/tap"
+brew "kind"
+brew "cdk8s"
+tap "k0sproject/tap"
+brew "k0sproject/tap/k0sctl"
+brew "k3sup"
+brew "dagger"
+brew "grype"
+brew "helm"
+brew "kubectl"
+brew "k9s"
+brew "kubectx"
+brew "buildpacks/tap/pack"
+brew "syft"
diff --git a/system_files/shared/usr/share/ublue-os/homebrew/swift.Brewfile b/system_files/shared/usr/share/ublue-os/homebrew/swift.Brewfile
new file mode 100644
index 0000000..3ff738e
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/homebrew/swift.Brewfile
@@ -0,0 +1,9 @@
+# Swift Development Environment
+# Install with: ujust swift
+
+# Swift toolchain management (official Swift installer)
+brew "swiftly"
+
+# Code quality tools
+brew "swiftlint"
+brew "swiftformat"
diff --git a/system_files/shared/usr/share/ublue-os/just/00-entry.just b/system_files/shared/usr/share/ublue-os/just/00-entry.just
index 65266b1..e5a321c 100644
--- a/system_files/shared/usr/share/ublue-os/just/00-entry.just
+++ b/system_files/shared/usr/share/ublue-os/just/00-entry.just
@@ -7,10 +7,8 @@ _default:
     ujust --list --list-heading $'Available commands:\n' --list-prefix $' - '
 
 # Imports
-# specific to Aurora
 import "/usr/share/ublue-os/just/changelog.just"
 import "/usr/share/ublue-os/just/system.just"
-# shared with bluefin
 import "/usr/share/ublue-os/just/apps.just"
 import "/usr/share/ublue-os/just/default.just"
 import "/usr/share/ublue-os/just/shared.just"
diff --git a/system_files/shared/usr/share/ublue-os/just/apps.just b/system_files/shared/usr/share/ublue-os/just/apps.just
new file mode 100644
index 0000000..fb2ef98
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/just/apps.just
@@ -0,0 +1,80 @@
+# vim: set ft=make :
+
+# alias for install-jetbrains-toolbox
+[group('Apps')]
+jetbrains-toolbox:
+    @ujust install-jetbrains-toolbox
+
+# Install JetBrains Toolbox | https://www.jetbrains.com/toolbox-app/
+[group('Apps')]
+install-jetbrains-toolbox:
+    #!/usr/bin/env bash
+    brew trust --tap ublue-os/homebrew-tap
+    brew tap ublue-os/homebrew-tap
+    brew install --cask jetbrains-toolbox-linux
+
+# Install OpenTabletDriver, an open source, cross-platform, user-mode tablet driver
+[group('Apps')]
+install-opentabletdriver:
+    #!/usr/bin/bash
+    gum confirm --affirmative="Install" --negative="Uninstall" "Installer for OpenTabletDriver"
+    EXIT_CODE="$?"
+
+    if [ "${EXIT_CODE}" == 0 ] ; then
+      echo "Installing OpenTabletDriver..."
+
+      OTD_TMPDIR="$(mktemp -d)"
+
+      curl -s "https://api.github.com/repos/OpenTabletDriver/OpenTabletDriver/releases/latest" \
+        | jq -r '.assets[] | select(.name | test("opentabletdriver.*tar.gz$")) | .browser_download_url' \
+        | xargs curl -L -s \
+        | tar --strip-components=1 -xvzf - -C "${OTD_TMPDIR}"
+
+      # https://opentabletdriver.net/Wiki/Documentation/RequiredPermissions
+      sudo cp "${OTD_TMPDIR}/etc/udev/rules.d/70-opentabletdriver.rules" /etc/udev/rules.d/71-opentabletdriver.rules
+      echo -ne "blacklist hid_uclogic\nblacklist wacom\n" | sudo tee /etc/modprobe.d/blacklist-opentabletdriver.conf
+      rm -rf "${OTD_TMPDIR}"
+
+      flatpak --system install -y flathub net.opentabletdriver.OpenTabletDriver
+
+      mkdir -p "$HOME/.config/systemd/user"
+      curl -s "https://raw.githubusercontent.com/flathub/net.opentabletdriver.OpenTabletDriver/refs/heads/master/scripts/opentabletdriver.service" > "$HOME/.config/systemd/user/opentabletdriver.service"
+
+      systemctl --user daemon-reload
+      systemctl enable --user --now opentabletdriver.service
+    elif [ "${EXIT_CODE}" == 1 ] ; then
+      echo "Uninstalling OpenTabletDriver..."
+      sudo rm -f /etc/modprobe.d/blacklist-opentabletdriver.rules /etc/udev/rules.d/71-opentabletdriver.rules
+      flatpak --system remove -y flathub net.opentabletdriver.OpenTabletDriver
+    fi
+
+# Install applications from curated Brewfiles (includes full-desktop.Brewfile with GNOME Circle apps)
+bbrew:
+    #!/usr/bin/env bash
+    if ! command -v bbrew &>/dev/null ; then
+        if gum confirm "Bold Brew is not installed, would you like to install it?" ; then
+            set -e
+            brew trust --tap Valkyrie00/homebrew-bbrew
+            brew install Valkyrie00/homebrew-bbrew/bbrew
+            set +e
+        else
+            exit 0
+        fi
+    fi
+    echo "Note: Some of these take a while to load, we'll keep working on it."
+    CHOSEN="$(gum choose $(find "/usr/share/ublue-os/homebrew"/*.Brewfile -exec basename '{}' '.Brewfile' ';'))"
+    BREWFILE="/usr/share/ublue-os/homebrew/${CHOSEN}.Brewfile"
+    /usr/libexec/ublue-brew-trust-brewfile "$BREWFILE"
+    bbrew -f "$BREWFILE"
+
+cncf:
+    #!/usr/bin/env bash
+    if ! command -v bbrew &>/dev/null ; then
+        if gum confirm "Bold Brew is not installed, would you like to install it?" ; then
+            brew install bbrew
+        else
+            exit 0
+        fi
+    fi
+    /usr/libexec/ublue-brew-trust-brewfile "/usr/share/ublue-os/homebrew/cncf.Brewfile"
+    bbrew -f "/usr/share/ublue-os/homebrew/cncf.Brewfile"
diff --git a/system_files/shared/usr/share/ublue-os/just/default.just b/system_files/shared/usr/share/ublue-os/just/default.just
new file mode 100644
index 0000000..1449cef
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/just/default.just
@@ -0,0 +1,191 @@
+# vim: set ft=make :
+
+uid := `id -u`
+shell := `grep :$(id -u): /etc/passwd | cut -d: -f7`
+
+# Boot into this device's BIOS/UEFI screen
+bios:
+    #!/usr/bin/bash
+    if [ ! -d /sys/firmware/efi ]; then
+      echo "Rebooting to legacy BIOS from OS is not supported."
+      exit 1
+    fi
+
+    if gum confirm "Reboot into BIOS?" ; then
+      systemctl reboot --firmware-setup
+    fi
+
+# Show BIOS info
+bios-info:
+    #!/usr/bin/bash
+    sudo bash <<'EOF'
+    echo "Manufacturer: $(dmidecode -s baseboard-manufacturer)"
+    echo "Product Name: $(dmidecode -s baseboard-product-name)"
+    echo "Version: $(dmidecode -s bios-version)"
+    echo "Release Date: $(dmidecode -s bios-release-date)"
+    EOF
+
+clean-system:
+    #!/usr/bin/bash
+    if gum confirm "Prune all Podman images and volumes?"; then
+        echo "Images that would be pruned:"
+        podman image ls --filter dangling=true --format "{{{{.Repository}}}}:{{{{.Tag}}}}  {{{{.ID}}}}" 2>/dev/null | head -20
+        echo "Volumes that would be pruned:"
+        podman volume ls --filter dangling=true --quiet 2>/dev/null | head -20
+        if gum confirm "Proceed with pruning Podman images and volumes?"; then
+            podman image prune -af
+            podman volume prune -f
+        fi
+    fi
+
+    if command -v docker >/dev/null 2>&1; then
+      if gum confirm "Prune all Docker images and volumes?"; then
+        echo "Images that would be pruned:"
+        docker image ls --filter dangling=true --format "{{{{.Repository}}}}:{{{{.Tag}}}}  {{{{.ID}}}}" 2>/dev/null | head -20
+        echo "Volumes that would be pruned:"
+        docker volume ls --filter dangling=true --quiet 2>/dev/null | head -20
+        if gum confirm "Proceed with pruning Docker images and volumes?"; then
+            docker image prune -af
+            docker volume prune -f
+        fi
+      fi
+    fi
+
+    flatpak uninstall --unused
+    rpm-ostree cleanup -bm
+    if [ -x /home/linuxbrew/.linuxbrew/bin/brew ]; then
+        brew autoremove
+        brew cleanup
+    fi
+
+# Show all messages from this boot
+logs-this-boot:
+    sudo journalctl --no-hostname -b 0
+
+# Show all messages from last boot
+logs-last-boot:
+    sudo journalctl --no-hostname -b -1
+
+# Enroll Nvidia driver & KMOD signing key for secure boot - Enter password "universalblue" if prompted
+enroll-secure-boot-key:
+    #!/usr/bin/bash
+    ENROLLMENT_PASSWORD="universalblue"
+    sudo bash <<EOF
+    mokutil --timeout -1
+    echo -e "$ENROLLMENT_PASSWORD\n$ENROLLMENT_PASSWORD" | mokutil --import "/etc/pki/akmods/certs/akmods-ublue.der"
+    EOF
+    echo 'At next reboot, the mokutil UEFI menu UI will be displayed (*QWERTY* keyboard input and navigation).\nThen, select "Enroll MOK", and input "universalblue" as the password'
+
+# Toggle display of the user-motd in terminal
+toggle-user-motd:
+    #!/usr/bin/bash
+    if [ -e "${HOME}/.config/no-show-user-motd" ] ; then
+      if gum confirm "Would you like to enable the MOTD?" ; then
+        rm -f "${HOME}/.config/no-show-user-motd"
+        echo "MOTD will now be shown on login."
+        exit 0
+      fi
+    fi
+    if gum confirm "Would you like to disable the MOTD?" ; then
+      mkdir -p "${HOME}/.config"
+      touch "${HOME}/.config/no-show-user-motd"
+      echo "MOTD will not be shown anymore."
+      exit 0
+    fi
+
+# Check for local overrides
+check-local-overrides:
+    #!/usr/bin/bash
+    RESET="\x1b[0m"
+    if [ "${NO_COLOR}" == 1 ]; then
+        BLUE_COLOR=""
+        GREEN_COLOR=""
+        YELLOW_COLOR=""
+    else
+        BLUE_COLOR="${BLUE_COLOR:-\x1b[38;5;117m}"
+        GREEN_COLOR="${GREEN_COLOR:-\x1b[38;5;85m}"
+        YELLOW_COLOR="${YELLOW_COLOR:-\x1b[93m}"
+    fi
+
+    diff -qr \
+      --suppress-common-lines \
+      --color="always" \
+      --exclude "passwd*" \
+      --exclude "group*" \
+      --exclude="subgid*" \
+      --exclude="subuid*" \
+      --exclude="machine-id" \
+      --exclude="adjtime" \
+      --exclude="fstab" \
+      --exclude="system-connections" \
+      --exclude="shadow*" \
+      --exclude="gshadow*" \
+      --exclude="ssh_host*" \
+      --exclude="cmdline" \
+      --exclude="crypttab" \
+      --exclude="hostname" \
+      --exclude="localtime" \
+      --exclude="locale*" \
+      --exclude="*lock" \
+      --exclude=".updated" \
+      --exclude="*LOCK" \
+      --exclude="vconsole*" \
+      --exclude="00-keyboard.conf" \
+      --exclude="grub" \
+      --exclude="system.control*" \
+      --exclude="cdi" \
+      --exclude="default.target" \
+      /usr/etc /etc 2>/dev/null | sed \
+          -e '/Binary\ files\ /d ; /Common subdirectories/d' \
+          -e "/Files/ s/^/${BLUE_COLOR}&/g" \
+          -e "/Files/ s/\$/&${RESET}/g" \
+          -e "/Only in/ s/^/${GREEN_COLOR}&/g" \
+          -e "/Only in/ s/\$/&${RESET}/g" \
+          -e "s/\:.*/${RESET}${YELLOW_COLOR}&${RESET}/g"
+
+# Gather device info to a pastebin
+device-info:
+    #!/usr/bin/bash
+    if ! gum confirm "Submit information to the CentOS pastebin?" ; then
+        exit 0
+    fi
+
+    cat &> /tmp/deviceinfo-out <<EOF
+    --#--# sudo bootc status --verbose:
+    $(sudo bootc status --verbose)
+    --#--# fpaste --sysinfo --printonly:
+    $(fpaste --sysinfo --printonly)
+    --#--# flatpak list --columns=application,version,options:
+    $(flatpak list --columns=application,version,options)
+    EOF
+
+    cat /tmp/deviceinfo-out | fpaste
+
+# Measure Idle Power Draw
+check-idle-power-draw:
+    #!/usr/bin/bash
+    if ! command -v powerstat ; then
+        echo "Powerstat is not available"
+        exit 1
+    fi
+    sudo powerstat -a -r
+
+# Run a one minute system benchmark
+[group('System')]
+benchmark:
+    #!/usr/bin/env bash
+    if ! command -v "stress-ng" ; then
+        if gum confirm "Stress does not seem to be on your path, do you wish to install it?" ; then
+            set -eu
+            brew install stress-ng
+            brew link stress-ng
+            set +eu
+        else
+            exit 0
+        fi
+    fi
+
+    echo "Running a 1 minute benchmark ..."
+    trap popd EXIT
+    pushd "$(mktemp -d)"
+    stress-ng --matrix 0 -t 1m --times
diff --git a/system_files/shared/usr/share/ublue-os/just/shared.just b/system_files/shared/usr/share/ublue-os/just/shared.just
new file mode 100644
index 0000000..09a45a2
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/just/shared.just
@@ -0,0 +1,22 @@
+# vim: set ft=make :
+
+# Toggle LUKS auto-unlock via TPM2
+[group('System')]
+toggle-tpm2:
+    @/usr/bin/luks-tpm2-autounlock
+
+# Factory reset this device (experimental)
+[group('System')]
+powerwash:
+    #!/usr/bin/bash
+    FIRST_CONFIRMATION=$(gum choose --header='Warning: This is an experimental feature that will reset this device to its factory state.' "No" "Yes - wipe this machine")
+    if [[ "$FIRST_CONFIRMATION" != "Yes - wipe this machine" ]]; then
+        echo "Powerwash cancelled."
+        exit 0
+    fi
+    SECOND_CONFIRMATION=$(gum choose --header='Are you sure?' "No" "Yes - wipe this machine")
+    if [[ "$SECOND_CONFIRMATION" != "Yes - wipe this machine" ]]; then
+        echo "Powerwash cancelled."
+        exit 0
+    fi
+    sudo bootc install reset --experimental
diff --git a/system_files/shared/usr/share/ublue-os/just/update.just b/system_files/shared/usr/share/ublue-os/just/update.just
new file mode 100644
index 0000000..ea1bdf8
--- /dev/null
+++ b/system_files/shared/usr/share/ublue-os/just/update.just
@@ -0,0 +1,64 @@
+# vim: set ft=make :
+
+alias upgrade := update
+
+# Update system, flatpaks and homebrew packages all at once
+update:
+    #!/usr/bin/bash
+    if systemctl cat -- uupd.timer &> /dev/null; then
+        SERVICE="uupd.service"
+    else
+        SERVICE="rpm-ostreed-automatic.service"
+    fi
+    if systemctl is-active --quiet "$SERVICE"; then
+        echo "automatic updates are currently running, use \`journalctl -fexu $SERVICE\` to see logs"
+        exit 1
+    fi
+    if command -v rpm-ostree >/dev/null 2>&1 && [ -f /etc/rpm-ostreed.conf ] && grep -q -E -e "^[[:space:]]*LockLayering[[:space:]]*=[[:space:]]*true([[:space:]]*(#.*)?)?$" /etc/rpm-ostreed.conf ; then
+        sudo bootc upgrade
+    else
+        rpm-ostree upgrade
+    fi
+    # rpm-ostree used due to bootc upgrade not supporting local layered packages
+    # Updates system Flatpaks
+    if flatpak remotes | grep -q system; then
+        flatpak update -y
+    fi
+    # Update user Flatpaks
+    if flatpak remotes | grep -q user; then
+        flatpak update --user -y
+    fi
+    # Guard Brew if the user does not own brew/doesn't exist
+    if [[ -O /var/home/linuxbrew/.linuxbrew/bin/brew ]]; then
+        # Upgrade will run brew update if needed
+        /var/home/linuxbrew/.linuxbrew/bin/brew upgrade -y
+    fi
+
+alias auto-update := toggle-updates
+
+# Turn automatic updates on or off
+toggle-updates ACTION="prompt":
+    #!/usr/bin/bash
+    CURRENT_STATE="disabled"
+    if systemctl is-enabled -q rpm-ostreed-automatic.timer; then
+        CURRENT_STATE="enabled"
+    elif systemctl is-enabled -q uupd.timer; then
+        CURRENT_STATE="enabled"
+    fi
+
+    echo "Automatic updates are currently ${CURRENT_STATE}"
+    SELECTED_OPTION="$(gum choose --header="Toggle automatic updates?" "Enable" "Disable" "Cancel")"
+    [[ "${SELECTED_OPTION}" == "Cancel" || "${SELECTED_OPTION}" == "" ]] && exit 0
+
+    if systemctl cat -- uupd.timer &> /dev/null; then
+        TIMER="uupd.timer"
+    else
+        TIMER="rpm-ostreed-automatic.timer"
+    fi
+    if [ "${SELECTED_OPTION}" == "Enable" ] ; then
+        sudo systemctl enable "$TIMER"
+        echo "Updates have been enabled"
+    elif [ "${SELECTED_OPTION}" == "Disable" ] ; then
+        sudo systemctl disable "$TIMER"
+        echo "Updates have been disabled"
+    fi