diff --git a/.chezmoiscripts/run_once_after_dock.sh b/.chezmoiscripts/run_once_after_dock.sh
index 0ec4b45..061387c 100755
--- a/.chezmoiscripts/run_once_after_dock.sh
+++ b/.chezmoiscripts/run_once_after_dock.sh
@@ -29,9 +29,10 @@ defaults write com.apple.dock show-recents -bool false
 
 add_app_to_dock "Chrome"
 add_app_to_dock "Ghostty"
-add_app_to_dock "Visual Studio Code"
 add_app_to_dock "Obsidian"
+add_app_to_dock "Visual Studio Code"
 add_app_to_dock "Slack"
+add_app_to_dock "Claude"
 add_app_to_dock "Spotify"
 add_folder_to_dock "$HOME/Downloads"
 
diff --git a/.chezmoiscripts/run_onchange_after_tmux.sh.tmpl b/.chezmoiscripts/run_onchange_after_tmux.sh.tmpl
new file mode 100755
index 0000000..d2c066e
--- /dev/null
+++ b/.chezmoiscripts/run_onchange_after_tmux.sh.tmpl
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# dot_tmux.conf hash: {{ include "dot_tmux.conf" | sha256sum }}
+set -e
+{{- if eq .chezmoi.arch "arm64" }}
+eval "$(/opt/homebrew/bin/brew shellenv)"
+{{- else }}
+eval "$(/usr/local/bin/brew shellenv)"
+{{- end }}
+
+if [ ! -d "$HOME/.tmux/plugins/tpm" ]; then
+    git clone https://github.com/tmux-plugins/tpm ~/.tmux/plugins/tpm
+fi
+
+"$HOME/.tmux/plugins/tpm/bin/install_plugins"
diff --git a/.chezmoiscripts/run_onchange_before_packages.sh.tmpl b/.chezmoiscripts/run_onchange_before_packages.sh.tmpl
index b91f7f2..9f652c3 100755
--- a/.chezmoiscripts/run_onchange_before_packages.sh.tmpl
+++ b/.chezmoiscripts/run_onchange_before_packages.sh.tmpl
@@ -19,10 +19,6 @@ fi
 
 $(brew --prefix)/opt/fzf/install --key-bindings --completion --no-update-rc || true
 
-if [ ! -d "$HOME/.tmux/plugins/tpm" ]; then
-    git clone https://github.com/tmux-plugins/tpm ~/.tmux/plugins/tpm
-fi
-
 brew cleanup || true
 
 echo "Homebrew packages installed"
diff --git a/README.md b/README.md
index b251be2..b42e5a0 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
   </a>
 </p>
 
-**Already using these?** `chezmoi update && chezmoi apply`
+**Already using these?** `chezmoi update`
 
 ---
 
@@ -16,6 +16,15 @@
 
 ### 1. Before leaving the old Mac
 
+Check the repo has everything:
+
+```bash
+chezmoi status                                   # managed files edited outside the repo → chezmoi re-add
+brew bundle cleanup --file ~/.dotfiles/Brewfile  # installed but not in Brewfile → add or ignore
+```
+
+Never pass `--force` to `cleanup`. It uninstalls everything unlisted, including Apple's apps.
+
 Save these to 1Password:
 
 - Raycast settings: Settings → Advanced → Export (`.rayconfig` file)
@@ -64,16 +73,12 @@ Then open Terminal and run each command **one at a time**. Wait for each to fini
 
 Close Terminal and open Ghostty. Your shell config loads from here on.
 
-1. Add your SSH key to GitHub. Git uses SSH for every GitHub URL, so clones fail until this is done.
-   ```bash
-   pbcopy < ~/.ssh/id_ed25519.pub   # paste at https://github.com/settings/ssh/new
-   ssh -T git@github.com            # answer "yes" to trust GitHub
-   ```
-2. Install runtimes. This step failed during install because the key didn't exist yet.
-   ```bash
-   cut -d' ' -f1 ~/.tool-versions | xargs -n1 asdf plugin add; asdf install
-   ```
-3. Start `tmux` and press `prefix + I` to install its plugins.
+Add your SSH key to GitHub. Git pushes to GitHub over SSH.
+
+```bash
+pbcopy < ~/.ssh/id_ed25519.pub   # paste at https://github.com/settings/ssh/new
+ssh -T git@github.com            # answer "yes" to trust GitHub
+```
 
 ### 5. Set up apps
 
@@ -90,6 +95,25 @@ These need a login or a manual step:
 
 Work tools stay out of this repo. Set them up on the work Mac.
 
+## Existing Mac
+
+Adds what's missing. Preview first: `~` may hold edits you want to keep.
+
+1. Clone without applying.
+   ```bash
+   brew install chezmoi
+   chezmoi init --source ~/.dotfiles helderberto
+   ```
+2. Preview changes to `~`. Move machine-only bits to `~/.private` first.
+   ```bash
+   chezmoi diff
+   ```
+3. Sign in to the App Store, then apply. `brew bundle` installs only what's missing.
+   ```bash
+   chezmoi apply
+   ```
+4. Do [steps 4 and 5](#4-finish-in-ghostty) for anything not set up yet.
+
 ---
 
 <details>
diff --git a/dot_gitconfig b/dot_gitconfig
index 8d3776a..9e56b1d 100644
--- a/dot_gitconfig
+++ b/dot_gitconfig
@@ -110,4 +110,4 @@
   al = config --get-regexp alias
   alf = config --get-regexp alias | grep
 [url "git@github.com:"]
-	insteadOf = https://github.com/
+	pushInsteadOf = https://github.com/
diff --git a/test-chezmoi.sh b/test-chezmoi.sh
index 06796aa..19480e8 100755
--- a/test-chezmoi.sh
+++ b/test-chezmoi.sh
@@ -215,6 +215,12 @@ if $POST_APPLY; then
         fi
     done
 
+    if brew bundle check --file "$CHEZMOI_SOURCE/Brewfile" >/dev/null 2>&1; then
+        pass "Brewfile satisfied"
+    else
+        fail "Brewfile has missing packages (brew bundle check --verbose)"
+    fi
+
     # Zsh plugin paths (referenced in dot_zshrc)
     ZSH_PLUGINS=(
         "/opt/homebrew/share/powerlevel10k/powerlevel10k.zsh-theme"
@@ -246,6 +252,10 @@ if $POST_APPLY; then
         fail "TPM missing (~/.tmux/plugins/tpm)"
     fi
 
+    while read -r plugin; do
+        [ -d "$HOME/.tmux/plugins/${plugin##*/}" ] && pass "tmux plugin ${plugin##*/}" || fail "tmux plugin ${plugin##*/} missing"
+    done < <(sed -n "s/^set -g @plugin '\(.*\)'/\1/p" "$HOME/.tmux.conf")
+
     # Workspace
     if [ -d "$HOME/workspace" ]; then
         pass "~/workspace exists"
@@ -279,6 +289,13 @@ else
     fail "dot_gitconfig has stray template syntax"
 fi
 
+if grep -q "pushInsteadOf = https://github.com/" "$GITCONFIG" && \
+   ! grep -qE "^[[:space:]]*insteadOf" "$GITCONFIG"; then
+    pass "dot_gitconfig rewrites only pushes to SSH"
+else
+    fail "dot_gitconfig rewrites clones to SSH, breaking installs before key setup"
+fi
+
 if ! grep -q "^\[data\]" "$CHEZMOI_SOURCE/.chezmoi.toml.tmpl"; then
     pass ".chezmoi.toml.tmpl has no dead [data] section"
 else
@@ -376,9 +393,19 @@ else
     fail "asdf script not driven by .tool-versions"
 fi
 
+TMUX_TMPL="$CHEZMOI_SOURCE/.chezmoiscripts/run_onchange_after_tmux.sh.tmpl"
+if grep -qF '{{ include "dot_tmux.conf" | sha256sum }}' "$TMUX_TMPL" 2>/dev/null && \
+   grep -qF 'tpm/bin/install_plugins' "$TMUX_TMPL"; then
+    pass "tmux plugins install on dot_tmux.conf change"
+else
+    fail "tmux plugins not installed on apply"
+fi
+
 grep -qx 'cask "claude"' "$BREWFILE" && pass "claude desktop via brew" || fail "claude desktop cask missing"
 ! grep -q '^cask "claude-code' "$BREWFILE" && pass "claude code installed natively, not via brew" || fail "claude-code cask in Brewfile"
 
+grep -q 'add_app_to_dock "Claude"' "$CHEZMOI_SOURCE/.chezmoiscripts/run_once_after_dock.sh" && pass "Claude in Dock" || fail "Claude missing from Dock"
+
 grep -q '^defaults write' "$CHEZMOI_SOURCE/.chezmoiscripts/run_onchange_after_macos.sh" 2>/dev/null && pass "macos defaults script present" || fail "macos defaults script missing"
 
 [ ! -e "$CHEZMOI_SOURCE/.chezmoiscripts/run_once_after_mas.sh" ] && pass "mas script merged into Brewfile" || fail "mas script still present"
@@ -389,7 +416,7 @@ else
     fail "claude code installer script missing"
 fi
 
-for script in run_onchange_before_packages.sh.tmpl run_onchange_after_asdf.sh.tmpl; do
+for script in run_onchange_before_packages.sh.tmpl run_onchange_after_asdf.sh.tmpl run_onchange_after_tmux.sh.tmpl; do
     rendered=$(chezmoi execute-template --source "$CHEZMOI_SOURCE" < "$CHEZMOI_SOURCE/.chezmoiscripts/$script")
     if env -i HOME="$HOME" PATH=/usr/bin:/bin bash -c "$(echo "$rendered" | sed -n '/brew shellenv/p'); command -v brew" >/dev/null 2>&1; then
         pass "$script finds brew on a fresh PATH"