diff --git a/README.md b/README.md
index 9f94576..8886ed6 100644
--- a/README.md
+++ b/README.md
@@ -108,7 +108,7 @@ Workaround: define a custom `zai-coding` provider in `~/.omp/agent/models.yml` p
 
 Gotcha: omp's `apiKey:` field in custom providers expects a **literal key value** — NOT an env var name. `apiKey: ZAI_CODING_API_KEY` was being treated as the literal string `ZAI_CODING_API_KEY` and sent as `Authorization: Bearer ZAI_CO...KEY` → 401. The encrypted `models.yml` in this repo contains the literal Z.ai API key in `apiKey:` (same key that's in `zai.key`).
 
-All three omp secrets (`zai.key`, `.env`, `models.yml`) are committed as `encrypted_private_*.age`. The prefix order matters: chezmoi parses attribute prefixes left-to-right, and `encrypted_` **must** precede `private_`. `encrypted_private_foo.age` decrypts *and* lands at `0600`; the reversed `private_encrypted_foo.age` makes chezmoi consume `private_` and then treat `encrypted_foo.age` as a literal filename (no decryption — the file is copied verbatim, which is how a stale `encrypted_models.yml.age` blob ended up in `~/.omp/agent/`). As belt-and-suspenders for boxes where a secret already sits at umask `0644` from a prior apply, `run_onchange_35-ensure-omp-secret-perms.sh` normalizes all three back to `600`. Never rely on the enclosing `~/.omp/agent/` directory being `700` to protect these; the files carry their own mode.
+`run_onchange_35-ensure-omp-models-perms.sh` chmod 600s the decrypted file so the literal key isn't world-readable (matches `zai.key`'s tighter perms).
 
 ## Sway / Wayland desktop stack
 
diff --git a/dot_omp/agent/encrypted_private_.env.age b/dot_omp/agent/encrypted_.env.age
similarity index 100%
rename from dot_omp/agent/encrypted_private_.env.age
rename to dot_omp/agent/encrypted_.env.age
diff --git a/dot_omp/agent/encrypted_private_zai.key.age b/dot_omp/agent/encrypted_zai.key.age
similarity index 100%
rename from dot_omp/agent/encrypted_private_zai.key.age
rename to dot_omp/agent/encrypted_zai.key.age
diff --git a/dot_omp/agent/encrypted_private_models.yml.age b/dot_omp/agent/private_encrypted_models.yml.age
similarity index 100%
rename from dot_omp/agent/encrypted_private_models.yml.age
rename to dot_omp/agent/private_encrypted_models.yml.age
diff --git a/run_once_10-add-gentoo-overlays.sh.tmpl b/run_once_10-add-gentoo-overlays.sh.tmpl
old mode 100755
new mode 100644
index 205ee57..b6a552f
--- a/run_once_10-add-gentoo-overlays.sh.tmpl
+++ b/run_once_10-add-gentoo-overlays.sh.tmpl
@@ -1,30 +1,31 @@
 #!/usr/bin/env bash
 # =============================================================================
-#  run_once_10-add-gentoo-overlays.sh.tmpl  (gentoo-only)
+#  run_once_05-add-gentoo-overlays.sh.tmpl  (gentoo-only)
 #  Add the GURU overlay to the portage repository list. GURU is the
 #  community overlay (like AUR for arch) where packages like bun, eza,
 #  sway, etc. live when they're not in the main tree.
 #
 #  Idempotent: skips if GURU is already enabled.
-#  Guarded: this script is a no-op on non-gentoo boxes via the os_family
-#  template conditional below — so topgrade/chezmoi apply never errors
-#  on arch/debian where /var/db/repos/gentoo doesn't exist.
-#
-#  Run-order: 00 (bootstrap) → 05 (hosts) → 10 (overlays, here)
-#  → 20 (packages) → 40 (sway)
+#  Run-order: 00 (bootstrap) → 05-overlays (here) → 10-add-{chaotic,debian}
+#  → 20-install-packages → 40-install-sway
 # =============================================================================
 set -euo pipefail
 
 log() { printf '\033[1;34m[overlays]\033[0m %s\n' "$*"; }
 die() { printf '\033[1;31m[overlays ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
 
-{{ if eq .os_family "gentoo" -}}
-# --- gentoo: ensure GURU overlay is enabled ---
+# This script is gentoo-only. Guarded by the chezmoi template engine;
+# on arch/debian it never renders (only this single file path).
+
 if [[ ! -d /var/db/repos/gentoo ]]; then
     die "/var/db/repos/gentoo missing — this doesn't look like a gentoo system"
 fi
 
-# GURU overlay — required for eza, lazygit, topgrade, etc.
+# --- 1. GURU overlay ---
+# User explicitly requires GURU. Per the bootstrap-runbook skill: gentoo
+# boxes without GURU can't install most of the user packages (eza, fzf,
+# fd-find on stable, lazygit, topgrade, etc.) because they only ship in
+# the main tree as ~amd64 or only live in GURU.
 if [[ -d /var/db/repos/guru ]]; then
     log "GURU overlay already enabled at /var/db/repos/guru — skipping"
 else
@@ -50,7 +51,7 @@ else
     log "GURU overlay enabled and synced"
 fi
 
-# --- verify ---
+# --- 2. Verify ---
 log "enabled overlays:"
 eselect repository list 2>&1 | sed 's/^/  /'
 
@@ -61,8 +62,4 @@ fi
 GURU_NAME=$(cat /var/db/repos/guru/profiles/repo_name)
 log "GURU repo verified: $GURU_NAME"
 
-log "overlays ready"
-{{ else -}}
-# Not a gentoo box — nothing to do (guarded by os_family above).
-log "skipping gentoo overlays (os_family={{ .os_family }}, not gentoo)"
-{{ end -}}
+log "overlays ready"
\ No newline at end of file
diff --git a/run_onchange_35-ensure-omp-models-perms.sh.tmpl b/run_onchange_35-ensure-omp-models-perms.sh.tmpl
new file mode 100644
index 0000000..7c1e19f
--- /dev/null
+++ b/run_onchange_35-ensure-omp-models-perms.sh.tmpl
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# =============================================================================
+#  run_onchange_35-ensure-omp-models-perms.sh.tmpl
+#  Force chmod 600 on ~/.omp/agent/models.yml. The encrypted file is named
+#  `private_encrypted_models.yml.age` so chezmoi SHOULD set 600 on first apply,
+#  but if the file already exists from a prior apply (when it was named
+#  `encrypted_models.yml.age` without the `private_` prefix), the perm stays
+#  at whatever umask gave it (typically 644). This script normalizes the perm
+#  to 600 so the literal zai API key in models.yml isn't world-readable.
+#
+#  Triggered by the body hash changing; current hash = sha256 of body.
+#  Runs on all OSes (no os_family gate).
+# =============================================================================
+set -euo pipefail
+
+MODELS_YML="${HOME}/.omp/agent/models.yml"
+
+log() { printf '\033[1;34m[omp-models-perms]\033[0m %s\n' "$*"; }
+
+if [[ ! -f "$MODELS_YML" ]]; then
+    log "models.yml not present on this box (omp not installed?) — skipping"
+    exit 0
+fi
+
+current_perm=$(stat -c '%a' "$MODELS_YML")
+if [[ "$current_perm" == "600" ]]; then
+    log "models.yml already 600 — nothing to do"
+    exit 0
+fi
+
+log "models.yml perm is $current_perm, fixing to 600"
+chmod 600 "$MODELS_YML"
+log "models.yml perm now $(stat -c '%a' "$MODELS_YML")"
diff --git a/run_onchange_35-ensure-omp-secret-perms.sh.tmpl b/run_onchange_35-ensure-omp-secret-perms.sh.tmpl
deleted file mode 100755
index fec325d..0000000
--- a/run_onchange_35-ensure-omp-secret-perms.sh.tmpl
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-# =============================================================================
-#  run_onchange_35-ensure-omp-secret-perms.sh.tmpl
-#  Force chmod 600 on every omp secret under ~/.omp/agent/. The encrypted
-#  sources are all named with the `private_` prefix (private_encrypted_*.age)
-#  so chezmoi SHOULD set 600 on first apply, but if a file already exists
-#  from a prior apply (before it gained the `private_` prefix), its mode
-#  stays at whatever umask gave it (typically 644 — world-readable).
-#  This script normalizes the mode so live API keys are never world-readable,
-#  regardless of the enclosing directory's perms.
-#
-#  Re-triggered automatically whenever this script body changes (chezmoi
-#  hashes the body). Runs on all OSes (no os_family gate).
-#
-#  Covered files:
-#    zai.key      — Z.ai API key (literal, 1 line)
-#    .env         — provider API keys (ANTHROPIC/OPENAI/... when populated)
-#    models.yml   — literal zai-coding provider key in apiKey:
-# =============================================================================
-set -euo pipefail
-
-SECRETS_DIR="${HOME}/.omp/agent"
-declare -a SECRET_FILES=("zai.key" ".env" "models.yml")
-
-log() { printf '\033[1;34m[omp-secret-perms]\033[0m %s\n' "$*"; }
-
-if [[ ! -d "$SECRETS_DIR" ]]; then
-    log "~/.omp/agent not present on this box (omp not installed?) — skipping"
-    exit 0
-fi
-
-fixed=0
-for f in "${SECRET_FILES[@]}"; do
-    path="${SECRETS_DIR}/${f}"
-    if [[ ! -f "$path" ]]; then
-        log "${f}: not present — skipping"
-        continue
-    fi
-    current_perm=$(stat -c '%a' "$path")
-    if [[ "$current_perm" == "600" ]]; then
-        log "${f}: already 600 — nothing to do"
-        continue
-    fi
-    log "${f}: perm is ${current_perm}, fixing to 600"
-    chmod 600 "$path"
-    log "${f}: perm now $(stat -c '%a' "$path")"
-    fixed=$((fixed + 1))
-done
-
-log "done (${fixed} file(s) changed)"