diff --git a/config/mcp/mcp.json b/config/mcp/mcp.json
index c1814c6..81ac60a 100644
--- a/config/mcp/mcp.json
+++ b/config/mcp/mcp.json
@@ -1,11 +1,5 @@
 {
   "mcpServers": {
-    "ionos": {
-      "url": "https://mcp.ionos.com/mcp",
-      "auth": "bearer",
-      "bearerTokenEnv": "IONOS_PAT",
-      "lifecycle": "lazy"
-    },
     "linear": {
       "url": "https://mcp.linear.app/mcp",
       "auth": "oauth",
diff --git a/flake.lock b/flake.lock
index 51ccbfc..8f7a316 100644
--- a/flake.lock
+++ b/flake.lock
@@ -3,11 +3,11 @@
     "agent-skills": {
       "flake": false,
       "locked": {
-        "lastModified": 1785322008,
-        "narHash": "sha256-1NmnD25Q9wgDa1IsSKE8Ky7S9J9wt0KSKDsVZekLbQY=",
+        "lastModified": 1785234559,
+        "narHash": "sha256-9aejq9o5rNQkMZve8GHKkV1lz6v2kmotDgacBb25bes=",
         "ref": "main",
-        "rev": "5960c925868f3eb5d1721d75c6bf31457228bab0",
-        "revCount": 6,
+        "rev": "d35f1642a58b3725957361a789ad30c02deed5be",
+        "revCount": 4,
         "type": "git",
         "url": "https://codeberg.org/oibot/agent-skills.git"
       },
@@ -164,11 +164,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1785511290,
-        "narHash": "sha256-oz9nu9DUlq657V8Lhb+jsSmRhjzHOQ8ty3oAw158+f4=",
+        "lastModified": 1785138805,
+        "narHash": "sha256-NZ9C/5I/PDJUERJ+gVqTBcZJqp5YlSgu/a6Y3I5RIG8=",
         "owner": "lukasl-dev",
         "repo": "pi.nix",
-        "rev": "3d2bd32b017a0e55a072d74963443ab97eab9a27",
+        "rev": "740d5d8af6d3cffca0b369418144cc7123a167a4",
         "type": "github"
       },
       "original": {
diff --git a/module/configuration.nix b/module/configuration.nix
index 49dd371..f4e67d1 100644
--- a/module/configuration.nix
+++ b/module/configuration.nix
@@ -26,6 +26,10 @@
     enable = true;
     onActivation.cleanup = "zap";
 
+    brews = [
+      "mihaelamj/tap/cupertino"
+    ];
+
     casks = [
       "aerospace"
       "chatgpt"
@@ -49,10 +53,8 @@
 
     taps = [
       "homebrew/services"
-      {
-        name = "nikitabobko/tap";
-        trusted = true;
-      }
+      "mihaelamj/tap"
+      "nikitabobko/tap"
     ];
   };
 
diff --git a/module/home-manager.nix b/module/home-manager.nix
index fb6ddc4..e8658ca 100644
--- a/module/home-manager.nix
+++ b/module/home-manager.nix
@@ -10,33 +10,12 @@
     firecrawlApiKey = "$FIRECRAWL_API_KEY";
     firecrawlFreshScrape = true;
   };
-  home.file.".pi/agent/extensions/subagent/config.json".text = builtins.toJSON {
-    artifactDir = "session";
-  };
-  home.file.".pi/agent/extensions/guardrails.json".text = builtins.toJSON {
-    version = "0.13.0-20260619";
-    features = {
-      policies = false;
-      permissionGate = true;
-    };
-    permissionGate = {
-      requireConfirmation = true;
-      patterns = [
-        {
-          pattern = "(^|[;&|])\\s*(ssh|scp|sftp)(\\s|$)";
-          description = "SSH connection or file transfer";
-          regex = true;
-        }
-      ];
-    };
-  };
 
   sops = {
     age.keyFile = "${config.home.homeDirectory}/Library/Application Support/sops/age/keys.txt";
     defaultSopsFile = ../secrets/secrets.yaml;
 
     secrets.firecrawl_api_key = { };
-    secrets.ionos_pat = { };
   };
 
   targets.darwin.defaults = {
@@ -62,8 +41,6 @@
     coreutils
     curl
     fira-code
-    forgejo-cli
-    gh
     gnupg
     htop
     imagemagick
@@ -130,12 +107,10 @@
     pi.coding-agent = {
       enable = true;
       skills = [
-        (inputs.agent-skills + "/create-plan")
         (inputs.agent-skills + "/create-skill")
       ];
       environment = {
         FIRECRAWL_API_KEY.file = config.sops.secrets.firecrawl_api_key.path;
-        IONOS_PAT.file = config.sops.secrets.ionos_pat.path;
       };
       settings = {
         defaultProvider = "openai-codex";
@@ -144,12 +119,7 @@
 
         packages = [
           "npm:pi-web-access@0.15.0"
-          "npm:pi-mcp-adapter@2.15.0"
-          "npm:pi-subagents@0.37.2"
-          {
-            source = "npm:@aliou/pi-guardrails@0.16.0";
-            extensions = [ "-extensions/herdr/index.ts" ];
-          }
+          "npm:pi-mcp-adapter@2.10.0"
         ];
       };
     };
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index cd1e035..3d58266 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -1,5 +1,4 @@
 firecrawl_api_key: ENC[AES256_GCM,data:T5o3SaZmteTq+c6Qw3pvYrW7+Yicio3EbfI3c+d1ZxbsHEU=,iv:bg+q7TZDdsyWI+nvDzX/LpMf2FTKEKBKgMXOhUMCAho=,tag:fmRHmgWfFfL4ckQcTKdshQ==,type:str]
-ionos_pat: ENC[AES256_GCM,data:UizMtJgoMAoYC4LPkP6hgmYjR5y2QL1ngfgZNkt7R53L8QSm7Yah7pDCZw==,iv:KzekpU5Bhy9RqtWWUK6ZFmsasJy6IiuAujDFn7dCqpM=,tag:/IEmHjS4Hw7+YsO2P7aXjQ==,type:str]
 sops:
     age:
         - enc: |
@@ -11,7 +10,7 @@ sops:
             ptUomL2W/we4iRbe1LnPHB1JqBuYZSEaXGgdFbGGf2iYw/jtEE5gTQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age106xkhmfrzqum2zkuxxfwjddesuwu6m99tqtt7s3pre4d4wejlp7qkhyfee
-    lastmodified: "2026-07-31T13:37:26Z"
-    mac: ENC[AES256_GCM,data:z0o0HITRWvzn8YTehdMhhPCtKosM7Jx0jRCfhV5iJzncjs5cBMi6H8s+0aCd/Ymst6TZsWdq+9I2icwM8SHDWzRrkXzzrPZmqZ+jl4A+tTNcVbRr18ymojg/kz3888jxedYeClRkUbzKGkv/saxOidO5PPyutExdKcomVdcj1kE=,iv:gfEkvBDWmSH9A1qwbx6hSq5k9Xh5DwMcWIvvtkVC6tc=,tag:nse1YX5rYp2DUUOwfYFl0Q==,type:str]
+    lastmodified: "2026-06-19T11:46:02Z"
+    mac: ENC[AES256_GCM,data:NqmNt+NagD6Fg0KiXkvSIZq/c73F78u7bZfsTFiKqezhcipfsex+71wriLTB3E3fEV9L0YseXWqbaXJjQnE26GoLaqHB232N9BUSw676tetb+5n59oi13FbaZl77OMsh7QZGQ1oSKWccmGm9UVo7T9YBgJHGys/ucqVTqaOAIlg=,iv:7PhfpF9TqgZPVSdi7/sacMSDBOr6fseSERbVisef98M=,tag:Ci6sKjA70Jj13y1JwPPUBQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.3
+    version: 3.13.1