diff --git a/config/mcp/mcp.json b/config/mcp/mcp.json
index 81ac60a..c1814c6 100644
--- a/config/mcp/mcp.json
+++ b/config/mcp/mcp.json
@@ -1,5 +1,11 @@
 {
   "mcpServers": {
+    "ionos": {
+      "url": "https://mcp.ionos.com/mcp",
+      "auth": "bearer",
+      "bearerTokenEnv": "IONOS_PAT",
+      "lifecycle": "lazy"
+    },
     "linear": {
       "url": "https://mcp.linear.app/mcp",
       "auth": "oauth",
diff --git a/flake.lock b/flake.lock
index 8f7a316..51ccbfc 100644
--- a/flake.lock
+++ b/flake.lock
@@ -3,11 +3,11 @@
     "agent-skills": {
       "flake": false,
       "locked": {
-        "lastModified": 1785234559,
-        "narHash": "sha256-9aejq9o5rNQkMZve8GHKkV1lz6v2kmotDgacBb25bes=",
+        "lastModified": 1785322008,
+        "narHash": "sha256-1NmnD25Q9wgDa1IsSKE8Ky7S9J9wt0KSKDsVZekLbQY=",
         "ref": "main",
-        "rev": "d35f1642a58b3725957361a789ad30c02deed5be",
-        "revCount": 4,
+        "rev": "5960c925868f3eb5d1721d75c6bf31457228bab0",
+        "revCount": 6,
         "type": "git",
         "url": "https://codeberg.org/oibot/agent-skills.git"
       },
@@ -164,11 +164,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1785138805,
-        "narHash": "sha256-NZ9C/5I/PDJUERJ+gVqTBcZJqp5YlSgu/a6Y3I5RIG8=",
+        "lastModified": 1785511290,
+        "narHash": "sha256-oz9nu9DUlq657V8Lhb+jsSmRhjzHOQ8ty3oAw158+f4=",
         "owner": "lukasl-dev",
         "repo": "pi.nix",
-        "rev": "740d5d8af6d3cffca0b369418144cc7123a167a4",
+        "rev": "3d2bd32b017a0e55a072d74963443ab97eab9a27",
         "type": "github"
       },
       "original": {
diff --git a/module/configuration.nix b/module/configuration.nix
index f4e67d1..49dd371 100644
--- a/module/configuration.nix
+++ b/module/configuration.nix
@@ -26,10 +26,6 @@
     enable = true;
     onActivation.cleanup = "zap";
 
-    brews = [
-      "mihaelamj/tap/cupertino"
-    ];
-
     casks = [
       "aerospace"
       "chatgpt"
@@ -53,8 +49,10 @@
 
     taps = [
       "homebrew/services"
-      "mihaelamj/tap"
-      "nikitabobko/tap"
+      {
+        name = "nikitabobko/tap";
+        trusted = true;
+      }
     ];
   };
 
diff --git a/module/home-manager.nix b/module/home-manager.nix
index e8658ca..fb6ddc4 100644
--- a/module/home-manager.nix
+++ b/module/home-manager.nix
@@ -10,12 +10,33 @@
     firecrawlApiKey = "$FIRECRAWL_API_KEY";
     firecrawlFreshScrape = true;
   };
+  home.file.".pi/agent/extensions/subagent/config.json".text = builtins.toJSON {
+    artifactDir = "session";
+  };
+  home.file.".pi/agent/extensions/guardrails.json".text = builtins.toJSON {
+    version = "0.13.0-20260619";
+    features = {
+      policies = false;
+      permissionGate = true;
+    };
+    permissionGate = {
+      requireConfirmation = true;
+      patterns = [
+        {
+          pattern = "(^|[;&|])\\s*(ssh|scp|sftp)(\\s|$)";
+          description = "SSH connection or file transfer";
+          regex = true;
+        }
+      ];
+    };
+  };
 
   sops = {
     age.keyFile = "${config.home.homeDirectory}/Library/Application Support/sops/age/keys.txt";
     defaultSopsFile = ../secrets/secrets.yaml;
 
     secrets.firecrawl_api_key = { };
+    secrets.ionos_pat = { };
   };
 
   targets.darwin.defaults = {
@@ -41,6 +62,8 @@
     coreutils
     curl
     fira-code
+    forgejo-cli
+    gh
     gnupg
     htop
     imagemagick
@@ -107,10 +130,12 @@
     pi.coding-agent = {
       enable = true;
       skills = [
+        (inputs.agent-skills + "/create-plan")
         (inputs.agent-skills + "/create-skill")
       ];
       environment = {
         FIRECRAWL_API_KEY.file = config.sops.secrets.firecrawl_api_key.path;
+        IONOS_PAT.file = config.sops.secrets.ionos_pat.path;
       };
       settings = {
         defaultProvider = "openai-codex";
@@ -119,7 +144,12 @@
 
         packages = [
           "npm:pi-web-access@0.15.0"
-          "npm:pi-mcp-adapter@2.10.0"
+          "npm:pi-mcp-adapter@2.15.0"
+          "npm:pi-subagents@0.37.2"
+          {
+            source = "npm:@aliou/pi-guardrails@0.16.0";
+            extensions = [ "-extensions/herdr/index.ts" ];
+          }
         ];
       };
     };
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index 3d58266..cd1e035 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -1,4 +1,5 @@
 firecrawl_api_key: ENC[AES256_GCM,data:T5o3SaZmteTq+c6Qw3pvYrW7+Yicio3EbfI3c+d1ZxbsHEU=,iv:bg+q7TZDdsyWI+nvDzX/LpMf2FTKEKBKgMXOhUMCAho=,tag:fmRHmgWfFfL4ckQcTKdshQ==,type:str]
+ionos_pat: ENC[AES256_GCM,data:UizMtJgoMAoYC4LPkP6hgmYjR5y2QL1ngfgZNkt7R53L8QSm7Yah7pDCZw==,iv:KzekpU5Bhy9RqtWWUK6ZFmsasJy6IiuAujDFn7dCqpM=,tag:/IEmHjS4Hw7+YsO2P7aXjQ==,type:str]
 sops:
     age:
         - enc: |
@@ -10,7 +11,7 @@ sops:
             ptUomL2W/we4iRbe1LnPHB1JqBuYZSEaXGgdFbGGf2iYw/jtEE5gTQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age106xkhmfrzqum2zkuxxfwjddesuwu6m99tqtt7s3pre4d4wejlp7qkhyfee
-    lastmodified: "2026-06-19T11:46:02Z"
-    mac: ENC[AES256_GCM,data:NqmNt+NagD6Fg0KiXkvSIZq/c73F78u7bZfsTFiKqezhcipfsex+71wriLTB3E3fEV9L0YseXWqbaXJjQnE26GoLaqHB232N9BUSw676tetb+5n59oi13FbaZl77OMsh7QZGQ1oSKWccmGm9UVo7T9YBgJHGys/ucqVTqaOAIlg=,iv:7PhfpF9TqgZPVSdi7/sacMSDBOr6fseSERbVisef98M=,tag:Ci6sKjA70Jj13y1JwPPUBQ==,type:str]
+    lastmodified: "2026-07-31T13:37:26Z"
+    mac: ENC[AES256_GCM,data:z0o0HITRWvzn8YTehdMhhPCtKosM7Jx0jRCfhV5iJzncjs5cBMi6H8s+0aCd/Ymst6TZsWdq+9I2icwM8SHDWzRrkXzzrPZmqZ+jl4A+tTNcVbRr18ymojg/kz3888jxedYeClRkUbzKGkv/saxOidO5PPyutExdKcomVdcj1kE=,iv:gfEkvBDWmSH9A1qwbx6hSq5k9Xh5DwMcWIvvtkVC6tc=,tag:nse1YX5rYp2DUUOwfYFl0Q==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.3