diff --git a/flake.lock b/flake.lock
index 6f1e459..67460e0 100644
--- a/flake.lock
+++ b/flake.lock
@@ -288,11 +288,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1738198475,
-        "narHash": "sha256-htByqdcHJ9errhlCwsPbtDwwcethA+5Z3EWrunpYEZE=",
+        "lastModified": 1738630538,
+        "narHash": "sha256-xFPk9/4mJaC4yeJ0bqs0MRjMWrJHoRk/N/cWc980VLc=",
         "owner": "bandithedoge",
         "repo": "nixpkgs-firefox-darwin",
-        "rev": "aa67b010a2783e5ba889cf9b54857b99dbfd023f",
+        "rev": "d77c620fe1938911e3bcc56f5a6f021b2949b8c9",
         "type": "github"
       },
       "original": {
@@ -391,11 +391,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1737955272,
-        "narHash": "sha256-x6r47XKM0eSpN3760AaNwDGyZ4ctlbhCwuJSf0P9p+U=",
+        "lastModified": 1738561823,
+        "narHash": "sha256-o5pIXUNU/9wCyoVquyE0AmzzVnDC+fEnbdSuw/Vj5SU=",
         "owner": "sellout",
         "repo": "flaky",
-        "rev": "12cc8197237d2a42dddbb647fc27ccdccbf33122",
+        "rev": "6978e9b7894827d5d31c2b9a3645e9cf33799a9d",
         "type": "github"
       },
       "original": {
@@ -468,11 +468,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1738186752,
-        "narHash": "sha256-Xb8kuspAdwbRRxhvrf0wDJYJG3CaAiRWmQxsoCNCF4w=",
+        "lastModified": 1738618744,
+        "narHash": "sha256-t2ZkrnBxavDK7SCaOp85ldTkxeIPb++xpyRcqwgRReY=",
         "owner": "jacekszymanski",
         "repo": "nixcasks",
-        "rev": "721a3f3062e834db2e270e0b7a635c648c9a0650",
+        "rev": "1f19b243354f5bd419a1d58eee220c868a359dad",
         "type": "github"
       },
       "original": {
@@ -483,11 +483,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1737936803,
-        "narHash": "sha256-N/5tl/SwJ6+C97FkpCGP9lzFS3MDurh/e/ZqyZNAiac=",
+        "lastModified": 1738539029,
+        "narHash": "sha256-t3wejzZwydjugAPdy27Dl2dRwkT9irHcn19vnFqqMC4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b82ae44a2fd326a201b1b5d9157f9de4435d9c20",
+        "rev": "2f964cd5c54daba97677b5ca3824c7e14835e9dd",
         "type": "github"
       },
       "original": {
@@ -563,11 +563,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1737110817,
-        "narHash": "sha256-DSenga8XjPaUV5KUFW/i3rNkN7jm9XmguW+qQ1ZJTR4=",
+        "lastModified": 1737879851,
+        "narHash": "sha256-H+FXIKj//kmFHTTW4DFeOjR7F1z2/3eb2iwN6Me4YZk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "041c867bad68dfe34b78b2813028a2e2ea70a23c",
+        "rev": "5d3221fd57cc442a1a522a15eb5f58230f45a304",
         "type": "github"
       },
       "original": {
@@ -600,11 +600,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1738209019,
-        "narHash": "sha256-w0D8PdncWGjIGTWGApYNxgKSrZGcvRi9qFOar0I5Acg=",
+        "lastModified": 1738362438,
+        "narHash": "sha256-EO2dVkMVLThWqv4hobEZEZGWBEuH2Z9SYqQDrbLSclU=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "e4cbe85ffa2b9ecbd80aded528ca7b64445b244d",
+        "rev": "95ddad0ff0e67c90314c6ca46324dce5f9a910d2",
         "type": "github"
       },
       "original": {
@@ -661,11 +661,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1737424962,
-        "narHash": "sha256-rFU5yGjNdjyMDKaHmOi5eVhHStKXQn+sD5tMqyt6NbI=",
+        "lastModified": 1738210227,
+        "narHash": "sha256-/GVE4HYRvGbtKtlbjjM1eck7qcwr/t4YaPvBXdDUDz8=",
         "owner": "sellout",
         "repo": "project-manager",
-        "rev": "6663da781f16496cbd7e1bfe9e921abdaf95b161",
+        "rev": "d853b2288454536104adaa8eeec986543dad4349",
         "type": "github"
       },
       "original": {
@@ -764,11 +764,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737103437,
-        "narHash": "sha256-uPNWcYbhY2fjY3HOfRCR5jsfzdzemhfxLSxwjXYXqNc=",
+        "lastModified": 1737483750,
+        "narHash": "sha256-5An1wq5U8sNycOBBg3nsDDgpwBmR9liOpDGlhliA6Xo=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "d1ed3b385f8130e392870cfb1dbfaff8a63a1899",
+        "rev": "f2cc121df15418d028a59c9737d38e3a90fbaf8f",
         "type": "github"
       },
       "original": {
diff --git a/nix/modules/darwin-configuration.nix b/nix/modules/darwin-configuration.nix
index ed0bfa6..8141063 100644
--- a/nix/modules/darwin-configuration.nix
+++ b/nix/modules/darwin-configuration.nix
@@ -8,6 +8,7 @@
   ...
 }: {
   imports = [
+    ./games.nix
     ./input-devices.nix
     ./nix-configuration.nix
     ./nixpkgs-configuration.nix
@@ -36,6 +37,8 @@
       pkgs.gnupg
       pkgs.yubikey-manager
       pkgs.yubikey-personalization
+      ## TODO: This is a work around for LnL7/nix-darwin#1314
+      pkgs.mas
     ];
     systemPath = [
       # TODO: Support this via the homebrew module.
@@ -64,9 +67,8 @@
   #
   # NB: Ideally this would be managed in home.nix, but that's not yet supported.
   homebrew = {
-    brews = [
-      "sysbench" # not available on darwin via Nix
-    ];
+    ## TODO: This is a workaround for LnL7/nix-darwin#1314.
+    brews = lib.mkForce [];
     caskArgs = {
       appdir = "/Applications/Homebrew Apps";
       fontdir = "/Library/Fonts/Homebrew Fonts";
@@ -98,15 +100,9 @@
       # "delicious-library" # perhaps removed?
       "eagle" # doesn't respect appdir # not available on darwin via Nix
       "google-drive" # doesn't respect appdir
-      "growlnotify"
-      "pokemon-trading-card-game-online" # for the kids
       "psi"
       "r" # doesn't respect appdir
       "racket"
-      "spotify" # not available on darwin via Nix
-      # not available on darwin via Nix
-      # I don’t know how to control auto-update
-      "steam"
       "timemachineeditor"
       # "virtualbox" # requires Intel architecture
       {
@@ -131,17 +127,14 @@
       Deliveries = 290986013;
       FocusMask = 435999818;
       GarageBand = 682658836;
-      Harvest = 506189836;
       iMovie = 408981434;
       Keynote = 409183694;
       Numbers = 409203825;
-      "ODAT Tracker" = 448831531;
       Pages = 409201541;
       "Picture Window" = 507262984;
       "Prime Video" = 545519333;
       reMarkable = 1276493162;
       "Remote Mouse" = 403195710;
-      Robotek = 462238382;
       SoundCloud = 412754595;
       # Twitter = 409789998; # currently subsumed by ferdium
       Xcode = 497799835;
@@ -155,6 +148,20 @@
       upgrade = true;
     };
   };
+  ## Don’t auto-upgrade from the Mac App Store (this is handled by
+  ## `homebrew.masApps`).
+  system.defaults.CustomSystemPreferences."com.apple.commerce".AutoUpdate = false;
+  ## TODO: Build this incrementally from arbitrarily-named scripts.
+  system.activationScripts.postUserActivation.text = ''
+    echo "checking for un-managed apps ..."
+    mas list | sort >installed-packages
+    echo "App Store apps that are installed, but not in the nix-darwin configuration:"
+    join -v1 -1 1 installed-packages - <<EOF
+    ${lib.concatStringsSep "\n"
+      (lib.sort (a: b: a <= b) (map toString (lib.attrValues config.homebrew.masApps)))}
+    EOF
+    rm installed-packages
+  '';
 
   nix = {
     gc = {
diff --git a/nix/modules/games.nix b/nix/modules/games.nix
index c01c14a..0d76b7d 100644
--- a/nix/modules/games.nix
+++ b/nix/modules/games.nix
@@ -6,6 +6,17 @@
   ...
 }: {
   config = flaky.lib.multiConfig options {
+    darwinConfig = {
+      homebrew = {
+        casks = [
+          # not available on darwin via Nix
+          # I don’t know how to control auto-update
+          "steam"
+        ];
+        masApps.Robotek = 462238382;
+      };
+    };
+
     homeConfig = {
       home.packages = lib.optionals pkgs.stdenv.hostPlatform.isDarwin [
         pkgs.nixcasks.marathon
diff --git a/nix/modules/home-configuration.nix b/nix/modules/home-configuration.nix
index 14aeee9..0b83674 100644
--- a/nix/modules/home-configuration.nix
+++ b/nix/modules/home-configuration.nix
@@ -215,6 +215,7 @@
         })
         ## not available on darwin via Nix
         (maybeNixcask "obs-studio" "obs")
+        pkgs.python3Packages.opentype-feature-freezer
         # pkgs.slack # currently subsumed by ferdium
         pkgs.synergy
         pkgs.tailscale
@@ -224,6 +225,7 @@
       ]
       ++ map (font: font.package) fonts
       ++ lib.optionals (pkgs.system != "aarch64-linux") [
+        pkgs.spotify
         pkgs.unison-ucm # Unison dev tooling
         pkgs.zoom-us
       ]
@@ -518,6 +520,7 @@
       "eagle"
       "onepassword-password-manager"
       "plexmediaserver"
+      "spotify"
       "zoom"
     ];
   };
@@ -576,7 +579,7 @@
 
   targets.darwin = lib.mkIf pkgs.stdenv.hostPlatform.isDarwin {
     defaults = {
-      "Apple Global Domain" = {
+      "NSGlobalDomain" = {
         AppleInterfaceStyleSwitchesAutomatically = true;
         NSAutomaticCapitalizationEnabled = false;
         NSAutomaticDashSubstitutionEnabled = false;
@@ -601,6 +604,8 @@
         ];
         "com.apple.sound.beep.flash" = 1;
       };
+      # Opt out of Apple Intelligence.
+      "com.apple.CloudSubscriptionFeatures.optIn"."545129924" = false;
       "com.apple.desktopservices" = {
         DSDontWriteNetworkStores = true;
         DSDontWriteUSBStores = true;
diff --git a/nix/modules/ntfy.nix b/nix/modules/ntfy.nix
index 06ef425..db514ee 100644
--- a/nix/modules/ntfy.nix
+++ b/nix/modules/ntfy.nix
@@ -13,6 +13,7 @@ in {
     sessionVariables.AUTO_NTFY_DONE_IGNORE = lib.concatStringsSep " " [
       "emacs"
       "less"
+      "man"
       "ssh"
     ];
   };
diff --git a/nix/modules/shell.nix b/nix/modules/shell.nix
index ad044af..edbce79 100644
--- a/nix/modules/shell.nix
+++ b/nix/modules/shell.nix
@@ -42,7 +42,7 @@
         };
         ## Make sure we don’t fall back to different versions on non-NixOS (e.g.
         ## the ancient Bash 3.2 on darwin).
-        shell.program = lib.getExe pkgs.bashInteractive;
+        terminal.shell.program = lib.getExe pkgs.bashInteractive;
       };
     };