diff --git a/.config/zsh/rc.d/05-pre-omz.zsh b/.config/zsh/rc.d/05-pre-omz.zsh
index e99da84..4c08488 100644
--- a/.config/zsh/rc.d/05-pre-omz.zsh
+++ b/.config/zsh/rc.d/05-pre-omz.zsh
@@ -28,3 +28,25 @@ case "$ROLE" in
     zstyle ':omz:update' mode auto
     ;;
 esac
+
+# Plugins. Assembled here rather than in the stub because the set is
+# role-dependent: macos, brew and dotbare exist only on the Mac, archlinux only
+# where pacman does. A single shared list would have silently dropped four
+# plugins on the Mac.
+#
+# Filtered by what is actually present. Naming a plugin that is not installed
+# makes oh-my-zsh complain on every shell start, and the local custom plugin
+# signal-keyring is exactly that case on any machine other than beastix.
+_want=(git colored-man-pages colorize zsh-interactive-cd fzf)
+case "$ROLE" in
+  desktop|server) _want+=(archlinux) ;;
+  mobile)         _want+=(macos brew dotbare) ;;
+esac
+
+plugins=()
+for _p in $_want; do
+  if [[ -d "$ZSH/plugins/$_p" || -d "${ZSH_CUSTOM:-$ZSH/custom}/plugins/$_p" ]]; then
+    plugins+=("$_p")
+  fi
+done
+unset _p _want
diff --git a/.config/zsh/rc.d/50-mobile.zsh b/.config/zsh/rc.d/50-mobile.zsh
index e26fe93..f73534d 100644
--- a/.config/zsh/rc.d/50-mobile.zsh
+++ b/.config/zsh/rc.d/50-mobile.zsh
@@ -1,22 +1,30 @@
 # Role: mobile (the Mac - macOS on Apple Silicon)
 #
-# Homebrew's shellenv belongs in .zprofile, not here: a non-login shell would
-# otherwise have no /opt/homebrew/bin in PATH. That is not theory - during the
-# design phase "ssh mac brew --version" came back empty for exactly that
-# reason, and was briefly mistaken for Homebrew not being installed.
+# Homebrew's shellenv is NOT here. It belongs in .zprofile, which login shells
+# read and .zshrc does not cover: a non-interactive "ssh mac <command>" sources
+# neither .zshrc nor anything it pulls in, so a PATH set here leaves brew
+# invisible. That is not theory - during the design phase "ssh mac brew
+# --version" came back empty and was briefly taken as evidence that Homebrew
+# was not installed at all. It was; the PATH just was not there.
 
-# Apple Silicon puts Homebrew under /opt/homebrew; Intel Macs use /usr/local.
-# Checked rather than assumed, so the same file works on either.
-for _b in /opt/homebrew /usr/local; do
-  if [[ -x "$_b/bin/brew" ]]; then
-    eval "$("$_b/bin/brew" shellenv)"
-    break
-  fi
-done
-unset _b
-
-# Role colour, set here rather than in 05-prompt.zsh because ~/.p10k.zsh
-# assigns POWERLEVEL9K_CONTEXT_BACKGROUND itself and is sourced in 30-path.zsh.
-# Anything set before that is silently replaced. Not decoration: shron carries
-# mail, web and cloud, and a glance should say which machine this is.
+# Role colour. Only takes effect where powerlevel10k is installed, which on
+# this machine it is not yet - the ys theme has no equivalent. Kept so it
+# applies the moment p10k arrives.
 typeset -g POWERLEVEL9K_CONTEXT_BACKGROUND=green
+
+# Homebrew's own behaviour. Auto-update on every invocation turns a one-second
+# install into a minute.
+export HOMEBREW_AUTO_UPDATE_SECS="86400"
+export HOMEBREW_NO_AUTO_UPDATE="0"
+
+# bench inside the ERPNext compose stack, without remembering where it lives.
+# The -T is needed when there is no terminal, or docker compose refuses.
+bench() {
+  local tty_flag=()
+  [[ -t 0 && -t 1 ]] || tty_flag=(-T)
+  docker compose --project-directory ~/work/erpnext exec "${tty_flag[@]}" backend bench "$@"
+}
+
+# The previous configuration exported PYTHONPATH=/usr/lib/python3.9/site-packages.
+# That is a Linux path and does not exist on macOS at all; beastix and shron
+# carried the same line pointing at 3.9 and 3.4 respectively. None are kept.
diff --git a/.zprofile b/.zprofile
new file mode 100644
index 0000000..156bc27
--- /dev/null
+++ b/.zprofile
@@ -0,0 +1,17 @@
+# Login shells only.
+#
+# Homebrew belongs here rather than in .zshrc. .zprofile is read by login
+# shells, which includes the one behind every terminal window and, importantly,
+# is the only hook that also covers a plain "ssh host <command>" reliably
+# enough to matter. Putting brew's PATH in .zshrc leaves it missing from
+# anything non-interactive, which is how "ssh mac brew --version" came back
+# empty and was mistaken for Homebrew being absent.
+#
+# Harmless on Linux: neither prefix exists there, so the loop does nothing.
+for _brew in /opt/homebrew /usr/local; do
+  if [[ -x "$_brew/bin/brew" ]]; then
+    eval "$("$_brew/bin/brew" shellenv)"
+    break
+  fi
+done
+unset _brew
diff --git a/.zshrc b/.zshrc
index 21049fc..ef6e879 100644
--- a/.zshrc
+++ b/.zshrc
@@ -28,19 +28,6 @@ export ZSH="$HOME/.oh-my-zsh"
 ROLE=$(cat "$HOME/.config/dotconfs/role" 2>/dev/null || echo desktop)
 export ROLE
 
-# One list for every machine, filtered by what is actually installed. A plugin
-# named but not present makes oh-my-zsh complain on every single shell start,
-# and the alternative - a separate list per role - means editing three files to
-# add one plugin.
-_want_plugins=(git archlinux colored-man-pages colorize zsh-interactive-cd fzf)
-plugins=()
-for _p in $_want_plugins; do
-  if [[ -d "$ZSH/plugins/$_p" || -d "${ZSH_CUSTOM:-$ZSH/custom}/plugins/$_p" ]]; then
-    plugins+=("$_p")
-  fi
-done
-unset _p _want_plugins
-
 # Theme and oh-my-zsh's own settings, which it reads while being sourced.
 # Anything of that kind placed in a role file - which comes afterwards - is
 # silently ignored, so it lives here instead.