diff --git a/README.md b/README.md
index f67d180..6b1dec9 100644
--- a/README.md
+++ b/README.md
@@ -22,6 +22,7 @@ git clone https://github.com/tsilenzio/dotfiles.git ~/.dotfiles
 ## What's Included
 
 - **Zsh** configuration with Starship prompt
+- **Atuin** shell history sync with E2E encryption
 - **Git** config with delta diffs and GPG signing
 - **Ghostty** terminal configuration (with WezTerm fallback)
 - **Homebrew** packages organized by bundle
@@ -72,6 +73,7 @@ just secrets ...      # Secrets management (init, backup, restore)
 ~/.dotfiles/
 ├── config/                    # Base configurations
 │   ├── manifest              # Declares what gets linked where
+│   ├── atuin/
 │   ├── ghostty/
 │   ├── git/
 │   ├── gnupg/
@@ -94,6 +96,7 @@ just secrets ...      # Secrets management (init, backup, restore)
 │       │   ├── personal/
 │       │   ├── work/
 │       │   └── test/
+│       ├── daemons/            # Launch daemons/agents (spotlight)
 │       ├── install              # macOS platform installer
 │       ├── preflight            # Sudo caching / preflight checks
 │       ├── preferences          # macOS system preferences
diff --git a/config/gnupg/gpg-agent.conf b/config/gnupg/gpg-agent.conf
index 65caef3..6bea500 100644
--- a/config/gnupg/gpg-agent.conf
+++ b/config/gnupg/gpg-agent.conf
@@ -1,7 +1,6 @@
-# Cache passphrase for 10 minutes (600 seconds)
-default-cache-ttl 600
-# Maximum cache lifetime of 2 hours (7200 seconds)
-max-cache-ttl 7200
+# Require Touch ID for every signing operation
+default-cache-ttl 0
+max-cache-ttl 0
 
 # Pinentry program options (uncomment one):
 
diff --git a/config/zsh/zshrc b/config/zsh/zshrc
index f4a166e..bfe298b 100644
--- a/config/zsh/zshrc
+++ b/config/zsh/zshrc
@@ -11,6 +11,7 @@ fi
 # Environment Variables
 # ============================================================================
 export COPYFILE_DISABLE=1               # Don't create ._* files on macOS
+export GPG_TTY=$(tty)                   # Required for pinentry-touchid
 
 # ============================================================================
 # PATH Configuration
diff --git a/platforms/macos/bundles/test/manifest b/platforms/macos/bundles/test/manifest
new file mode 100644
index 0000000..36273cc
--- /dev/null
+++ b/platforms/macos/bundles/test/manifest
@@ -0,0 +1,12 @@
+# Minimal symlinks for VM testing
+zsh/zshrc      -> $HOME/.zshrc
+zsh/zshenv     -> $HOME/.zshenv
+zsh/zprofile   -> $HOME/.zprofile
+
+# Git
+git/gitconfig  -> $HOME/.gitconfig
+git/gitignore  -> $HOME/.gitignore
+
+# GnuPG
+gnupg/gpg-agent.conf -> $HOME/.gnupg/gpg-agent.conf
+@chmod 700 $HOME/.gnupg
diff --git a/platforms/macos/bundles/test/setup.sh b/platforms/macos/bundles/test/setup.sh
index d39c199..8e8b4cb 100755
--- a/platforms/macos/bundles/test/setup.sh
+++ b/platforms/macos/bundles/test/setup.sh
@@ -28,15 +28,18 @@ echo "Configuring minimal symlinks..."
 
 ensure_config_dirs
 
-# Only essential symlinks (subset of link_base_configs)
-CONFIG_DIR="$DOTFILES_DIR/config"
-
-[[ -f "$CONFIG_DIR/zsh/zshrc" ]] && safe_link "$CONFIG_DIR/zsh/zshrc" "$HOME/.zshrc"
-[[ -f "$CONFIG_DIR/zsh/zshenv" ]] && safe_link "$CONFIG_DIR/zsh/zshenv" "$HOME/.zshenv"
-[[ -f "$CONFIG_DIR/zsh/zprofile" ]] && safe_link "$CONFIG_DIR/zsh/zprofile" "$HOME/.zprofile"
-[[ -f "$CONFIG_DIR/git/gitconfig" ]] && safe_link "$CONFIG_DIR/git/gitconfig" "$HOME/.gitconfig"
-[[ -f "$CONFIG_DIR/git/gitignore" ]] && safe_link "$CONFIG_DIR/git/gitignore" "$HOME/.gitignore"
-[[ -f "$CONFIG_DIR/gnupg/gpg-agent.conf" ]] && safe_link "$CONFIG_DIR/gnupg/gpg-agent.conf" "$HOME/.gnupg/gpg-agent.conf"
+if [[ -f "$BUNDLE_DIR/manifest" ]]; then
+    apply_manifest "$BUNDLE_DIR/manifest" "$DOTFILES_DIR/config"
+else
+    # Legacy fallback
+    CONFIG_DIR="$DOTFILES_DIR/config"
+    [[ -f "$CONFIG_DIR/zsh/zshrc" ]] && safe_link "$CONFIG_DIR/zsh/zshrc" "$HOME/.zshrc"
+    [[ -f "$CONFIG_DIR/zsh/zshenv" ]] && safe_link "$CONFIG_DIR/zsh/zshenv" "$HOME/.zshenv"
+    [[ -f "$CONFIG_DIR/zsh/zprofile" ]] && safe_link "$CONFIG_DIR/zsh/zprofile" "$HOME/.zprofile"
+    [[ -f "$CONFIG_DIR/git/gitconfig" ]] && safe_link "$CONFIG_DIR/git/gitconfig" "$HOME/.gitconfig"
+    [[ -f "$CONFIG_DIR/git/gitignore" ]] && safe_link "$CONFIG_DIR/git/gitignore" "$HOME/.gitignore"
+    [[ -f "$CONFIG_DIR/gnupg/gpg-agent.conf" ]] && safe_link "$CONFIG_DIR/gnupg/gpg-agent.conf" "$HOME/.gnupg/gpg-agent.conf"
+fi
 
 echo ""
 echo "Test setup complete!"