diff --git a/config/atuin/config.toml b/config/atuin/config.toml
index a96e69d..1b127c5 100644
--- a/config/atuin/config.toml
+++ b/config/atuin/config.toml
@@ -5,17 +5,26 @@ sync_address = "https://api.atuin.sh"
 
 # Search behavior
 search_mode = "fuzzy"
+search_mode_shell_up_key_binding = "prefix"
 filter_mode = "global"
-filter_mode_shell_up_key_binding = "host"
+filter_mode_shell_up_key_binding = "workspace"
+workspaces = true
 
 # UI
-style = "auto"
 show_preview = true
 enter_accept = true
+command_chaining = true
+
+# Ctrl+R: fullscreen search. Up arrow: ~10 visible results.
+style = "auto"
 inline_height = 0
+inline_height_shell_up_key_binding = 16
 
 # Security: filter secrets from history
 secrets_filter = true
 
+[search]
+filters = ["directory", "workspace", "session", "session-preload", "host", "global"]
+
 [sync]
 records = true
diff --git a/platforms/macos/bundles/core/setup.sh b/platforms/macos/bundles/core/setup.sh
index 1be15e3..9f175c6 100755
--- a/platforms/macos/bundles/core/setup.sh
+++ b/platforms/macos/bundles/core/setup.sh
@@ -68,13 +68,11 @@ if command -v atuin &>/dev/null && [[ ! -f "$HOME/.local/share/atuin/key" ]]; th
             echo ""
             echo "Importing existing shell history..."
             atuin import auto
-            atuin sync
+            echo "  Sync starts on your next shell session."
             ;;
         l|L|login)
             atuin login
-            echo ""
-            echo "Syncing history from server..."
-            atuin sync
+            echo "  Sync starts on your next shell session."
             ;;
         *)
             echo "  Skipped. Run 'atuin register' or 'atuin login' later."
diff --git a/platforms/macos/bundles/work/config/atuin/config.toml b/platforms/macos/bundles/work/config/atuin/config.toml
deleted file mode 100644
index 7233cec..0000000
--- a/platforms/macos/bundles/work/config/atuin/config.toml
+++ /dev/null
@@ -1,25 +0,0 @@
-# Sync settings
-auto_sync = true
-sync_frequency = "5m"
-sync_address = "https://api.atuin.sh"
-
-# Search behavior
-search_mode = "fuzzy"
-filter_mode = "host"
-filter_mode_shell_up_key_binding = "host"
-
-# UI
-style = "auto"
-show_preview = true
-enter_accept = true
-inline_height = 0
-
-# Security: filter secrets from history
-secrets_filter = true
-
-# Restrict filter modes to prevent cross-host history exposure
-[search]
-filters = ["host", "session", "workspace", "directory"]
-
-[sync]
-records = true
diff --git a/platforms/macos/bundles/work/setup.sh b/platforms/macos/bundles/work/setup.sh
index 411fbc7..410a2d0 100755
--- a/platforms/macos/bundles/work/setup.sh
+++ b/platforms/macos/bundles/work/setup.sh
@@ -25,12 +25,10 @@ install_brewfile "$BUNDLE_DIR/Brewfile"
 # Kill apps that auto-launch after installation
 killall "zoom.us" 2>/dev/null || true
 
-## Bundle-specific config overrides
-if [[ -d "$BUNDLE_DIR/config" ]]; then
-    echo ""
-    echo "Applying work config overrides..."
-    apply_config_overrides "$BUNDLE_DIR"
-fi
+## Bundle-specific config tweaks
+echo ""
+echo "Applying work-specific config overrides..."
+"$BUNDLE_DIR/tweak.sh"
 
 echo ""
 echo "Work setup complete!"
diff --git a/platforms/macos/bundles/work/tweak.sh b/platforms/macos/bundles/work/tweak.sh
new file mode 100755
index 0000000..a668938
--- /dev/null
+++ b/platforms/macos/bundles/work/tweak.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+# Work-specific config overrides.
+# Patches base configs in-place for values that need to differ at work.
+#
+# Idempotent: each section skips if its changes are already applied.
+#
+# TODO: Replace with bidirectional config sync (see TODO.md) so bundle-specific
+# overrides don't need per-tool tweak scripts.
+
+set -e
+
+DOTFILES_DIR="${DOTFILES_DIR:-$(cd "$(dirname "$0")/../../../.." && pwd)}"
+source "$DOTFILES_DIR/scripts/lib/common.sh"
+
+ATUIN_CONFIG="$HOME/.config/atuin/config.toml"
+BASE_CONFIG="$DOTFILES_DIR/config/atuin/config.toml"
+
+if [[ ! -f "$BASE_CONFIG" ]]; then
+    echo "  No base atuin config found, skipping work tweaks"
+    return 0 2>/dev/null || exit 0
+fi
+
+if [[ -L "$ATUIN_CONFIG" ]]; then
+    cp -L "$ATUIN_CONFIG" "$ATUIN_CONFIG.tmp"
+    rm "$ATUIN_CONFIG"
+    mv "$ATUIN_CONFIG.tmp" "$ATUIN_CONFIG"
+    echo "  Copied base atuin config for work customization"
+fi
+
+# Tweak: filter_mode = "host" (instead of "global")
+if grep -q '^filter_mode = "global"' "$ATUIN_CONFIG" 2>/dev/null; then
+    sed -i '' 's/^filter_mode = "global"/filter_mode = "host"/' "$ATUIN_CONFIG"
+    echo "  Set filter_mode to host"
+fi
+
+# Tweak: drop "global" from the search filters array
+if grep -q '"global"' "$ATUIN_CONFIG" 2>/dev/null; then
+    sed -i '' 's/, "global"//g; s/"global", //g; s/"global"//g' "$ATUIN_CONFIG"
+    echo "  Removed global from search filters"
+fi