diff --git a/mcp-config/install.sh b/mcp-config/install.sh
index 8e5d2f4..678cd9e 100644
--- a/mcp-config/install.sh
+++ b/mcp-config/install.sh
@@ -53,13 +53,20 @@ chmod 0600 "$KEYFILE"
 say "Key stored at $KEYFILE (0600)."
 
 # --- 3. wire the shell rc --------------------------------------------------
-# Detect the user's interactive rc; default to zsh on macOS, bash elsewhere.
+# For zsh the hook goes in ~/.zshrc.local, NOT ~/.zshrc. The dotfiles repo
+# MANAGES ~/.zshrc and overwrites it wholesale on every bootstrap
+# (zsh/install.sh), so a hook written there survives only until the next
+# bootstrap run — and then models and skills silently vanish, because sync.sh
+# never runs and OPENCODE_CONFIG is never exported. ~/.zshrc.local is the
+# unmanaged file the managed zshrc sources last, so the hook persists.
 case "${SHELL:-}" in
-  *zsh) RC="$HOME/.zshrc" ;;
+  *zsh) RC="$HOME/.zshrc.local" ;;
   *bash) RC="$HOME/.bashrc" ;;
-  *) [ -f "$HOME/.zshrc" ] && RC="$HOME/.zshrc" || RC="$HOME/.bashrc" ;;
+  *) [ -f "$HOME/.zshrc" ] && RC="$HOME/.zshrc.local" || RC="$HOME/.bashrc" ;;
 esac
 touch "$RC"
+# It sits alongside the user's secrets; keep it non-readable by others.
+[ "$RC" = "$HOME/.zshrc.local" ] && chmod 0600 "$RC" 2>/dev/null || true
 
 if grep -qF "$HOOK_MARKER" "$RC" 2>/dev/null; then
   say "Shell hook already present in $RC."
diff --git a/mcp-config/sync.sh b/mcp-config/sync.sh
index 9b90741..b842bd5 100644
--- a/mcp-config/sync.sh
+++ b/mcp-config/sync.sh
@@ -140,8 +140,14 @@ with os.fdopen(fd, "w") as f:
 os.replace(tmp, dest)
 PYEOF
   elif [ -n "$_base" ]; then
+    # No python3: the base config is deployed verbatim, so its "models" map
+    # stays EMPTY and opencode shows the provider with zero models. That looks
+    # like a broken gateway rather than a missing dependency, so say so — this
+    # is the one case worth breaking the silence for.
     mv "$_base" "$MCP_SYNC_DEST" 2>/dev/null || true
     _base=""
+    printf 'mcp-sync: python3 not found — models cannot be discovered.\n' >&2
+    printf 'mcp-sync: install python3 (bootstrap.sh does), then open a new shell.\n' >&2
   fi
   [ -n "$_base" ] && rm -f "$_base"
 }