diff --git a/README.md b/README.md
index 993e134..9849c61 100644
--- a/README.md
+++ b/README.md
@@ -29,6 +29,7 @@ into the repo so this stays the source of truth.
 | `systemd/user/` | `lan-mouse.service`, `voxtype.service`. |
 | `system/` | `/etc` drop-ins: the ARP sysctl and `hid_apple` fnmode. |
 | `packages.txt` | Packages beyond the Omarchy baseline, each with a reason. |
+| `hosts/<hostname>/` | Per-host overlay of `config/` and `system/`: a file there replaces the shared copy on that host only. See `hosts/omarchy-air/README.md`. |
 
 ## The customizations, and why
 
@@ -187,3 +188,12 @@ git add config/foo/bar.conf
 nothing else needs changing. Check first that the file actually differs from
 stock — `diff /usr/share/omarchy/config/foo/bar.conf ~/.config/foo/bar.conf` —
 or you will be tracking a file Omarchy already ships.
+
+### Per-host files
+
+Hardware-specific files (monitor scale, fnmode) go under `hosts/<hostname>/`,
+mirroring `config/` or `system/`, rather than into the shared tree. The shared
+tree comes from `omarchy-laptop`, and `capture.sh` refreshes it only there (or
+with `CAPTURE_SHARED=1`). On any other host it refreshes just that host's overlay,
+so a machine running stock files cannot overwrite the shared customizations.
+`OMARCHY_SETUP_HOST` overrides the detected hostname for both scripts.
diff --git a/capture.sh b/capture.sh
index 86e8b70..392064a 100755
--- a/capture.sh
+++ b/capture.sh
@@ -15,6 +15,15 @@ set -uo pipefail
 
 REPO="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 STEPS=(config themes plugins bin services system packages)
+HOST="${OMARCHY_SETUP_HOST:-$(hostname)}"
+HOST_DIR="$REPO/hosts/$HOST"
+# The shared config/ and system/ trees were captured from this host. Capturing
+# them anywhere else would overwrite its customizations with the other machine's
+# (often stock) files, so elsewhere only the host overlay is refreshed unless
+# CAPTURE_SHARED=1 says the change really is meant for every machine.
+SHARED_HOST="${OMARCHY_SETUP_SHARED_HOST:-omarchy-laptop}"
+CAPTURE_SHARED="${CAPTURE_SHARED:-0}"
+[[ $HOST == "$SHARED_HOST" ]] && CAPTURE_SHARED=1
 
 c_ch=$'\033[33m'; c_skip=$'\033[2m'; c_warn=$'\033[33m'; c_hd=$'\033[1m'; c_off=$'\033[0m'
 [[ -t 1 ]] || { c_ch=; c_skip=; c_warn=; c_hd=; c_off=; }
@@ -32,13 +41,29 @@ pull_back() {
   if cmp -s "$live" "$dest"; then skip "$label"; else cp "$live" "$dest"; chg "$label"; fi
 }
 
+# layered <tree> -- NUL-separated "<repo-copy>\t<rel>" across the shared tree and
+# this host's overlay, the overlay copy winning, so a live file is pulled back into
+# whichever copy this host actually installs from (see install.sh).
+layered() {
+  local tree=$1 f rel
+  declare -A pick=()
+  for base in "$REPO/$tree" "$HOST_DIR/$tree"; do
+    [[ -d $base ]] || continue
+    while IFS= read -r -d '' f; do
+      rel=${f#"$base/"}; pick[$rel]=$f
+    done < <(find "$base" -type f -print0)
+  done
+  for rel in "${!pick[@]}"; do printf '%s\t%s\0' "${pick[$rel]}" "$rel"; done | sort -z -t$'\t' -k2
+}
+
 step_config() {
-  head_ "~/.config -> config/"
+  head_ "~/.config -> config/ (+ hosts/$HOST/config)"
   local dest rel
-  while IFS= read -r -d '' dest; do
-    rel=${dest#"$REPO/config/"}
-    pull_back "$HOME/.config/$rel" "$dest" "$rel"
-  done < <(find "$REPO/config" -type f -print0 | sort -z)
+  while IFS=$'\t' read -r -d '' dest rel; do
+    local tag=$rel; [[ $dest == "$HOST_DIR"/* ]] && tag="$rel  (hosts/$HOST)"
+    if [[ $dest != "$HOST_DIR"/* ]] && (( ! CAPTURE_SHARED )); then skip "$rel  (shared; not on $SHARED_HOST)"; continue; fi
+    pull_back "$HOME/.config/$rel" "$dest" "$tag"
+  done < <(layered config)
 }
 
 step_themes() {
@@ -135,10 +160,10 @@ step_services() {
 step_system() {
   head_ "/etc drop-ins"
   local dest rel
-  while IFS= read -r -d '' dest; do
-    rel=${dest#"$REPO/system/"}
+  while IFS=$'\t' read -r -d '' dest rel; do
+    if [[ $dest != "$HOST_DIR"/* ]] && (( ! CAPTURE_SHARED )); then skip "/etc/$rel  (shared; not on $SHARED_HOST)"; continue; fi
     pull_back "/etc/$rel" "$dest" "/etc/$rel"
-  done < <(find "$REPO/system" -type f -print0 | sort -z)
+  done < <(layered system)
 }
 
 # Report drift in the package delta without rewriting the hand-annotated file:
diff --git a/hosts/omarchy-air/README.md b/hosts/omarchy-air/README.md
new file mode 100644
index 0000000..2880d0a
--- /dev/null
+++ b/hosts/omarchy-air/README.md
@@ -0,0 +1,65 @@
+# omarchy-air
+
+MacBook Air M2 (`Mac14,2`) running Omarchy **4.0.3rc4-1** on Asahi (aarch64).
+Captured **2026-10-16**.
+
+Every file here overlays the shared tree on this host only: `install.sh` installs
+`hosts/omarchy-air/config/X` instead of `config/X`, and `capture.sh` pulls back
+into it. Paths the overlay leaves out fall through to the shared files, which come
+from `omarchy-laptop` (the HP).
+
+## What is in the overlay, and why
+
+| File | Why it is per-host |
+|---|---|
+| `config/hypr/monitors.lua` | Stock file with `scale = 1.33333` and `GDK_SCALE = 1` for the 2560x1664 Retina panel. The shared one names the HP's Chimei panel and its LG outputs by EDID, which mean nothing here. |
+| `config/hypr/input.lua` | Stock settings plus the measurement notes showing why per-device `sensitivity`/`accel_profile` rules are inert for lan-mouse's virtual pointer. Air keeps stock input. It does not take the shared file's 3-finger workspace gesture, its `natural_scroll` comment change, or its `unknown-device` flat-accel rules. Drop this file if you want the HP's behaviour here. |
+| `config/herdr/config.toml` | Stock plus `onboarding = false`. |
+| `config/git/config` | Stock Omarchy git config plus identity, `fetch.prune`, libsecret, and a `git.nic-oconnor.com` helper that reads `$GITEA_KEY` from the environment. The file holds no secret. |
+| `config/mimeapps.list` | nvim for text and source files, chromium for web, HEY for `mailto:`, and the `claude-cli` URL handler. |
+| `system/modprobe.d/hid_apple.conf` | `fnmode=1`, which is what Omarchy's own `fix-fkeys.sh` writes. Without this the shared copy would push the HP's `fnmode=2` onto this keyboard. |
+| `system/modprobe.d/asahi-notch.conf` | `show_notch=1`, written by Omarchy's `apple/enable-notch.sh`. Tracked so it stays explicit. |
+
+`hypr/bindings.lua` is deliberately **not** overlaid. The shared file is a strict
+superset of what air had: the same `SUPER+SHIFT+K` handoff chord plus Claude and
+herdr-hud bindings.
+
+## Already shared, identical here
+
+`bin/omarchy-handoff`, `systemd/user/lan-mouse.service` and
+`systemd/user/voxtype.service` match the shared copies byte for byte.
+`handoff/config/config.toml.example-air` covers this machine's lan-mouse config;
+the live file differs only because the daemon strips comments.
+
+## Not captured, on purpose
+
+- **Themes and plugins.** None are installed here. `~/.config/omarchy/plugins/`
+  is empty, so the shared `themes/` and `plugins.txt` would be new on this machine
+  rather than a conflict.
+- **Packages.** Nothing here was added to `packages.txt`. Beyond the shared list,
+  air's explicit packages are almost all the Asahi baseline that Omarchy's
+  installer provides (`linux-asahi`, `m1n1`, `uboot-asahi`, `asahi-*`,
+  `vulkan-asahi`, `speakersafetyd`, ...). The ones added by hand are
+  `obsidian-appimage`, `wf-recorder`, `omarchy-steam-fex` and `dotnet-runtime-2.1`.
+  Many shared entries are Intel/x86-only (`intel-ucode`, `vulkan-intel`,
+  `lib32-*`, `linux-omarchy`, `sof-firmware`, `thermald`) and some are x86-only
+  AUR binaries (`visual-studio-code-bin`, `hyprmoncfg-bin`, `netbird-bin`,
+  `1password`), so **do not run `install.sh packages` here as-is.**
+- **`~/.local/bin` tooling** (kubectl, helm, tofu, opencode, op, the agent CLIs,
+  ...) and `~/.config/dotfiles/*.env` come from the separate `~/.dotfiles`
+  bootstrap, not Omarchy, and the env files hold secrets.
+- **Omarchy's own** post-update invitation hooks, `omarchy-asahi-mic.service`
+  and the other `omarchy-*` user units are all installer-provided.
+- **Chromium `Preferences`** is runtime state, not configuration.
+
+## Running the scripts here
+
+`./install.sh --dry-run config system` is safe. It would bring in the shared
+terminal fonts, `hyprland.lua`, `autostart.lua`, `bindings.lua`, `shell.json`,
+`shell.toml` and the ARP sysctl, which are all the HP's customizations rather than
+hardware settings. The `hyprmoncfg` include in `hyprland.lua` is guarded, so it
+does nothing without the plugin.
+
+On this host `./capture.sh` refreshes only the overlay. Shared files are skipped
+unless `CAPTURE_SHARED=1`, because otherwise air's stock copies would overwrite
+the HP's customizations.
diff --git a/hosts/omarchy-air/config/git/config b/hosts/omarchy-air/config/git/config
new file mode 100644
index 0000000..5491715
--- /dev/null
+++ b/hosts/omarchy-air/config/git/config
@@ -0,0 +1,39 @@
+# See https://git-scm.com/docs/git-config
+
+[alias]
+	co = checkout
+	br = branch
+	ci = commit
+	st = status
+[init]
+	defaultBranch = main
+[pull]
+	rebase = true
+[push]
+	autoSetupRemote = true   # Automatically set upstream branch on push
+[diff]
+	algorithm = histogram    # Clearer diffs on moved/edited lines
+	colorMoved = plain       # Highlight moved blocks in diffs
+	mnemonicPrefix = true    # More intuitive refs in diff output
+[commit]
+	verbose = true           # Include diff comment in commit message template
+[column]
+	ui = auto 			     # Output in columns when possible
+[branch]
+	sort = -committerdate    # Sort branches by most recent commit first
+[tag]
+	sort = -version:refname  # Sort version numbers as you would expect
+[rerere]
+	enabled = true           # Record and reuse conflict resolutions
+	autoupdate = true        # Apply stored conflict resolutions automatically
+[user]
+	name = Nic O'Connor
+	email = nic.oconnor@gmail.com
+[fetch]
+	prune = true
+[credential]
+	helper = /usr/lib/git-core/git-credential-libsecret
+[credential "https://git.nic-oconnor.com"]
+	helper = 
+	helper = "!f() { test \"$1\" = get && test -n \"${GITEA_KEY:-}\" && printf \"username=%s\\npassword=%s\\n\" \"${GITEA_USER:-$(id -un)}\" \"$GITEA_KEY\"; }; f"
+	helper = /usr/lib/git-core/git-credential-libsecret
diff --git a/hosts/omarchy-air/config/herdr/config.toml b/hosts/omarchy-air/config/herdr/config.toml
new file mode 100644
index 0000000..6a2fc96
--- /dev/null
+++ b/hosts/omarchy-air/config/herdr/config.toml
@@ -0,0 +1,96 @@
+onboarding = false
+# Mirrors the Omarchy tmux config in config/tmux/tmux.conf
+# tmux session -> herdr workspace, tmux window -> herdr tab, tmux pane -> herdr pane
+
+[theme]
+# tmux ran on the terminal's own palette (bg=default, fg=default, ANSI blue accents)
+name = "terminal"
+
+[theme.custom]
+# The active tab is drawn as panel_bg text on an accent background, so panel_bg
+# has to be dark for it to read - same colors as status-left's "#[fg=black,bg=blue]"
+panel_bg = "black"
+
+[terminal]
+# Matches -c "#{pane_current_path}" on every split, window, and session
+new_cwd = "follow"
+
+[keys]
+prefix = "ctrl+space"
+
+# Config and help
+reload_config = "prefix+q"
+help = "prefix+?"
+detach = "prefix+d"
+
+# Copy mode
+copy_mode = "prefix+["
+
+# Panes
+split_horizontal = ["prefix+h", "alt+enter"]
+split_vertical = ["prefix+v", "alt+shift+enter"]
+close_pane = ["prefix+x", "alt+esc"]
+zoom = "prefix+z"
+last_pane = "prefix+;"
+
+focus_pane_left = "ctrl+alt+left"
+focus_pane_down = "ctrl+alt+down"
+focus_pane_up = "ctrl+alt+up"
+focus_pane_right = "ctrl+alt+right"
+
+resize_mode = ["prefix+ctrl+left", "prefix+ctrl+down", "prefix+ctrl+up", "prefix+ctrl+right"]
+
+# Like resize-pane on C-M-S-arrows
+resize_pane_left = "ctrl+alt+shift+left"
+resize_pane_down = "ctrl+alt+shift+down"
+resize_pane_up = "ctrl+alt+shift+up"
+resize_pane_right = "ctrl+alt+shift+right"
+
+# No tmux equivalent; herdr's default prefix+shift+p is taken by previous session
+rename_pane = "prefix+shift+o"
+
+# Windows -> tabs
+new_tab = "prefix+c"
+rename_tab = "prefix+r"
+close_tab = "prefix+k"
+switch_tab = ["prefix+1..9", "alt+1..9"]
+previous_tab = ["prefix+p", "alt+left"]
+next_tab = ["prefix+n", "alt+right"]
+
+# Like swap-window -t -1/+1 on M-S-Left/Right
+move_tab_previous = "alt+shift+left"
+move_tab_next = "alt+shift+right"
+
+# Sessions -> workspaces
+new_workspace = "prefix+shift+c"
+rename_workspace = "prefix+shift+r"
+close_workspace = "prefix+shift+k"
+previous_workspace = ["prefix+shift+p", "alt+up"]
+next_workspace = ["prefix+shift+n", "alt+down"]
+
+[ui]
+accent = "blue"
+
+# tmux drew single-line dividers between adjacent panes and no outer frame
+pane_gaps = false
+pane_outer_borders = false
+
+# tmux had no scrollbar column beside its panes
+pane_scrollbars = false
+
+# kill-window and kill-session never asked
+confirm_close = false
+
+# automatic-rename gave windows a name without prompting
+prompt_new_tab_name = false
+
+# set -g mouse on
+mouse_capture = true
+
+# status-right had the zoom flag followed by #h
+tab_bar_right = [{ type = "zoom" }, { type = "hostname" }]
+
+# set -g set-titles on / set -g set-titles-string '#h:#W', where tmux's #W was
+# the basename of the pane cwd. This is what Hyprland shows in the group bar,
+# and it resolves on the server so remote sessions name the remote host.
+window_title = "{hostname}: {workspace}"
diff --git a/hosts/omarchy-air/config/hypr/input.lua b/hosts/omarchy-air/config/hypr/input.lua
new file mode 100644
index 0000000..7fefdc4
--- /dev/null
+++ b/hosts/omarchy-air/config/hypr/input.lua
@@ -0,0 +1,83 @@
+-- Keep only your personal input overrides here. Uncommented settings below
+-- replace Omarchy's defaults.
+
+-- Keyboard layout and options.
+-- See https://wiki.hypr.land/Configuring/Basics/Variables/#input
+-- hl.config({
+--   input = {
+--     -- Use multiple keyboard layouts and switch between them with Left Alt + Right Alt.
+--     kb_layout = "us,dk,eu",
+--     kb_options = "compose:caps,shift:both_capslock_cancel,grp:alts_toggle",
+--
+--     -- Use a specific keyboard variant if needed (e.g. intl for international keyboards).
+--     kb_variant = "intl",
+--
+--     -- Change speed of keyboard repeat.
+--     repeat_rate = 40,
+--     repeat_delay = 250,
+--
+--     -- Start with numlock on by default.
+--     numlock_by_default = true,
+--
+--     -- Increase sensitivity for mouse/trackpad (default: 0).
+--     sensitivity = 0.35,
+--
+--     -- Turn off mouse acceleration (default: adaptive).
+--     accel_profile = "flat",
+--
+--     touchpad = {
+--       -- Use traditional (non-inverse) scrolling.
+--       natural_scroll = false,
+--
+--       -- Re-enable tap-to-click (one-finger tap = left, two-finger = right).
+--       tap_to_click = true,
+--
+--       -- Use two-finger clicks for right-click instead of lower-right corner.
+--       clickfinger_behavior = true,
+--
+--       -- Control the speed of your scrolling.
+--       scroll_factor = 0.4,
+--
+--       -- Enable the touchpad while typing.
+--       disable_while_typing = false,
+--
+--       -- Left-click-and-drag with three fingers.
+--       drag_3fg = 1,
+--     },
+--   },
+-- })
+
+-- App-specific touchpad scroll speeds.
+-- o.window("(Alacritty|kitty|foot)", { scroll_touchpad = 1.5 })
+-- o.window("com.mitchellh.ghostty", { scroll_touchpad = 0.2 })
+
+-- Enable touchpad gestures for changing workspaces.
+-- See https://wiki.hypr.land/Configuring/Advanced-and-Cool/Gestures/
+-- hl.gesture({ fingers = 3, direction = "horizontal", action = "workspace" })
+
+-- Enable touchpad gestures for moving focus (helpful on scrolling layout).
+-- hl.gesture({ fingers = 3, direction = "left", action = function() hl.dispatch(hl.dsp.focus({ direction = "l" })) end })
+-- hl.gesture({ fingers = 3, direction = "right", action = function() hl.dispatch(hl.dsp.focus({ direction = "r" })) end })
+
+-- lan-mouse (handoff) virtual pointer: DO NOT add sensitivity/accel_profile rules here.
+--
+-- Tried and measured as INERT on 2026-10-10. `hl.device({name="unknown-device", ...})` does
+-- match the device (proven by toggling scroll_factor and watching hyprctl report it), but
+-- `sensitivity` and `accel_profile` are libinput pointer-acceleration settings and a
+-- wlr-virtual-pointer is not a libinput device, so they have nothing to act on. Measured
+-- travel with `lan-mouse test-emulation` + hyprctl cursorpos was 398x198px at sensitivity 0
+-- AND at -0.9 -- identical, and exactly 1:1 with the raw deltas. Both machines measure the
+-- same 398x198, so neither end scales.
+--
+-- Corollary: global `accel_profile = "flat"` would also be a no-op for the virtual pointer
+-- while permanently changing how the real trackpad feels. Pure loss -- do not do it.
+-- The magnitude of forwarded motion originates on the SENDING machine's trackpad.
+--
+-- ROOT CAUSE FOUND 2026-10-10: lan-mouse 0.11.0 forwards UNACCELERATED deltas.
+-- input-capture/src/layer_shell.rs:887 destructures the relative-pointer event as
+-- `dx_unaccel: dx, dy_unaccel: dy, ..` -- the `..` throws away the accelerated dx/dy that the
+-- same event carries. So the accel curve is stripped at the SENDER and nothing replaces it at
+-- the receiver. Consequence: sensitivity/accel_profile are inert for forwarded motion on BOTH
+-- ends, so "sync the sensitivity between the laptops" is impossible by configuration.
+-- The only fix is a source patch to use the accelerated dx/dy.
+-- See memory: lan-mouse-forwards-unaccelerated-deltas.md
diff --git a/hosts/omarchy-air/config/hypr/monitors.lua b/hosts/omarchy-air/config/hypr/monitors.lua
new file mode 100644
index 0000000..32123c3
--- /dev/null
+++ b/hosts/omarchy-air/config/hypr/monitors.lua
@@ -0,0 +1,22 @@
+-- See https://wiki.hypr.land/Configuring/Basics/Monitors/
+-- List current monitors and supported resolutions with: hyprctl monitors all
+
+-- Monitor scale is Hyprland's scale for the output. It sizes everything
+-- Wayland-native, accepts fractions (1.6, 1.75), and applies immediately.
+-- "auto" lets Hyprland pick per display.
+local omarchy_monitor_scale = 1.33333
+hl.monitor({ output = "", mode = "preferred", position = "auto", scale = omarchy_monitor_scale })
+
+-- Configure a specific monitor.
+-- hl.monitor({ output = "DP-2", mode = "2560x1440@144", position = "0x0", scale = 1 })
+
+-- Portrait/rotated secondary monitor (transform: 1 = 90°, 3 = 270°).
+-- hl.monitor({ output = "DP-2", mode = "preferred", position = "auto", scale = 1, transform = 1 })
+
+-- GDK scale is GDK_SCALE, the factor GTK draws its own UI at. It's what
+-- sizes X11/XWayland windows, which Omarchy leaves unscaled so they stay
+-- crisp instead of being stretched by the compositor. GTK only honors whole
+-- numbers, so use the nearest integer to the monitor scale, and restart an
+-- app for a change to reach it.
+local omarchy_gdk_scale = 1
+hl.env("GDK_SCALE", tostring(omarchy_gdk_scale))
diff --git a/hosts/omarchy-air/config/mimeapps.list b/hosts/omarchy-air/config/mimeapps.list
new file mode 100644
index 0000000..6bcd650
--- /dev/null
+++ b/hosts/omarchy-air/config/mimeapps.list
@@ -0,0 +1,26 @@
+
+[Default Applications]
+text/plain=nvim.desktop
+text/english=nvim.desktop
+text/x-makefile=nvim.desktop
+text/x-c++hdr=nvim.desktop
+text/x-c++src=nvim.desktop
+text/x-chdr=nvim.desktop
+text/x-csrc=nvim.desktop
+text/x-java=nvim.desktop
+text/x-moc=nvim.desktop
+text/x-pascal=nvim.desktop
+text/x-tcl=nvim.desktop
+text/x-tex=nvim.desktop
+application/x-shellscript=nvim.desktop
+text/x-c=nvim.desktop
+text/x-c++=nvim.desktop
+application/xml=nvim.desktop
+text/xml=nvim.desktop
+text/html=chromium.desktop
+x-scheme-handler/http=chromium.desktop
+x-scheme-handler/https=chromium.desktop
+x-scheme-handler/about=chromium.desktop
+x-scheme-handler/unknown=chromium.desktop
+x-scheme-handler/mailto=HEY.desktop
+x-scheme-handler/claude-cli=claude-code-url-handler.desktop
diff --git a/hosts/omarchy-air/system/modprobe.d/asahi-notch.conf b/hosts/omarchy-air/system/modprobe.d/asahi-notch.conf
new file mode 100644
index 0000000..f525db0
--- /dev/null
+++ b/hosts/omarchy-air/system/modprobe.d/asahi-notch.conf
@@ -0,0 +1 @@
+options appledrm show_notch=1
diff --git a/hosts/omarchy-air/system/modprobe.d/hid_apple.conf b/hosts/omarchy-air/system/modprobe.d/hid_apple.conf
new file mode 100644
index 0000000..1729ac6
--- /dev/null
+++ b/hosts/omarchy-air/system/modprobe.d/hid_apple.conf
@@ -0,0 +1 @@
+options hid_apple fnmode=1
diff --git a/install.sh b/install.sh
index 192b60b..2ab2cd4 100755
--- a/install.sh
+++ b/install.sh
@@ -18,6 +18,12 @@ STAMP="$(date +%s)"
 DRY=0
 STEPS=(packages config themes plugins bin handoff services system)
 
+# Per-host overlay: hosts/<hostname>/{config,system}/ mirror the shared trees, and
+# a file there replaces the shared copy of the same path on that host only. It is
+# how hardware-specific files (monitor scale, fnmode) stay off the wrong machine.
+HOST="${OMARCHY_SETUP_HOST:-$(hostname)}"
+HOST_DIR="$REPO/hosts/$HOST"
+
 # omarchy-handoff peer addresses to open the firewall for. The peer is dual-homed
 # (Wi-Fi + dock NIC) and the dock address disappears on undock, so list both.
 if [[ -z ${HANDOFF_PEER_IPS+x} ]]; then
@@ -61,6 +67,20 @@ install_file() {
   fi
 }
 
+# layered <tree> -- NUL-separated "<src>\t<rel>" for every file in the shared tree
+# and the host overlay, the host copy winning where both have the same path.
+layered() {
+  local tree=$1 f rel
+  declare -A pick=()
+  for base in "$REPO/$tree" "$HOST_DIR/$tree"; do
+    [[ -d $base ]] || continue
+    while IFS= read -r -d '' f; do
+      rel=${f#"$base/"}; pick[$rel]=$f
+    done < <(find "$base" -type f -print0)
+  done
+  for rel in "${!pick[@]}"; do printf '%s\t%s\0' "${pick[$rel]}" "$rel"; done | sort -z -t$'\t' -k2
+}
+
 # ---------------------------------------------------------------- packages
 step_packages() {
   head_ "Packages"
@@ -108,11 +128,11 @@ step_packages() {
 # ---------------------------------------------------------------- config
 step_config() {
   head_ "Config files -> ~/.config"
+  [[ -d $HOST_DIR/config ]] && say "  host overlay: hosts/$HOST/config"
   local src rel
-  while IFS= read -r -d '' src; do
-    rel=${src#"$REPO/config/"}
+  while IFS=$'\t' read -r -d '' src rel; do
     install_file "$src" "$HOME/.config/$rel"
-  done < <(find "$REPO/config" -type f -print0 | sort -z)
+  done < <(layered config)
 
   if (( ! DRY )) && command -v hyprctl >/dev/null && [[ -n ${HYPRLAND_INSTANCE_SIGNATURE:-} ]]; then
     hyprctl reload >/dev/null 2>&1
@@ -370,9 +390,9 @@ step_handoff() {
 # ---------------------------------------------------------------- system
 step_system() {
   head_ "System drop-ins (needs sudo)"
+  [[ -d $HOST_DIR/system ]] && say "  host overlay: hosts/$HOST/system"
   local src rel dest
-  while IFS= read -r -d '' src; do
-    rel=${src#"$REPO/system/"}
+  while IFS=$'\t' read -r -d '' src rel; do
     dest="/etc/$rel"
     if [[ -e $dest ]] && cmp -s "$src" "$dest"; then
       skip "$dest"
@@ -383,12 +403,12 @@ step_system() {
       continue
     fi
     sudo install -D -m 0644 "$src" "$dest" && ok "$dest"
-  done < <(find "$REPO/system" -type f -print0 | sort -z)
+  done < <(layered system)
 
   if (( ! DRY )); then
     sudo sysctl --system >/dev/null 2>&1 && ok "sysctl reloaded"
     say ""
-    say "  hid_apple.conf (fnmode=2: F-keys act as F-keys) only takes effect once the"
+    say "  hid_apple.conf (fnmode) only takes effect once the"
     say "  initramfs is rebuilt or the module reloads:"
     say "    sudo mkinitcpio -P   # or: sudo modprobe -r hid_apple && sudo modprobe hid_apple"
   fi
@@ -410,7 +430,7 @@ main() {
   done
   (( ${#want[@]} )) || want=("${STEPS[@]}")
 
-  say "${c_hd}omarchy-setup${c_off}  repo=$REPO"
+  say "${c_hd}omarchy-setup${c_off}  repo=$REPO  host=$HOST"
   (( DRY )) && warn "dry run - nothing will be changed"
   command -v omarchy >/dev/null || warn "omarchy not found; this looks like a non-Omarchy host"