diff --git a/Brewfile b/Brewfile
index 366e189..836bad3 100644
--- a/Brewfile
+++ b/Brewfile
@@ -1,4 +1,5 @@
 tap "dart-lang/dart"
+tap "holtwick/tap"
 tap "sass/sass"
 
 brew "ack"
@@ -8,11 +9,11 @@ brew "autoconf"
 brew "automake"
 brew "b2-tools"
 brew "bat"
-brew "bazelisk"
 brew "binwalk"
 brew "cask"
 brew "ccache"
 brew "certbot"
+brew "cloudflared"
 brew "cmake"
 brew "colima"
 brew "devcontainer"
@@ -22,6 +23,7 @@ brew "direnv"
 brew "duck"
 brew "earthly"
 brew "esptool"
+brew "fish"
 brew "gh"
 brew "ghidra", link: false
 brew "git"
@@ -31,14 +33,18 @@ brew "gnupg"
 brew "go"
 brew "gradle"
 brew "hf"
+brew "holtwick/tap/bx"
 brew "htop"
 brew "httpie"
-brew "huggingface-cli"
 brew "hugo"
 brew "imagemagick"
 brew "john-jumbo"
 brew "jq"
+brew "kubeconform"
+brew "kubectx"
+brew "librsvg"
 brew "lima"
+brew "minikube"
 brew "mise"
 brew "mosh"
 brew "neovim"
@@ -93,6 +99,7 @@ cask "rectangle"
 cask "scroll-reverser"
 cask "temurin"
 cask "veracrypt"
+cask "wezterm"
 cask "zulu@17"
 
 def is_corp?
@@ -100,13 +107,20 @@ def is_corp?
   `profiles status -type enrollment 2>/dev/null`.include?("Enrolled via DEP: Yes")
 end
 
+if is_corp?
+  brew "bazelisk", link: false
+end
+
 # non-corp
 if !is_corp?
-  brew "bazel"
+  brew "bazelisk"
   brew "openssh"
+
   cask "claude-code"
   cask "cryptomator"
+  cask "keepassxc"
   cask "gcloud-cli"
   cask "google-cloud-sdk"
+  cask "keybase"
   cask "orbstack"
 end
diff --git a/bin/macos/update_brewfile b/bin/macos/update_brewfile
index a099df5..7c950a7 100755
--- a/bin/macos/update_brewfile
+++ b/bin/macos/update_brewfile
@@ -251,7 +251,13 @@ def main(args):
             if last_type and e.pkg_type != last_type:
                 output_lines.append("")
             last_type = e.pkg_type
-        output_lines.extend(e.to_lines())
+
+        lines = e.to_lines()
+        # If we just added a blank line, and the new lines start with one, skip the first new line
+        if output_lines and output_lines[-1] == "" and lines and lines[0] == "":
+            output_lines.extend(lines[1:])
+        else:
+            output_lines.extend(lines)
 
     new_content = "\n".join(output_lines)
     if footer:
diff --git a/dotfiles/bxignore b/dotfiles/bxignore
new file mode 100644
index 0000000..34149e2
--- /dev/null
+++ b/dotfiles/bxignore
@@ -0,0 +1,4 @@
+# Credentials
+.ssh
+Passwords.kdbx
+Passwords.kdbx.age
diff --git a/dotfiles/gitconfig b/dotfiles/gitconfig
index 0a2a125..80f7743 100644
--- a/dotfiles/gitconfig
+++ b/dotfiles/gitconfig
@@ -19,6 +19,9 @@
 [difftool]
   prompt = false
 
+[difftool "difftastic"]
+  cmd = difft "$LOCAL" "$REMOTE"
+
 [alias]
   st = status
   last = log -1 HEAD
diff --git a/dotfiles/shenv b/dotfiles/shenv
index 2afe628..33475cd 100755
--- a/dotfiles/shenv
+++ b/dotfiles/shenv
@@ -15,6 +15,7 @@ export DEBEMAIL="david@systemoverlord.com"
 export DEBFULLNAME="David Tomaschik"
 export LESS="-MR"
 export QUOTING_STYLE="literal"  # Coreutils quotes
+export HOMEBREW_NO_ENV_HINTS=1
 
 # Fix gnome-terminal
 if [ "$TERM" = "xterm" ] && [ "$COLORTERM" = "gnome-terminal" ] ; then