diff --git a/flake.lock b/flake.lock
index 6289b10..962dc49 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,22 @@
 {
   "nodes": {
+    "brew-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1774235677,
+        "narHash": "sha256-0ryNYmzDAeRlrzPTAgmzGH/Cgc8iv/LBN6jWGUANvIk=",
+        "owner": "Homebrew",
+        "repo": "brew",
+        "rev": "894a3d23ac0c8aaf561b9874b528b9cb2e839201",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Homebrew",
+        "ref": "5.1.1",
+        "repo": "brew",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -141,6 +158,24 @@
         "type": "github"
       }
     },
+    "nix-homebrew": {
+      "inputs": {
+        "brew-src": "brew-src"
+      },
+      "locked": {
+        "lastModified": 1774720267,
+        "narHash": "sha256-YYftFe8jyfpQI649yfr0E+dqEXE2jznZNcYvy/lKV1U=",
+        "owner": "zhaofengli",
+        "repo": "nix-homebrew",
+        "rev": "a7760a3a83f7609f742861afb5732210fdc437ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "repo": "nix-homebrew",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1773821835,
@@ -178,6 +213,7 @@
         "darwin": "darwin",
         "fw_nix": "fw_nix",
         "home-manager": "home-manager",
+        "nix-homebrew": "nix-homebrew",
         "nixpkgs": "nixpkgs",
         "nixpkgs-screen": "nixpkgs-screen",
         "vscode-server": "vscode-server"
diff --git a/flake.nix b/flake.nix
index b08af86..731f076 100644
--- a/flake.nix
+++ b/flake.nix
@@ -24,6 +24,7 @@
       url = "github:nix-darwin/nix-darwin";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nix-homebrew.url = "github:zhaofengli/nix-homebrew";
   };
 
   outputs =
@@ -71,6 +72,7 @@
           inputs.fw_nix.nixosModules.tools
           inputs.fw_nix.nixosModules.nix-settings
           inputs.fw_nix.nixosModules.futureware
+          inputs.nix-homebrew.darwinModules.nix-homebrew
           ({ lib, ... }: {
             # TODO: find solution to these ugly workarounds
             options.programs.htop = lib.mkOption {
diff --git a/hosts/mars/darwin.nix b/hosts/mars/darwin.nix
index 7b4b279..da093e7 100644
--- a/hosts/mars/darwin.nix
+++ b/hosts/mars/darwin.nix
@@ -4,15 +4,53 @@
   nixpkgs.config.allowUnfree = true;
 
   system.primaryUser = primaryUser;
+  users.users.${primaryUser} = {
+    home = "/Users/${primaryUser}";
+    shell = pkgs.zsh;
+  };
+
+  security.pam.services.sudo_local.touchIdAuth = true;
+
+  system = {
+    startup.chime = false;
+
+    defaults = {
+      loginwindow = {
+        GuestEnabled = false;
+        DisableConsoleAccess = true;
+      };
+
+      finder = {
+        AppleShowAllFiles = true; # hidden files
+        AppleShowAllExtensions = true; # file extensions
+        _FXShowPosixPathInTitle = true; # title bar full path
+        ShowPathbar = true; # breadcrumb nav at bottom
+        ShowStatusBar = true; # file count & disk space
+      };
+
+      NSGlobalDomain = {
+        NSAutomaticSpellingCorrectionEnabled = false;
+        NSAutomaticCapitalizationEnabled = false;
+        NSAutomaticPeriodSubstitutionEnabled = false;
+        NSAutomaticWindowAnimationsEnabled = false;
+      };
+    };
+  };
 
   # Create /etc/zshrc that loads the nix-darwin environment.
   programs.zsh.enable = true;
 
+  nix-homebrew = {
+    # Initial install of homebrew.
+    enable = true;
+    user = primaryUser;
+    autoMigrate = true;
+  };
   homebrew = {
     enable = true;
     onActivation = {
       cleanup = "zap";
-      autoUpdate = true;
+      autoUpdate = false;
       upgrade = true;
     };
     casks = [
@@ -20,10 +58,5 @@
     ];
   };
 
-  users.users."${primaryUser}" = {
-    name = primaryUser;
-    home = "/Users/${primaryUser}";
-  };
-
   system.stateVersion = 6; # Never change.
 }