diff --git a/home/secrets.nix b/home/secrets.nix
index d905f60..55167c6 100644
--- a/home/secrets.nix
+++ b/home/secrets.nix
@@ -9,6 +9,8 @@
     secrets = {
       ai_gateway_base_url = { };
       ai_gateway_api_key = { };
+      exa_api_key = { };
+      context7_api_key = { };
     };
   };
 
@@ -16,7 +18,9 @@
     # sops-nix secrets → env vars
     for pair in \
       AI_GATEWAY_BASE_URL:${config.sops.secrets.ai_gateway_base_url.path} \
-      AI_GATEWAY_API_KEY:${config.sops.secrets.ai_gateway_api_key.path}
+      AI_GATEWAY_API_KEY:${config.sops.secrets.ai_gateway_api_key.path} \
+      EXA_API_KEY:${config.sops.secrets.exa_api_key.path} \
+      CONTEXT7_API_KEY:${config.sops.secrets.context7_api_key.path}
       set -l parts (string split : $pair)
       if test -r $parts[2]
         set -gx $parts[1] (cat $parts[2])
diff --git a/modules/darwin/default.nix b/modules/darwin/default.nix
index c374004..5da25d8 100644
--- a/modules/darwin/default.nix
+++ b/modules/darwin/default.nix
@@ -53,6 +53,7 @@
   # ── Homebrew ───────────────────────────────────────
   homebrew = {
     enable = true;
+    greedyCasks = true; # always upgrade casks even if they auto-update
 
     taps = [
       "goooler/repo"
@@ -98,6 +99,7 @@
 
     onActivation = {
       autoUpdate = true;
+      upgrade = true;
       cleanup = "zap"; # remove anything not declared above
     };
   };
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
index aed142d..49505db 100644
--- a/secrets/secrets.yaml
+++ b/secrets/secrets.yaml
@@ -1,5 +1,7 @@
 ai_gateway_base_url: ENC[AES256_GCM,data:5/F4Tp6O4cYcpV6j00WOk2kXRd9iUorvD2Fl5LWKy9yJgfA=,iv:f09QoozjEEvblSOlDutw3CODju6DlTOKSjgPS5ypfJQ=,tag:ojD9CbG6ZiL3qlUzTcp4/w==,type:str]
 ai_gateway_api_key: ENC[AES256_GCM,data:bGr4RGGOANmUNY8fZzhdq4/0hdc+3g9adFaNoXTOAF823iZAbtLi6jC7EXVrDJYuTjBH,iv:YLMecyk3yIAcSY63gmEJm7NJcFD9vE0D8zqb1vNJd98=,tag:w1GThmuY3aBNr15VPOtuNg==,type:str]
+exa_api_key: ENC[AES256_GCM,data:DqZXFCHP1wpzrvXzLtmtooqKV0ljLTmAARWnfyFjm+tDmqMl,iv:7cDwuVudmWkwoI77XX5azmuOUKrUL3akI53wDc5CJks=,tag:BJZl7M0C9EQAnELcrWYN4Q==,type:str]
+context7_api_key: ENC[AES256_GCM,data:XjwUQSarEtvWA0wnbRDn8QqFxSpCQphpzgTSeK2NVcn7Z0GLTpUkalCcFg==,iv:ttULoAsJ/4PhuE/LIVok7CaekVWO3FHwKGhjUQiG0E0=,tag:Va7wdsz90LF4LWpeQYP6Iw==,type:str]
 sops:
     age:
         - recipient: age1w74wqpmum6xa3mk5p7ya620e8mhn9afdyf30gh3fk44javxsmvssm4hs64
@@ -11,7 +13,7 @@ sops:
             YUFlVW1IcGpVdjRsMmlmL1lOeEQzY1EKH1K2NomPsote6PGp30ZASKKwQoZi9x5F
             UWPj6xphWXp/7lFE7XpujKU323tFj7mZ+wRCb77T9QTNbg8zGsUO/A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-10T17:42:34Z"
-    mac: ENC[AES256_GCM,data:dVVNOi8k8mmw1aRr1AXUDoF1UdF48HOPfX69Fh/mY9+HzZrIYCukqI4548eL0KcqCrbo0yEtTOYfg6PzckxpGA5FQRVv7qrfimkpFntbWoUzY8dy0pXxKFUxUuHW43XXpqkq1ZmVX5B6/fzkNxiLu4YY9X2Qnf840O/1E0fYaWw=,iv:UFfdK6I2SeGrBz12OcCjAycq7dFPfsAxploBvk+4Zic=,tag:6qLU79NwlKLApErYAoJIVQ==,type:str]
+    lastmodified: "2026-04-11T15:51:24Z"
+    mac: ENC[AES256_GCM,data:x3Os/6i9jdmyIitD2dnz9Dl2GPLDVQlbPfVMRnebixFJ5fX6L0BqPRVVG20FvtCUQSzTMKp5eVZPRtti3wkr5TyQHz/0bz65B7Ucq3ssnpz0Hh/X8JyLRb6dKyRiiE3kIHf82nq+Do5oFUEG95LmRvhvbVdIzdMF/TJNVXOd4DQ=,iv:hIljr/1Y0Ra02Y4PwykNjhhxzxYFeMc1/waSCEy2skA=,tag:NoLozwKMPZVxKAg8g6R3UA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2