diff --git a/AGENTS.md b/AGENTS.md
index f88e5b0..81c65df 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -56,7 +56,7 @@ cd ~/nix-config && sudo nixos-rebuild switch --flake .#wsl
 - **NixOS default shell aliases are force-cleared**: `hosts/wsl/default.nix` sets `environment.shellAliases = lib.mkForce {}` to remove NixOS defaults (`l`, `ll`, `ls`). All shell aliases are managed exclusively by Home Manager (eza integration + `fish.nix`). Don't set `environment.shellAliases` in NixOS modules — it would be ignored anyway.
 - **Neovim uses lazyvim-nix**: `programs.lazyvim` in `home/dev/neovim.nix` manages neovim via the `lazyvim-nix` flake input (loaded as `sharedModules` in `lib/default.nix`). Catppuccin nvim integration is explicitly disabled (`catppuccin.nvim.enable = false`) because LazyVim manages its own colorscheme.
 - **catppuccin module names**: Home-manager uses `catppuccin.homeModules.catppuccin` (in `home/default.nix`). NixOS uses `catppuccin.nixosModules.catppuccin` (in `lib/default.nix`). Don't use the old `homeManagerModules` name.
-- **Homebrew `cleanup = "zap"`**: Any brew formula/cask NOT declared in `modules/darwin/default.nix` WILL be removed on rebuild. Be comprehensive. Casks from taps need full path (e.g. `"goooler/repo/fl-clash"`).
+- **Homebrew `cleanup = "zap"`**: Any brew formula/cask NOT declared WILL be removed on rebuild. Be comprehensive. Casks from taps need full path (e.g. `"goooler/repo/fl-clash"`). Shared casks go in `modules/darwin/default.nix`; host-specific casks go in `hosts/*/default.nix` (nix-darwin merges `homebrew.casks` lists automatically).
 - **mise for version management**: Configured via `programs.mise` in `home/dev/languages.nix`. Config trusts all config paths (`trusted_config_paths = [ "/" ]`).
 - **Ghostty is macOS-only**: `programs.ghostty.enable = pkgs.stdenv.isDarwin` with `package = null` (installed via Homebrew cask). Terminfo is propagated to NixOS via `ghostty.terminfo` in `modules/nixos/default.nix`.
 
diff --git a/modules/darwin/default.nix b/modules/darwin/default.nix
index db254ac..d2cce54 100644
--- a/modules/darwin/default.nix
+++ b/modules/darwin/default.nix
@@ -56,6 +56,7 @@
       "1password"
       "brave-browser"
       "cherry-studio"
+      "cyberduck"
       "dbeaver-community"
       "discord"
       "feishu"