diff --git a/config/.chezmoiscripts/run_onchange_11-arch-packages.sh.tmpl b/config/.chezmoiscripts/run_onchange_11-arch-packages.sh.tmpl
index 4bcd5b8..8bf11f4 100644
--- a/config/.chezmoiscripts/run_onchange_11-arch-packages.sh.tmpl
+++ b/config/.chezmoiscripts/run_onchange_11-arch-packages.sh.tmpl
@@ -5,7 +5,7 @@
 set -eu
 
 {{ if eq .chezmoi.os "linux" -}}
-{{ $pkgs := includeTemplate "dot_config/paru/pkglist.txt.tmpl" . | regexReplaceAll `(?m)^\s*(#.*)?$\n?` "" -}}
+{{ $pkgs := includeTemplate "dot_config/paru/pkglist.txt.tmpl" . | regexReplaceAll `(?m)\s*#.*$` "" | regexReplaceAll `(?m)^\s*$\n?` "" -}}
 {{ if $pkgs -}}
 
 paru -S --needed - <<'PKGEOF'
diff --git a/config/dot_config/homebrew/Brewfile.tmpl b/config/dot_config/homebrew/Brewfile.tmpl
index c25fc77..b0911c2 100644
--- a/config/dot_config/homebrew/Brewfile.tmpl
+++ b/config/dot_config/homebrew/Brewfile.tmpl
@@ -15,6 +15,7 @@ brew "zsh"
 
 # --- IMPORTANT: core programs ---
 brew "gnupg"
+brew "openssh"
 brew "less"
 brew "nano"
 brew "wget"
@@ -65,7 +66,7 @@ brew "yt-dlp"
 
 # --- languages / frameworks ---
 brew "rustup" # required and... honestly just kinda useful
-brew "node@24", link: true # using LTS because some packages are picky about that 
+brew "node@24", link: true # using LTS because some packages are picky about that
 
 # --- vcs --
 brew "git"
diff --git a/config/dot_config/paru/pkglist.txt.tmpl b/config/dot_config/paru/pkglist.txt.tmpl
index 3433b26..d43f475 100644
--- a/config/dot_config/paru/pkglist.txt.tmpl
+++ b/config/dot_config/paru/pkglist.txt.tmpl
@@ -1 +1,139 @@
-# TODO: fill with packages
+# --- IMPORTANT: bootstrap! ---
+chezmoi
+just
+age
+fish
+starship
+
+# --- IMPORTANT: shells! ---
+bash
+zsh
+
+# --- IMPORTANT: base system! ---
+base
+base-devel
+linux
+linux-headers
+linux-zen
+linux-zen-headers
+linux-firmware
+amd-ucode
+efibootmgr
+btrfs-progs
+snapper
+dosfstools
+zram-generator
+
+# --- IMPORTANT: core programs ---
+gnupg
+openssh
+less
+nano
+wget
+curl
+tree
+rsync
+unzip
+inetutils
+mosh
+fwupd
+
+# --- meta + package management ---
+pacman-contrib
+man-db
+reflector
+flatpak
+paru-git # paru-bin installing paru-git lol
+topgrade-bin # the designated upgrade owner for this whole system
+
+# --- jdks ---
+jdk25-openjdk
+jdk21-openjdk
+jdk17-openjdk
+jdk8-openjdk
+
+# --- better coreutils ---
+dust
+duf
+eza
+bat
+procs
+fd
+ripgrep
+sd
+hyperfine
+tealdeer
+
+# --- cli tools ---
+zoxide
+fzf
+pwgen
+jq
+ffmpeg
+imagemagick
+oxipng
+btop
+direnv
+pfetch-rs
+shfmt
+zellij
+yt-dlp
+trash-cli
+
+# --- languages / frameworks ---
+rustup
+nodejs-lts-krypton # using LTS because some packages are picky about that
+
+# --- vcs ---
+git
+git-lfs
+github-cli
+jujutsu
+difftastic
+
+# --- neovim ---
+neovim
+tree-sitter-cli
+
+# --- typesetting ---
+texlive-meta
+typst
+tinymist
+typstyle
+
+# --- fonts ---
+noto-fonts-cjk
+noto-fonts-emoji
+ttf-fira-code
+ttf-firacode-nerd
+ttf-jetbrains-mono
+ttf-jetbrains-mono-nerd
+ttf-libertinus
+
+# --- networking / remote access ---
+networkmanager
+bind
+nmap
+tailscale
+
+# --- pipewire (audio) ---
+pipewire
+pipewire-alsa
+pipewire-jack
+pipewire-pulse
+wireplumber
+
+# --- apps: everywhere ---
+# TODO: maybe a flatpak list? maybe even move some of these?
+discord
+element-desktop
+signal-desktop
+telegram-desktop
+keepassxc
+handbrake
+ghostty-nightly-bin # TODO: consider stable ghostty again
+zen-browser-bin
+vscodium-bin
+
+# TODO: need some way to declare "profiles" because like.
+# all the desktop stuff and gaming and everything is missing.
diff --git a/justfile b/justfile
index bb3e7c3..67c5ef6 100644
--- a/justfile
+++ b/justfile
@@ -27,5 +27,5 @@ brew-drift:
 pacman-drift:
     #!/bin/bash
     comm -13 \
-      <(grep -vE '^\s*(#|$)' ~/.config/paru/pkglist.txt | sort) \
+      <(sed -e 's/\s*#.*$//' -e '/^\s*$/d' ~/.config/paru/pkglist.txt | sort) \
       <(pacman -Qqe | sort)
diff --git a/system.just b/system.just
index 3f21e4d..51a46d0 100644
--- a/system.just
+++ b/system.just
@@ -24,7 +24,7 @@ timezone:
 
 [linux]
 timezone:
-    timedatectl set-timezone Europe/Berlin
+    sudo timedatectl set-timezone Europe/Berlin
 
 # sets login shell for the current user to fish
 login-shell: