diff --git a/chezmoi/.chezmoiexternal.toml.tmpl b/chezmoi/.chezmoiexternal.toml.tmpl
index 7b18df0a..6d524090 100644
--- a/chezmoi/.chezmoiexternal.toml.tmpl
+++ b/chezmoi/.chezmoiexternal.toml.tmpl
@@ -3,17 +3,6 @@
   url = "https://github.com/GitAlias/gitalias/raw/main/gitalias.txt"
   refreshPeriod = "168h"
 
-[".config/git/ignore"]
-  type = "file"
-{{- if eq .chezmoi.os "darwin" }}
-  url = "https://github.com/github/gitignore/raw/main/Global/macOS.gitignore"
-{{- else if eq .chezmoi.os "windows" }}
-  url = "https://github.com/github/gitignore/raw/main/Global/Windows.gitignore"
-{{- else }}
-  url = "https://github.com/github/gitignore/raw/main/Global/Linux.gitignore"
-{{- end }}
-  refreshPeriod = "168h"
-
 {{- if .is_ephemeral }}
 [".local/bin/fzf"]
   type = "archive-file"
diff --git a/chezmoi/.chezmoiscripts/run_before_brew_install.sh.tmpl b/chezmoi/.chezmoiscripts/run_before_brew_install.sh.tmpl
index 0d18cb32..42e6b115 100644
--- a/chezmoi/.chezmoiscripts/run_before_brew_install.sh.tmpl
+++ b/chezmoi/.chezmoiscripts/run_before_brew_install.sh.tmpl
@@ -16,6 +16,20 @@ if ! command -v brew >/dev/null; then
   done
 fi
 
+brew update
+
+taps=(
+  oven-sh/bun
+  hashicorp/tap
+  atlassian/acli
+  databricks/tap
+)
+
+for tap in "${taps[@]}"; do
+  brew tap "$tap" 2>/dev/null || true
+  brew trust "$tap"
+done
+
 brew bundle install \
 --force-cleanup --zap \
 --file=/dev/stdin <<EOF
@@ -167,7 +181,7 @@ cask "rectangle"
 # web
 cask "adguard"
 cask "brave-browser"
-cask "firefox"
+cask "firefox", args: { force: true }
 # cask "microsoft-edge"  # seems to required sudo everytime...
 
 # communication
diff --git a/chezmoi/private_dot_config/git/ignore.tmpl b/chezmoi/private_dot_config/git/ignore.tmpl
new file mode 100644
index 00000000..2d17dedc
--- /dev/null
+++ b/chezmoi/private_dot_config/git/ignore.tmpl
@@ -0,0 +1,111 @@
+{{ if eq .chezmoi.os "darwin" -}}
+
+# General
+.DS_Store
+.localized
+__MACOSX/
+.AppleDouble
+.LSOverride
+Icon[
+]
+
+# Resource forks
+._*
+
+# Files and directories that might appear in the root of a volume
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns
+.com.apple.timemachine.donotpresent
+.com.apple.timemachine.supported
+.PKInstallSandboxManager
+.PKInstallSandboxManager-SystemSoftware
+.hotfiles.btree
+.vol
+.file
+.disk_label*
+lost+found
+.HFS+ Private Directory Data[
+]
+
+# Directories potentially created on remote AFP share
+.AppleDB
+.AppleDesktop
+Network Trash Folder
+Temporary Items
+.apdisk
+
+# Mac OS 6 to 9
+Desktop DB
+Desktop DF
+TheFindByContentFolder
+TheVolumeSettingsFolder
+.FBCIndex
+.FBCSemaphoreFile
+.FBCLockFolder
+
+# Quota system
+.quota.group
+.quota.user
+.quota.ops.group
+.quota.ops.user
+
+# TimeMachine
+Backups.backupdb
+.MobileBackups
+.MobileBackups.trash
+MobileBackups.trash
+tmbootpicker.efi
+
+{{ else if eq .chezmoi.os "windows" -}}
+
+# Windows thumbnail cache files
+Thumbs.db
+Thumbs.db:encryptable
+ehthumbs.db
+ehthumbs_vista.db
+
+# Dump file
+*.stackdump
+
+# Folder config file
+[Dd]esktop.ini
+
+# Recycle Bin used on file shares
+$RECYCLE.BIN/
+
+# Windows Installer files
+*.cab
+*.msi
+*.msix
+*.msm
+*.msp
+
+# Windows shortcuts
+*.lnk
+
+{{ else -}}
+
+*~
+
+# temporary files which can be created if a process still has a handle open of a deleted file
+.fuse_hidden*
+
+# Metadata left by Dolphin file manager, which comes with KDE Plasma
+.directory
+
+# Linux trash folder which might appear on any partition or disk
+.Trash-*
+
+# .nfs files are created when an open file is removed but is still being accessed
+.nfs*
+
+# Log files created by default by the nohup command
+nohup.out
+
+{{- end }}
+
+**/.claude/settings.local.json