diff --git a/zshrc/.aliases.zsh b/zshrc/.aliases.zsh
index 0cc5257..48c9efe 100644
--- a/zshrc/.aliases.zsh
+++ b/zshrc/.aliases.zsh
@@ -1,5 +1,6 @@
-alias qk='pi --model kimi-k2.6:cloud -p'
-alias qm='pi --model minimax-m3:cloud -p'
+alias qk='pi --model kimi-k2.6 -p'
+alias qc='pi --provider ollama-cloud --model kimi-k2.7-code:cloud -p'
+alias qm='pi --model minimax-m3 -p'
 alias cl='clear'
 alias cld='clear && cd'
 alias neo='neofetch'
@@ -12,7 +13,8 @@ alias col='kitten themes'
 alias sc='~/scripts/theme-switch'
 alias cc='bash -c "$(wget -qO- https://git.io/vQgMr)"'
 
-alias nup='sudo netbird up --setup-key F4098B17-55C2-447B-87C7-B75CAEFB4058'
+# Store setup key outside dotfiles (e.g. pass / bitwarden / 1Password).
+# alias nup='sudo netbird up --setup-key $NETBIRD_SETUP_KEY'
 
 # Scripts
 alias br='/home/liph/scripts/niri_br.sh'
diff --git a/zshrc/.export.zsh b/zshrc/.export.zsh
index 459a068..c953a27 100644
--- a/zshrc/.export.zsh
+++ b/zshrc/.export.zsh
@@ -1,16 +1,18 @@
+# Load private secrets (e.g. BORG_PASSPHRASE, NETBIRD_SETUP_KEY) outside version control.
+[[ -f ${XDG_CONFIG_HOME:-$HOME/.config}/secrets.env ]] && source ${XDG_CONFIG_HOME:-$HOME/.config}/secrets.env
+
 # java jdk adaption
 export JDK_TOOL_OPTIONS="-Djdk.xml.totalEntitySizeLimit=0"
 # FZF
 export FZF_CTRL_T_OPTS="--preview 'bat -n --color=always --line-range :500 {}'"
 export FZF_ALT_C_OPTS="--preview 'eza --tree --color=always {} | head -200'"
-export FZF_DEFAULT_OPTS="--height 50% --layout=default --border --color=hl:#2dd4bf"
+export FZF_DEFAULT_OPTS="--height 50% --layout=default --border --color=hl:#2dd4bf --bind tab:accept"
 export FZF_TMUX_OPTS=" -p90%,70% "
 
 # FD
 export FZF_DEFAULT_COMMAND="fd --hidden --strip-cwd-prefix --exclude .git"
 export FZF_CTRL_T_COMMAND="$FZF_DEFAULT_COMMAND"
 export FZF_ALT_C_COMMAND="fd --type=d --hidden --strip-cwd-prefix --exclude .g-t"
-export FZF_DEFAULT_OPTS='--bind tab:accept'
 
 # temuxifier
 export PATH="$HOME/.tmuxifier/bin:$PATH"
@@ -22,16 +24,16 @@ export EDITOR="nvim"
 export PYENV_ROOT="$HOME/.pyenv/"
 
 # fuse
-export BORG_FUSE_IMPL=llfuse
 export BORG_FUSE_IMPL=pyfuse3
 
 # borg podman
-export BORG_PASSPHRASE="1ChagearC"
+# Load from a secrets manager or private env file instead of dotfiles.
+# export BORG_PASSPHRASE="..."
 
 # manpager
 export MANPAGER='nvim +Man!'
 
-export XDG_CURRENT_DESKTOP=Hyprland
+export XDG_CURRENT_DESKTOP=Niri
 export XDG_SESSION_TYPE=wayland
 export QT_QPA_PLATFORM=wayland
 export SDL_VIDEODRIVER=wayland
diff --git a/zshrc/.zshrc b/zshrc/.zshrc
index 849b818..16b6c7f 100644
--- a/zshrc/.zshrc
+++ b/zshrc/.zshrc
@@ -17,7 +17,7 @@ source ~/.export.zsh
 
 # CONSOLIDATED FUNCTION: All zsh-vi-mode logic must be in one place [2]
 function zvm_after_init() {
-  Fix fzf interaction
+  # Fix fzf interaction
   source <(fzf --zsh)
 
   # Bind Atuin search for both Insert and Normal modes [9]
@@ -60,7 +60,7 @@ _fzf_comprun() {
   cd) fzf --preview 'eza --tree --color=always {} | head -200' "$@" ;;
   export | unset) fzf --preview "eval 'echo \$' {}" "$@" ;;
   ssh) fzf --preview 'dig {}' "$@" ;;
-  *) fzf --preview "--preview 'bat -n --color=always --line-range :10 {}'" "$@" ;;
+  *) fzf --preview 'bat -n --color=always --line-range :10 {}' "$@" ;;
   esac
 }