diff --git a/nests/mac/setup.json b/nests/mac/setup.json
index 15ea6de..aaabef1 100644
--- a/nests/mac/setup.json
+++ b/nests/mac/setup.json
@@ -17,7 +17,8 @@
     "bun",
     "rust",
     "claude-code",
-    "codex"
+    "codex",
+    "machines"
   ],
   "rc_scripts": [
     "common:fzf.sh",
diff --git a/setups/machines/setup.json b/setups/machines/setup.json
index ee8f7bb..5db17ba 100644
--- a/setups/machines/setup.json
+++ b/setups/machines/setup.json
@@ -1,5 +1,6 @@
 {
   "name": "machines",
+  "install": "local:setup.sh",
   "links": [
     {
       "source": "local:ssh_config.secret",
diff --git a/setups/machines/setup.sh b/setups/machines/setup.sh
index 2a360eb..8c31490 100755
--- a/setups/machines/setup.sh
+++ b/setups/machines/setup.sh
@@ -1,6 +1,43 @@
-sudo pacman -S sftpman
+#!/bin/bash
+set -euo pipefail
 
-SCRIPT_DIR="$(dirname "$0")"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 
+case "$(uname -s)" in
+    Linux)
+        if command -v pacman &> /dev/null; then
+            sudo pacman -S --needed --noconfirm sftpman
+        fi
+        ;;
+    Darwin)
+        # sftpman is Linux-only; skip on macOS.
+        ;;
+    *)
+        echo "Unsupported OS: $(uname -s)"
+        exit 1
+        ;;
+esac
 
-op inject --in-file $SCRIPT_DIR/ssh_config_template --out-file $SCRIPT_DIR/ssh_config.secret
+if ! command -v op &> /dev/null; then
+    case "$(uname -s)" in
+        Darwin)
+            if command -v brew &> /dev/null; then
+                echo "Installing 1Password CLI via Homebrew..."
+                brew install 1password-cli
+            else
+                echo "1Password CLI (op) not found. Install Homebrew or grab op from https://1password.com/downloads/command-line/"
+                exit 1
+            fi
+            ;;
+        Linux)
+            if command -v yay &> /dev/null; then
+                yay -S --noconfirm 1password-cli
+            else
+                echo "1Password CLI (op) not found. Install it first."
+                exit 1
+            fi
+            ;;
+    esac
+fi
+
+op inject --in-file "$SCRIPT_DIR/ssh_config_template" --out-file "$SCRIPT_DIR/ssh_config.secret"