diff --git a/CLAUDE.md b/CLAUDE.md
index a220e77..4b62dca 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -40,3 +40,5 @@ laptop" shape).
 - Before any `launchctl disable`/`bootout`: record current `launchctl print` state to `.backup/`
 - Homebrew `Brewfile` at repo root is the package manifest — `brew bundle` is the install
 - macOS gotchas go in this file's Conventions; per-decision reasoning goes in `DECISIONS.md`
+- **Apply everything:** `scripts/run.sh` from steel141 (sudo primed from `$HOMELAB_PASSWORD` over `ssh -tt`). Second run must be all `[skip]`.
+- GUI-only steps live in `docs/manual-checklist.md` — read when something "didn't apply" (it's probably on that list).
diff --git a/docs/manual-checklist.md b/docs/manual-checklist.md
new file mode 100644
index 0000000..1374441
--- /dev/null
+++ b/docs/manual-checklist.md
@@ -0,0 +1,32 @@
+# Manual checklist — GUI-only steps on macOS 26 Tahoe
+
+Do these once, in order, after `scripts/run.sh` has completed. Tick and date.
+
+## Apply the shell-level changes
+- [ ] Log out / log in once (key repeat, press-and-hold, scroll direction only fully apply to a fresh session).
+
+## Cloud + privacy
+- [ ] System Settings > [your name] > iCloud > Drive (or "Saved to iCloud" > Drive): **Desktop & Documents Folders = OFF**. Keep account signed in.
+- [ ] System Settings > General > AirDrop & Handoff: Handoff OFF, AirDrop = Contacts Only.
+- [ ] System Settings > Screen Time: App & Website Activity OFF.
+- [ ] System Settings > Spotlight: untick Siri Suggestions and any web/store result types; "Help Apple Improve Search" OFF.
+- [ ] System Settings > Notifications: Allow notifications when mirroring/sharing OFF (keeps popups off a projector).
+
+## DAW Focus
+- [ ] System Settings > Focus > "+" > Custom > name **DAW**, icon of your choice. Allowed notifications: none. "Share across devices" OFF. Toggle it from the menu-bar moon before a session.
+
+## Apps needing a first-launch grant
+- [ ] Launch **Rectangle** once -> grant Accessibility when prompted. Set your snap keys.
+- [ ] Launch **kitty** once. Gatekeeper prompt -> Open.
+- [ ] Launch **Tailscale** -> log in to the tailnet. Confirm `tailscale status` in kitty and that `ssh mac` from bebop resolves via MagicDNS later.
+- [ ] Gitea: `cat ~/.ssh/id_ed25519.pub` -> https://git.sethpc.xyz/user/settings/keys -> Add Key. Then `git clone git@git.sethpc.xyz:Seth/mac.git` works from the Mac if you ever want to edit there.
+
+## Ableton
+- [ ] ableton.com > account > download Live 12 (Suite/trial) -> install to /Applications -> authorize.
+- [ ] Re-run `scripts/run.sh --no-tank` from steel141 so the Dock picks up Live (the script only adds it if installed).
+- [ ] Live > Browser > Packs: download the Suite packs you want (they're part of the license — do not torrent them).
+- [ ] Third-party packs: Finder > Go > Connect to Server > `smb://192.168.0.173/tank` (user seth, tick "Remember in Keychain") -> copy from `Downloads/Software/Milkie/` to `~/Music/Ableton/Samples/` (local disk — never run samples off SMB).
+- [ ] Live > Settings > Audio: once an interface is attached, pick it, 48 kHz, buffer 128 (raise if crackle). Test with the DAW Focus on and the lid open on AC for 15 min: no sleep, no notification.
+
+## Backup
+- [ ] `ssh mac ~/mac/scripts/backup.sh` by hand once -> confirm `/tank/backups/mac/Ableton` appears on pve173 and `~/Library/Logs/mac-backup.log` exists.
diff --git a/scripts/run.sh b/scripts/run.sh
new file mode 100755
index 0000000..a846cd1
--- /dev/null
+++ b/scripts/run.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+# From steel141: sync repo to the Mac, run setup there, pull backups back, then do the tank side.
+# Usage: scripts/run.sh [--no-tank]
+# sudo on the Mac is primed from $HOMELAB_PASSWORD over a forced pty (ssh -tt) so this works from a
+# non-interactive session; with the var unset it falls back to an interactive prompt.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+rsync -a --delete --exclude .git --exclude .backup --exclude Brewfile.lock.json ./ mac:mac/
+if [[ -n ${HOMELAB_PASSWORD:-} ]]; then
+  printf '%s\n' "$HOMELAB_PASSWORD" | ssh -tt mac 'sudo -S -v && HOSTNAME_WANT=mac ~/mac/scripts/setup.sh; exit' | tr -d '\r'
+else
+  ssh -t mac 'HOSTNAME_WANT=mac ~/mac/scripts/setup.sh'
+fi
+mkdir -p .backup/mac && rsync -a mac:.mac-setup-backup/ .backup/mac/
+[[ ${1:-} == --no-tank ]] && exit 0
+PUB=$(ssh mac cat .ssh/id_ed25519.pub)
+ssh pve173 'bash -s' -- "$PUB" < scripts/tank-side.sh
+echo "tank side done; test: ssh mac ~/mac/scripts/backup.sh"