diff --git a/dotfiles/finicky.js b/dotfiles/finicky.js
index 7e9e0b75..29e47fcb 100644
--- a/dotfiles/finicky.js
+++ b/dotfiles/finicky.js
@@ -25,6 +25,7 @@ function remove1pId(urlString) {
 
 const noContainerHosts = new Set(['duckduckgo.com', 'www.google.com', 'www.amazon.com', 'wikipedia.org'])
 const bundleIdsFor1p = new Set(["com.agilebits.onepassword7", "com.1password.1password"])
+const bundleIdsForHarmony = new Set(["com.logitech.myharmony"])
 const bundleIdsForAlfred = new Set(["com.runningwithcrayons.Alfred"])
 const meContainerIds = [
   {%@@ for id in firefox_me_ids.split() @@%}
@@ -128,6 +129,9 @@ module.exports = {
           if (bundleIdsFor1p.has(opener.bundleId)) {
             return true
           }
+          if (bundleIdsForHarmony.has(opener.bundleId)) {
+            return true
+          }
 
           if (bundleIdsForAlfred.has(opener.bundleId)) {
             return !noContainerHosts.has(url.host) || contains1pId(url.search)
diff --git a/script/lib/macos.sh b/script/lib/macos.sh
index 8da7b4d5..de8ad310 100644
--- a/script/lib/macos.sh
+++ b/script/lib/macos.sh
@@ -237,8 +237,17 @@ function macos::setup_security() {
   # shellcheck disable=SC2010
   if ls /usr/lib/pam | grep -q "pam_tid.so"; then
     echo "Configuring sudo authentication using TouchID:"
-    PAM_FILE="/etc/pam.d/sudo"
-    FIRST_LINE="# sudo: auth account password session"
+    if [[ -f /etc/pam.d/sudo_local || -f /etc/pam.d/sudo_local.template ]]; then
+      # New in macOS Sonoma, survives updates.
+      PAM_FILE="/etc/pam.d/sudo_local"
+      FIRST_LINE="# sudo_local: local config file which survives system update and is included for sudo"
+      if [[ ! -f "/etc/pam.d/sudo_local" ]]; then
+        echo "$FIRST_LINE" | sudo tee "$PAM_FILE" >/dev/null
+      fi
+    else
+      PAM_FILE="/etc/pam.d/sudo"
+      FIRST_LINE="# sudo: auth account password session"
+    fi
     if grep -q pam_tid.so "${PAM_FILE}"; then
       echo "ok"
     elif ! head -n1 "${PAM_FILE}" | grep -q "${FIRST_LINE}"; then
diff --git a/script/lib/resources/Brewfile.mac b/script/lib/resources/Brewfile.mac
index d9653edc..8531351a 100644
--- a/script/lib/resources/Brewfile.mac
+++ b/script/lib/resources/Brewfile.mac
@@ -67,3 +67,4 @@ mas "Keynote", id: 409183694
 mas "Magnet", id: 441258766
 mas "Numbers", id: 409203825
 mas "Pages", id: 409201541
+mas "Xcode", id: 497799835
diff --git a/script/lib/resources/Brewfile.personal b/script/lib/resources/Brewfile.personal
index 1bbb037e..6ee1bdc5 100644
--- a/script/lib/resources/Brewfile.personal
+++ b/script/lib/resources/Brewfile.personal
@@ -9,12 +9,13 @@ brew "twilio"
 
 cask "avidemux"
 cask "epic-games"
+cask "gnucash"
 cask "gog-galaxy"
 cask "google-chrome"
-cask "gnucash"
 cask "handbrake"
 cask "kid3"
 cask "kindle"
+cask "logitech-harmony-desktop"
 cask "netdownloadhelpercoapp"
 cask "raspberry-pi-imager"
 cask "sonos"
diff --git a/script/win-admin-setup.ps1 b/script/win-admin-setup.ps1
index e8a645ea..d5f294b8 100644
--- a/script/win-admin-setup.ps1
+++ b/script/win-admin-setup.ps1
@@ -12,6 +12,7 @@ choco install -y epicgameslauncher
 choco install -y firefox
 choco install -y geforce-experience
 choco install -y goggalaxy
+choco install -y myharmony
 choco install -y retroarch
 choco install -y slack
 choco install -y steam