diff --git a/README.md b/README.md
index 248f305..f93f06f 100644
--- a/README.md
+++ b/README.md
@@ -1,15 +1,23 @@
 # Mac setup
 
-Run `./setup.sh`
+Run the following to download the latest release of this repo and then run the setup script:
 
-## Manual steps:
+```bash
+setup_repo="$(mktemp -d)"
+zipball_url="$(curl -s https://api.github.com/repos/will-gant/mac-setup/releases/latest | grep zipball_url | cut -d '"' -f 4)"
+zip_file="${setup_repo}/repo.zip"
+curl --location "$zipball_url" --output "${setup_repo}/repo.zip"
+unzip "$zip_file" -d "$setup_repo"
+bash "$setup_repo/*mac-setup*/setup.sh
+```
 
-These should be run _after_ running the setup script.
+## Manual steps:
 
+These should be run _after_ the setup script completes.
 ### Git
 
 1. Retrieve SSH private key from password manager
-1. Copy into ~/.ssh/id_rsa
+1. Copy it into ~/.ssh/id_rsa
 1. Run `eval "$(ssh-agent -s)"`
 1. Run `ssh-add --apple-use-keychain ~/.ssh/id_rsa`
 
@@ -20,3 +28,29 @@ Import `iterm2.json` as a profile via the iterm GUI
 ### VScode
 
 Switch on 'sync' and login with GitHub
+
+### System settings
+
+NB. These take effect after a restart
+
+```bash
+# keyboard
+sudo defaults write /Library/Preferences/com.apple.HIToolbox AppleCurrentKeyboardLayoutInputSourceID "com.apple.keylayout.British"
+sudo defaults write /Library/Preferences/com.apple.HIToolbox AppleDefaultAsciiInputSource -dict InputSourceKind "Keyboard Layout" "KeyboardLayout ID" -int 2 "KeyboardLayout Name" British
+sudo defaults delete /Library/Preferences/com.apple.HIToolbox AppleEnabledInputSources
+
+# updates
+sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdate -bool true
+sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate ConfigDataInstall -bool true
+sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -bool true
+sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool true
+sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool true
+sudo defaults delete /Library/Preferences/com.apple.HIToolbox AppleEnabledInputSources
+sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdateRestartRequired -bool true
+
+# enable firewall
+sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 2
+
+# enable FileVault encryption (interactive)
+sudo fdesetup enable
+```
\ No newline at end of file
diff --git a/setup.sh b/setup.sh
index 29f9840..4cb99a9 100755
--- a/setup.sh
+++ b/setup.sh
@@ -1,10 +1,24 @@
 #!/usr/bin/env bash
 
-set -e
+set -eo pipefail
 
 script_dir="$( cd -- "$( dirname -- "${BASH_SOURCE[0]:-$0}"; )" &> /dev/null && pwd 2> /dev/null; )";
 
+# commandline developer tools
+touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress;
+xcode_version="$(softwareupdate --list | grep -E --only-matching "Command Line Tools for Xcode-[0-9]+\.[0-9]+" | tail -n 1)"
+softwareupdate --install "$xcode_version" --verbose
+rm /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
+
+# brew
+mkdir "${script_dir}/homebrew" && curl -L https://github.com/Homebrew/brew/tarball/master | tar xz --strip 1 -C "${script_dir}/homebrew"
+eval "$(homebrew/bin/brew shellenv | tee "${HOME}/.zshrc")"
+brew update --force --quiet
+chmod -R go-w "$(brew --prefix)/share/zsh"
+
 brew bundle --file="${script_dir}/Brewfile"
+mkdir -p "${HOME}/Library/LaunchAgents"
+brew autoupdate start 43200
 
 # git
 cp "${script_dir}/gitconfig" "${HOME}/.gitconfig"
@@ -34,9 +48,11 @@ mkdir -p "${ssh_dir}"
 touch "${ssh_dir}/id_rsa"
 chmod 400 "${ssh_dir}/id_rsa"
 
-cat <<EOF > ${HOME}/.ssh/config
+cat <<EOF > "${HOME}/.ssh/config"
 Host *
   AddKeysToAgent yes
   UseKeychain yes
   IdentityFile ~/.ssh/id_rsa
-EOF
\ No newline at end of file
+EOF
+
+mkdir -p "${HOME}/Workspace"
\ No newline at end of file