5 files changed, 23 insertions, 29 deletions
diff --git a/.chezmoiignore b/.chezmoiignore
index d87d077..82bbeb2 100644
--- a/.chezmoiignore
+++ b/.chezmoiignore
@@ -6,5 +6,4 @@ create-efi.sh
 .worktrees/
 meta/
 etc/
-etc2/
 firefox/
diff --git a/etc2/xdg/reflector/reflector.conf b/etc/xdg/reflector/reflector.conf
index a5dd94d..a5dd94d 100644
--- a/etc2/xdg/reflector/reflector.conf
+++ b/etc/xdg/reflector/reflector.conf
diff --git a/run_onchange_after_deploy-etc.sh b/run_onchange_after_deploy-etc.sh
deleted file mode 100755
index e016fa1..0000000
--- a/run_onchange_after_deploy-etc.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/bin/sh
-# Deploy system-level configs from etc/ and etc2/ to /etc/
-# etc/ files can be symlinked; etc2/ files must be copied (tools that refuse symlinks)
-set -eu
-
-# CHEZMOI_SOURCE_DIR is set by chezmoi when executing run scripts
-
-# etc/ — symlink-friendly configs
-for f in \
-    modules-load.d/tcp_bbr.conf \
-    pacman.d/hooks/orphans.hook \
-    sysctl.d/99-sysctl.conf \
-    systemd/system.conf.d/timeout.conf
-do
-    doas mkdir -p "/etc/$(dirname "$f")"
-    doas cp --remove-destination "$CHEZMOI_SOURCE_DIR/etc/$f" "/etc/$f"
-done
-
-# etc2/ — must be real files (e.g. reflector refuses symlinks)
-for f in \
-    xdg/reflector/reflector.conf
-do
-    doas mkdir -p "/etc/$(dirname "$f")"
-    doas cp --remove-destination "$CHEZMOI_SOURCE_DIR/etc2/$f" "/etc/$f"
-done
diff --git a/run_onchange_after_deploy-etc.sh.tmpl b/run_onchange_after_deploy-etc.sh.tmpl
new file mode 100755
index 0000000..921d956
--- /dev/null
+++ b/run_onchange_after_deploy-etc.sh.tmpl
@@ -0,0 +1,20 @@
+#!/bin/sh
+# Deploy system-level configs from etc/ to /etc/
+# chezmoi re-runs this script when any hash below changes.
+# {{ include "etc/modules-load.d/tcp_bbr.conf" | sha256sum }}
+# {{ include "etc/pacman.d/hooks/orphans.hook" | sha256sum }}
+# {{ include "etc/sysctl.d/99-sysctl.conf" | sha256sum }}
+# {{ include "etc/systemd/system.conf.d/timeout.conf" | sha256sum }}
+# {{ include "etc/xdg/reflector/reflector.conf" | sha256sum }}
+set -eu
+
+for f in \
+    modules-load.d/tcp_bbr.conf \
+    pacman.d/hooks/orphans.hook \
+    sysctl.d/99-sysctl.conf \
+    systemd/system.conf.d/timeout.conf \
+    xdg/reflector/reflector.conf
+do
+    doas mkdir -p "/etc/$(dirname "$f")"
+    doas cp --remove-destination "$CHEZMOI_SOURCE_DIR/etc/$f" "/etc/$f"
+done
diff --git a/run_onchange_after_deploy-firefox.sh b/run_onchange_after_deploy-firefox.sh.tmpl
index affea64..b8bf309 100755
--- a/run_onchange_after_deploy-firefox.sh
+++ b/run_onchange_after_deploy-firefox.sh.tmpl
@@ -1,10 +1,10 @@
 #!/bin/sh
 # Deploy Firefox/LibreWolf hardening overrides and custom CSS
+# chezmoi re-runs this script when any hash below changes.
+# {{ include "firefox/user-overrides.js" | sha256sum }}
+# {{ include "firefox/chrome/userChrome.css" | sha256sum }}
 set -eu
 
-# CHEZMOI_SOURCE_DIR is set by chezmoi when executing run scripts
-
-# Find LibreWolf profile directory (first profile with a default=1 marker)
 PROFILES_DIR="$HOME/.librewolf"
 if [ -d "$PROFILES_DIR" ]; then
     PROFILE=$(find "$PROFILES_DIR" -maxdepth 1 -mindepth 1 -type d -name '*.default-default' | head -1)