diff --git a/.gitignore b/.gitignore
index 43c15ce..3c4d89a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,5 @@ result
 .direnv
 .cache-home
 .bw-session
+config/karabiner/assets/
+config/karabiner/automatic_backups/
diff --git a/home/karabiner.nix b/home/karabiner.nix
index ac4f3c3..118f4ed 100644
--- a/home/karabiner.nix
+++ b/home/karabiner.nix
@@ -3,13 +3,22 @@
   lib,
   ...
 }: {
-  # Karabiner-Elements destroys symlinks (unlink + rewrite), so we cannot use
-  # xdg.configFile.  Instead, copy the file on every activation so Karabiner
-  # sees a real mutable file whose contents match our nix-managed source.
+  # Karabiner-Elements destroys file-level symlinks (unlink + rewrite), but
+  # directory-level symlinks survive.  Point ~/.config/karabiner at the repo
+  # directory so changes are tracked in git and Karabiner can write freely.
   home.activation.karabinerConfig = lib.hm.dag.entryAfter ["writeBoundary"] ''
-    karabiner_dir="${config.home.homeDirectory}/.config/karabiner"
-    mkdir -p "$karabiner_dir"
-    cp -f "${../config/karabiner/karabiner.json}" "$karabiner_dir/karabiner.json"
-    chmod 600 "$karabiner_dir/karabiner.json"
+    karabiner_link="${config.home.homeDirectory}/.config/karabiner"
+    karabiner_src="/Users/rathi/Documents/GitHub/nix/config/karabiner"
+
+    if [ -L "$karabiner_link" ]; then
+      # Already a symlink - nothing to do
+      :
+    elif [ -d "$karabiner_link" ]; then
+      # Real directory exists - remove it, replace with symlink
+      rm -rf "$karabiner_link"
+      ln -s "$karabiner_src" "$karabiner_link"
+    else
+      ln -s "$karabiner_src" "$karabiner_link"
+    fi
   '';
 }
diff --git a/scripts/restore-bw-files.sh b/scripts/restore-bw-files.sh
index 5dc557d..ff72126 100755
--- a/scripts/restore-bw-files.sh
+++ b/scripts/restore-bw-files.sh
@@ -160,3 +160,9 @@ restore_aws_credentials
 restore_gcloud_adc
 restore_plain_note 'Machine: Codex Auth' "${HOME}/.codex/auth.json" 600
 restore_plain_note 'Machine: Vercel Auth' "${HOME}/Library/Application Support/com.vercel.cli/auth.json" 600
+
+# GitHub CLI auth
+if command -v gh >/dev/null 2>&1; then
+  read_note 'Machine: GitHub Token' | gh auth login --with-token
+  printf 'restored gh auth\n'
+fi