diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..d06edf35
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "monthly"
+    labels:
+      - "enhancement"
diff --git a/.github/workflows/macos.yaml b/.github/workflows/macos.yaml
index 459539f0..74b4d4e5 100644
--- a/.github/workflows/macos.yaml
+++ b/.github/workflows/macos.yaml
@@ -52,9 +52,6 @@ jobs:
         run: |
           git config --global commit.gpgsign false
 
-      - name: Checkout
-        uses: actions/checkout@v2
-
       - name: Run benchmark
         run: |
           brew install gnu-time
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 6372c86f..d129a261 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -22,7 +22,7 @@ jobs:
         SYSTEM: ${{ matrix.system }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v1
+        uses: actions/checkout@v4
       
       - name: Install tools
         run: |
@@ -53,7 +53,7 @@ jobs:
           fi
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           # directory: ./coverage/kcov-merged
diff --git a/home/.chezmoiscripts/macos/run_once_after-decrypt-private-key.sh.tmpl b/home/.chezmoiscripts/macos/run_once_after_decrypt-private-key.sh.tmpl
similarity index 100%
rename from home/.chezmoiscripts/macos/run_once_after-decrypt-private-key.sh.tmpl
rename to home/.chezmoiscripts/macos/run_once_after_decrypt-private-key.sh.tmpl
diff --git a/home/.chezmoiscripts/macos/run_once_00-install-brew.sh.tmpl b/home/.chezmoiscripts/macos/run_once_before_03-install-brew.sh.tmpl
similarity index 100%
rename from home/.chezmoiscripts/macos/run_once_00-install-brew.sh.tmpl
rename to home/.chezmoiscripts/macos/run_once_before_03-install-brew.sh.tmpl
diff --git a/home/.chezmoiscripts/macos/run_once_before_04-decrypt-private-key.sh.tmpl b/home/.chezmoiscripts/macos/run_once_before_04-decrypt-private-key.sh.tmpl
new file mode 100644
index 00000000..0f888393
--- /dev/null
+++ b/home/.chezmoiscripts/macos/run_once_before_04-decrypt-private-key.sh.tmpl
@@ -0,0 +1,4 @@
+{{ if eq .chezmoi.os "darwin" -}}
+{{   include "../install/macos/common/age.sh" }}
+{{   include "../install/common/age.sh" }}
+{{ end -}}
diff --git a/home/.chezmoiscripts/ubuntu/run_once_after-decrypt-private-key.sh.tmpl b/home/.chezmoiscripts/ubuntu/run_once_after_decrypt-private-key.sh.tmpl
similarity index 100%
rename from home/.chezmoiscripts/ubuntu/run_once_after-decrypt-private-key.sh.tmpl
rename to home/.chezmoiscripts/ubuntu/run_once_after_decrypt-private-key.sh.tmpl
diff --git a/home/dot_config/sheldon/plugins.toml b/home/dot_config/sheldon/plugins.toml
index f6157158..d535e6b9 100644
--- a/home/dot_config/sheldon/plugins.toml
+++ b/home/dot_config/sheldon/plugins.toml
@@ -69,3 +69,8 @@ apply = ['source']
 local = '~/.local/bin/common'
 use = ['gpg.sh']
 apply = ['source']
+
+[plugins.history]
+local = '~/.local/bin/server'
+user = ['history.zsh']
+apply = ['source']
diff --git a/home/dot_local/bin/server/history.zsh b/home/dot_local/bin/server/history.zsh
new file mode 100644
index 00000000..e3b9b83a
--- /dev/null
+++ b/home/dot_local/bin/server/history.zsh
@@ -0,0 +1,7 @@
+#!/usr/bin/env zsh
+
+setopt inc_append_history
+
+export HISTFILE=${HISTFILE:-$HOME}/.zsh_history
+export HISTSIZE=10000
+export SAVEHIST=10000
diff --git a/install/common/age.sh b/install/common/age.sh
index 31bbdf38..0dec66ef 100644
--- a/install/common/age.sh
+++ b/install/common/age.sh
@@ -39,6 +39,8 @@ function decrypt_age_private_key() {
 
         if [ ! -f "${age_dst_key}" ]; then
             mkdir -p "${age_dir}"
+
+            echo "Decrypting ${age_src_key} to ${age_dst_key}"
             age --decrypt --output "${age_dst_key}" "${age_src_key}"
             chmod 600 "${age_dst_key}"
         fi
diff --git a/install/macos/common/docker.sh b/install/macos/common/docker.sh
index a64ad7d5..91c1adcd 100644
--- a/install/macos/common/docker.sh
+++ b/install/macos/common/docker.sh
@@ -6,16 +6,16 @@ if [ "${DOTFILES_DEBUG:-}" ]; then
     set -x
 fi
 
-function install_docker_docker_compose() {
+function install_docker() {
     brew install --cask docker
 }
 
-function uninstall_docker_docker_compose() {
-    brew uninstall docker
+function uninstall_docker() {
+    brew uninstall --cask docker --force
 }
 
 function main() {
-    install_docker_docker_compose
+    install_docker
 }
 
 if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
diff --git a/install/ubuntu/server/sheldon.sh b/install/ubuntu/server/sheldon.sh
index fd2c0b9d..7df5d12c 100644
--- a/install/ubuntu/server/sheldon.sh
+++ b/install/ubuntu/server/sheldon.sh
@@ -11,8 +11,12 @@ readonly BIN_DIR="${HOME}/.local/bin/server"
 function install_sheldon() {
     mkdir -p "${BIN_DIR}"
 
+    if [[ -n "${DOTFILES_GITHUB_PAT}" ]]; then
+        export GITHUB_TOKEN=${DOTFILES_GITHUB_PAT}
+    fi
+
     curl --proto '=https' -fLsS https://rossmacarthur.github.io/install/crate.sh |
-        bash -s -- --repo rossmacarthur/sheldon --to "${BIN_DIR}"
+        bash -s -- --repo rossmacarthur/sheldon --to "${BIN_DIR}" --force
 }
 
 function uninstall_sheldon() {
diff --git a/tests/install/macos/common/docker.bats b/tests/install/macos/common/docker.bats
index 607b5433..c8340bae 100644
--- a/tests/install/macos/common/docker.bats
+++ b/tests/install/macos/common/docker.bats
@@ -7,7 +7,7 @@ function setup() {
 }
 
 function teardown() {
-    run uninstall_docker_docker_compose
+    run uninstall_docker
 }
 
 @test "[macos] docker" {