diff --git a/scripts/setup/machine-setup/lib/packages.sh b/scripts/setup/machine-setup/lib/packages.sh
index f6b65e0d..e15c69e8 100644
--- a/scripts/setup/machine-setup/lib/packages.sh
+++ b/scripts/setup/machine-setup/lib/packages.sh
@@ -96,23 +96,23 @@ pkgs_core() {
       # separate decision from removing the tool that wanted it.
       echo curl ca-certificates gnupg git jq unzip \
         apt-transport-https lsb-release software-properties-common \
-        wget zip build-essential python3 btop htop tree tmux ripgrep fd-find net-tools \
+        wget zip build-essential python3 btop htop tree tmux ripgrep fd-find net-tools eza \
         fail2ban unattended-upgrades
       ;;
     pacman)
       echo curl ca-certificates gnupg git jq unzip \
-        wget zip base-devel python btop htop tree tmux ripgrep fd net-tools \
+        wget zip base-devel python btop htop tree tmux ripgrep fd net-tools eza \
         fail2ban
       ;;
     dnf)
       echo curl ca-certificates gnupg2 git jq unzip \
-        wget zip python3 btop htop tree tmux ripgrep fd-find net-tools \
+        wget zip python3 btop htop tree tmux ripgrep fd-find net-tools eza \
         fail2ban
       ;;
     brew)
       # curl, unzip and the TLS roots ship with macOS; the compilers come from
       # the Xcode command line tools, which is not a formula — see xcode_clt_*.
-      echo gnupg git jq wget btop htop tree ripgrep fd
+      echo gnupg git jq wget btop htop tree ripgrep fd eza
       ;;
   esac
 }
diff --git a/scripts/setup/machine-setup/machine-setup.sh b/scripts/setup/machine-setup/machine-setup.sh
index b91b39ab..5f1dcfcf 100755
--- a/scripts/setup/machine-setup/machine-setup.sh
+++ b/scripts/setup/machine-setup/machine-setup.sh
@@ -2309,8 +2309,41 @@ EOF
       ok "~/.local/bin and ~/.opencode/bin added to PATH"
     fi
 
+    # The eza aliases are GUARDED and the rest are not, for one reason: these
+    # replace `ls`. An unguarded `alias ls='eza --icons'` on a machine where eza
+    # failed to install leaves the owner with no working `ls` at all, in every new
+    # shell, which reads as a broken machine rather than a missing package. The
+    # others degrade honestly — `alias ld=lazydocker` without lazydocker is one
+    # command-not-found when you type it, not a core utility gone.
+    #
+    # Same principle shell-skel/zshrc already holds to: every optional tool is used
+    # only if present, so one file works on a minimal VPS and a full workstation.
     if append_once "$ZSHRC" aliases <<'EOF'
+if command -v eza >/dev/null 2>&1; then
+  alias ls='eza --icons'
+  alias la='eza --icons -la'
+  alias ll='eza --icons -l'
+  alias lll='eza --icons -lA'
+  alias lh='eza --icons -lhA'
+  alias ltr='eza --icons -ltr'
+  alias l='eza --icons -la'
+fi
+
+alias grep='grep --color=auto'
+alias less='less -R'
+alias diff='diff --color=auto'
+alias cp='cp -iv'
+alias mv='mv -iv'
+alias rm='rm -i'
+alias mkdir='mkdir -p'
+alias which='which -a'
+alias history='fc -l 1'
+
+alias n="nvim"
+alias vim="n"
 alias sz="source ~/.zshrc"
+alias ld="lazydocker"
+alias httpserver="python3 -m http.server 8888"
 EOF
     then
       ok "shell aliases added"