diff --git a/bundles/macbook/files/freshclam.conf b/bundles/macbook/files/freshclam.conf
new file mode 100644
index 0000000..3d9ca5f
--- /dev/null
+++ b/bundles/macbook/files/freshclam.conf
@@ -0,0 +1 @@
+DatabaseMirror database.clamav.net
diff --git a/bundles/macbook/items.py b/bundles/macbook/items.py
index 6103551..f7ee9ea 100644
--- a/bundles/macbook/items.py
+++ b/bundles/macbook/items.py
@@ -1,3 +1,12 @@
+# brew install
+
+actions['brew_install'] = {
+    'command': '/opt/homebrew/bin/brew install ' + ' '.join(node.metadata.get('brew')),
+    'unless': f"""PKGS=$(/opt/homebrew/bin/brew leaves); for p in {' '.join(node.metadata.get('brew'))}; do grep -q "$p" <<< $PKGS || exit 9; done"""
+}
+
+# bw init
+
 directories['/Users/mwiegand/.config/bundlewrap/lock'] = {}
 
 # home
@@ -21,6 +30,16 @@ files['/Users/mwiegand/.local/share/direnv/pyenv'] = {}
 files['/Users/mwiegand/.local/share/direnv/venv'] = {}
 files['/Users/mwiegand/.local/share/direnv/bundlewrap'] = {}
 
+
+# clamav
+
+files['/opt/homebrew/etc/clamav/freshclam.conf'] = {
+    'group': 'admin',
+}
+# run me baby one more time:
+# freshclam && clamscan --infected --recursive --exclude-dir ~/Library/Mail ~
+
+
 ##################
 
 for element in [*files.values(), *directories.values()]:
diff --git a/bundles/macbook/metadata.py b/bundles/macbook/metadata.py
index ca3af1f..1e6681b 100644
--- a/bundles/macbook/metadata.py
+++ b/bundles/macbook/metadata.py
@@ -1 +1,5 @@
-defaults = {}
+defaults = {
+    'brew': {
+        'clamav',
+    },
+}