diff --git a/bundles/zsh/files/bw.zsh-theme b/bundles/zsh/files/bw.zsh-theme
deleted file mode 100644
index 1cbe9c5..0000000
--- a/bundles/zsh/files/bw.zsh-theme
+++ /dev/null
@@ -1,51 +0,0 @@
-function zsh_spwd {
-  paths=(${(s:/:)PWD})
-
-  cur_path='/'
-  cur_short_path='/'
-  for directory in ${paths[@]}
-  do
-    cur_dir=''
-    for (( i=0; i<${#directory}; i++ )); do
-      cur_dir+="${directory:$i:1}"
-      matching=("$cur_path"/"$cur_dir"*/)
-      if [[ ${#matching[@]} -eq 1 ]]; then
-        break
-      fi
-    done
-    cur_short_path+="$cur_dir/"
-    cur_path+="$directory/"
-  done
-
-  printf %q "${cur_short_path: : -1}"
-  echo
-}
-
-function zsh_root_color {
-  if test "$EUID" -eq 0
-  then
-    echo "%{$fg_bold[green]%}"
-  else
-    echo "%{$fg_bold[yellow]%}"
-  fi
-}
-
-function zsh_exitcode_color {
-  echo "%(?:%{$fg_bold[green]%}:%{$fg_bold[red]%})"
-}
-
-function zsh_hostname {
-  if [ -z "$ZSH_HOSTNAME" ]
-  then
-    hostname -s
-  else
-    echo "$ZSH_HOSTNAME"
-  fi
-}
-
-PROMPT='$(zsh_root_color)$(whoami)%{$reset_color%}@$(zsh_exitcode_color)$(zsh_hostname) %{$fg[cyan]%}$(zsh_spwd)%{$reset_color%} $(git_prompt_info)'
-
-ZSH_THEME_GIT_PROMPT_PREFIX="%{$fg_bold[blue]%}git:(%{$fg[red]%}"
-ZSH_THEME_GIT_PROMPT_SUFFIX="%{$reset_color%} "
-ZSH_THEME_GIT_PROMPT_DIRTY="%{$fg[blue]%}) %{$fg[yellow]%}✗"
-ZSH_THEME_GIT_PROMPT_CLEAN="%{$fg[blue]%})"
diff --git a/bundles/zsh/files/zprofile b/bundles/zsh/files/zprofile
index aa9f911..901b9ab 100644
--- a/bundles/zsh/files/zprofile
+++ b/bundles/zsh/files/zprofile
@@ -1,22 +1,36 @@
-# /etc/zsh/zprofile: system-wide .zprofile file for zsh(1).
-#
-# This file is sourced only for login shells (i.e. shells
-# invoked with "-" as the first character of argv[0], and
-# shells invoked with the -l flag.)
-#
-# Global Order: zshenv, zprofile, zshrc, zlogin
+# /etc/zsh/zprofile — managed by ckn-bw bundles/zsh
+# Sourced for login shells only. SSH gives login shells; that's all we need.
 
+setopt prompt_subst
+autoload -Uz colors && colors
+autoload -Uz compinit && compinit
+
+zstyle ':completion:*' matcher-list 'm:{a-z}={A-Z}'
+
+# Mirrors the old bw.zsh-theme colors (sans git segment) plus a closing arrow:
+#   user  — bold, yellow normally, green as root
+#   host  — bold, green when last cmd succeeded, red otherwise
+#   path  — cyan (full path, ~ for $HOME)
+#   ❯     — bold, same green/red as host
+PROMPT='%B%(!.%F{green}.%F{yellow})%n%f%b@%B%(?.%F{green}.%F{red})%m%f%b %F{cyan}%~%f %(?.%F{green}.%F{red})%B❯%b%f '
+
+# Prefix-based history search on arrow keys
+autoload -Uz up-line-or-beginning-search down-line-or-beginning-search
+zle -N up-line-or-beginning-search
+zle -N down-line-or-beginning-search
+bindkey '^[[A' up-line-or-beginning-search
+bindkey '^[[B' down-line-or-beginning-search
+bindkey '^[OA' up-line-or-beginning-search
+bindkey '^[OB' down-line-or-beginning-search
+
+# Autosuggestions (apt-installed; guarded for minimal images)
+[[ -r /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh ]] \
+  && source /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh
+
+# Server-only conveniences, carried over from the old zprofile
 alias s='sudo su - root -s /usr/bin/zsh'
-
-function hhtop {
-    mkdir -p ~/.config/htop
-    cp /etc/htoprc.global ~/.config/htop/htoprc
-    htop
+hhtop() {
+  mkdir -p ~/.config/htop
+  cp /etc/htoprc.global ~/.config/htop/htoprc
+  htop
 }
-
-ZSH_THEME=bw
-DISABLE_AUTO_UPDATE=true
-plugins=(
-  zsh-autosuggestions
-)
-source /etc/zsh/oh-my-zsh/oh-my-zsh.sh
diff --git a/bundles/zsh/items.py b/bundles/zsh/items.py
index 28848c5..55b24c1 100644
--- a/bundles/zsh/items.py
+++ b/bundles/zsh/items.py
@@ -1,61 +1,19 @@
 from os.path import join
 
-directories = {
-    '/etc/zsh/oh-my-zsh': {},
-    '/etc/zsh/oh-my-zsh/custom/plugins': {
-        'mode': '0755',
-        'needs': [
-            f"git_deploy:/etc/zsh/oh-my-zsh",
-        ]
-    },
-    '/etc/zsh/oh-my-zsh/custom/plugins/zsh-autosuggestions': {
-        'mode': '0755',
-        'needs': [
-            f"git_deploy:/etc/zsh/oh-my-zsh",
-        ]
-    },
-}
-
-git_deploy = {
-    '/etc/zsh/oh-my-zsh': {
-        'repo': 'https://github.com/ohmyzsh/ohmyzsh.git',
-        'rev': 'master',
-    },
-    '/etc/zsh/oh-my-zsh/custom/plugins/zsh-autosuggestions': {
-        'repo': 'https://github.com/zsh-users/zsh-autosuggestions.git',
-        'rev': 'master',
-    },
-}
-
 files = {
     '/etc/zsh/zprofile': {
-        'mode': '0755',
-    },
-    '/etc/zsh/oh-my-zsh/themes/bw.zsh-theme': {
-        'mode': '0755',
-        'needs': [
-            f"git_deploy:/etc/zsh/oh-my-zsh",
-        ]
-    },
-}
-
-actions = {
-    'chown_oh_my_zsh': {
-        'command': 'chmod -R 755 /etc/zsh/oh-my-zsh',
-        'triggered': True,
-        'triggered_by': [
-            "git_deploy:/etc/zsh/oh-my-zsh",
-            "git_deploy:/etc/zsh/oh-my-zsh/custom/plugins/zsh-autosuggestions",
-            "file:/etc/zsh/zprofile",
-            "file:/etc/zsh/oh-my-zsh/themes/bw.zsh-theme",
-        ],
+        'mode': '0644',
     },
 }
 
+# Empty stub in each zsh user's home. zsh-newuser-install fires on login
+# when none of ~/.{zshrc,zshenv,zprofile,zlogin} exists, and the real
+# config lives in /etc/zsh/zprofile — so we keep a one-line marker file
+# here to suppress the new-user wizard.
 for name, user_config in node.metadata.get('users').items():
     if user_config.get('shell', None) == '/usr/bin/zsh':
         files[join(user_config['home'], '.zshrc')] = {
             'owner': name,
             'group': name,
-            'content': '# bw managed',
+            'content': '# bw managed; real config in /etc/zsh/zprofile\n',
         }
diff --git a/bundles/zsh/metadata.py b/bundles/zsh/metadata.py
index 7aa3349..f0c5255 100644
--- a/bundles/zsh/metadata.py
+++ b/bundles/zsh/metadata.py
@@ -2,6 +2,7 @@ defaults = {
     'apt': {
         'packages': {
             'zsh': {},
+            'zsh-autosuggestions': {},
         }
     }
 }