diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index a9bfb8e..79a4ba0 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -38,3 +38,12 @@ jobs:
         run: GO111MODULE=on go install mvdan.cc/sh/v3/cmd/shfmt@latest
       - name: Check formatting
         run: shfmt -f . | grep -v meta/dotbot | xargs shfmt -s -d
+  correct-sha256:
+    name: SHA256 in README is correct
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run Update SHA script
+        run: bin/update-bootstrap-sha
+      - name: Check that there is no diff
+        run: git diff --exit-code
diff --git a/README.md b/README.md
index d7e7e03..a27cab1 100644
--- a/README.md
+++ b/README.md
@@ -36,8 +36,15 @@ $ cd ~/repos/dotfiles
 ./install-profile mac
 ```
 
-## Testing
+## Developing and Testing
 
+If you update the `bootstrap/bootstrap.sh` file, you must also run
+
+```bash
+bin/update-bootstrap-sha
+```
+
+To run all lints and tests:
 ```bash
-$ ./test.sh
+bin/test
 ```
diff --git a/test.sh b/bin/test
similarity index 100%
rename from test.sh
rename to bin/test
diff --git a/bin/update-bootstrap-sha b/bin/update-bootstrap-sha
new file mode 100755
index 0000000..7c254bf
--- /dev/null
+++ b/bin/update-bootstrap-sha
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &> /dev/null && pwd)
+BOOTSTRAP_SHA=$(sha256sum "${SCRIPT_DIR}/../bootstrap/bootstrap.sh" | awk '{ print $1 }')
+# shellcheck disable=SC2016
+sed -i -e 's/\(sha256 checksum: `\)\(.*\)\(`\)/\1'"${BOOTSTRAP_SHA}"'\3/g' "${SCRIPT_DIR}/../README.md"
diff --git a/homebrew/Brewfile.base b/homebrew/Brewfile.base
index eba5121..6523356 100644
--- a/homebrew/Brewfile.base
+++ b/homebrew/Brewfile.base
@@ -17,8 +17,11 @@ brew "zlib"
 # Yubikey/GPG
 brew "gnupg"
 brew "hopenpgp-tools"
+brew "libfido2"
+brew "openssh"
 brew "pinentry-mac"
 brew "ykman"
+brew "ykpers"
 cask "yubico-authenticator"
 cask "yubico-yubikey-manager"
 
@@ -28,6 +31,7 @@ brew "coreutils"
 brew "diff-so-fancy"
 brew "direnv"
 brew "git"
+brew "gnu-sed"
 brew "hashicorp/tap/terraform"
 brew "helm"
 brew "htop"
diff --git a/shells/zsh/zshrc b/shells/zsh/zshrc
index 98a34e1..2d311b9 100644
--- a/shells/zsh/zshrc
+++ b/shells/zsh/zshrc
@@ -80,7 +80,7 @@ export SSH_KEY_PATH="${HOME}/.ssh/rsa_id"
 export GOPATH="${HOME}/.go"
 GOROOT="$(brew --prefix golang)/libexec"
 export GOROOT
-export PATH="/opt/homebrew/bin:$HOME/bin:/usr/local/sbin:${GOPATH}/bin:${GOROOT}/bin:$HOME/.cargo/bin:$PATH"
+export PATH="/opt/homebrew/bin:$HOME/bin:/usr/local/sbin:${GOPATH}/bin:${GOROOT}/bin:$HOME/.cargo/bin:/opt/homebrew/opt/gnu-sed/libexec/gnubin:$PATH"
 
 activate_gpg
 activate_powerline