diff --git a/.bunfig.toml b/.bunfig.toml
new file mode 100644
index 0000000..cc1bb0d
--- /dev/null
+++ b/.bunfig.toml
@@ -0,0 +1,16 @@
+# Bun global configuration — https://bun.com/docs/runtime/bunfig
+#
+# Lives at the repo root because bun's global config path is
+# $XDG_CONFIG_HOME/.bunfig.toml and $XDG_CONFIG_HOME points at this repo.
+# assimilate.sh also symlinks it to ~/.bunfig.toml for contexts where
+# XDG_CONFIG_HOME isn't exported (bun ignores ~/.bunfig.toml whenever
+# XDG_CONFIG_HOME is set — verified against bun 1.3.12).
+# A project-local bunfig.toml is merged on top, so repos can still override.
+
+[install]
+# Supply-chain hardening: never resolve a package version younger than 7 days
+# (value is in seconds). Same rolling window as uv's exclude-newer — most
+# malicious/compromised uploads are detected and yanked within a week, so
+# resolution just falls back to the newest version that clears the window.
+# Requires bun >= 1.2.22 (older bun ignores unknown bunfig keys).
+minimumReleaseAge = 604800
diff --git a/assimilate.sh b/assimilate.sh
index cedc37b..d9df406 100755
--- a/assimilate.sh
+++ b/assimilate.sh
@@ -68,6 +68,9 @@ sym agent-instructions.md           .claude/CLAUDE.md
 sym agent-instructions.md           .codex/AGENTS.md
 sym ssh/config                      .ssh/config
 sym uv/uv.toml                      .config/uv/uv.toml
+# bun reads $XDG_CONFIG_HOME/.bunfig.toml (the repo root) in shells; the
+# symlink covers contexts where XDG_CONFIG_HOME isn't exported.
+sym .bunfig.toml                    .bunfig.toml
 
 # Lock down sensitive symlink targets (chmod follows the symlink to the repo file).
 chmod 600 "$HOME/.gitconfig"
@@ -87,6 +90,12 @@ else
   fi
 fi
 
+# npm: refuse package versions younger than 7 days. Append-only because
+# ~/.npmrc may also contain authentication written by `npm login`.
+if ! grep -q '^min-release-age=' "$HOME/.npmrc" 2>/dev/null; then
+  echo 'min-release-age=7' >> "$HOME/.npmrc"
+fi
+
 # macOS-only symlinks and Homebrew (apps/paths don't exist on Linux)
 if [ "$OS" = "Darwin" ]; then
   sym hammerspoon                 .hammerspoon
@@ -257,4 +266,18 @@ if command -v nvim >/dev/null; then
   nvim --headless "+Lazy! restore" +qa || true
 fi
 
+# Configure Claude Code defaults. Appends each key only when it is absent, so
+# existing machine-local settings are never overridden.
+CLAUDE_SETTINGS="$HOME/.claude/settings.json"
+mkdir -p "$HOME/.claude"
+if [ ! -f "$CLAUDE_SETTINGS" ]; then
+  printf '{\n  "attribution": { "commit": "", "pr": "" },\n  "statusLine": { "type": "command", "command": "~/.claude/statusline.sh", "padding": 0 }\n}\n' > "$CLAUDE_SETTINGS"
+elif ! jq -e 'has("attribution") and has("statusLine")' "$CLAUDE_SETTINGS" >/dev/null 2>&1; then
+  tmp=$(mktemp)
+  jq '
+    if has("attribution") then . else . + {attribution: {commit: "", pr: ""}} end
+    | if has("statusLine") then . else . + {statusLine: {type: "command", command: "~/.claude/statusline.sh", padding: 0}} end
+  ' "$CLAUDE_SETTINGS" > "$tmp" && mv "$tmp" "$CLAUDE_SETTINGS"
+fi
+
 echo "> Assimilation successful!"