diff --git a/overlays/nono.nix b/overlays/nono.nix
index 5348195..68c7273 100644
--- a/overlays/nono.nix
+++ b/overlays/nono.nix
@@ -1,18 +1,19 @@
 {inputs}: final: prev: let
 	manifest = (prev.lib.importTOML "${inputs.nono}/Cargo.toml").package;
 in {
-	nono = prev.rustPlatform.buildRustPackage {
-		pname = manifest.name;
-		version = manifest.version;
+	nono =
+		prev.rustPlatform.buildRustPackage {
+			pname = manifest.name;
+			version = manifest.version;
 
-		cargoLock.lockFile = "${inputs.nono}/Cargo.lock";
+			cargoLock.lockFile = "${inputs.nono}/Cargo.lock";
 
-		src = inputs.nono;
+			src = inputs.nono;
 
-		nativeBuildInputs = with prev; [pkg-config];
-		buildInputs = with prev; [openssl dbus];
-		OPENSSL_NO_VENDOR = 1;
+			nativeBuildInputs = with prev; [pkg-config];
+			buildInputs = with prev; [openssl dbus];
+			OPENSSL_NO_VENDOR = 1;
 
-		doCheck = false;
-	};
+			doCheck = false;
+		};
 }
diff --git a/profiles/nono.nix b/profiles/nono.nix
index c8ccac3..f786d02 100644
--- a/profiles/nono.nix
+++ b/profiles/nono.nix
@@ -2,4 +2,18 @@
 	home.packages = with pkgs; [
 		nono
 	];
+
+	xdg.configFile."nono/profiles/opencode.toml".text = ''
+		[meta]
+		name = "opencode"
+		version = "1.0.0"
+		description = "OpenCode AI agent"
+
+		[filesystem]
+		allow = ["$WORKDIR"]
+		read = ["$XDG_CONFIG_HOME/opencode"]
+
+		[network]
+		block = false
+	'';
 }