diff --git a/bin/nextcloud-sync b/bin/nextcloud-sync
new file mode 100755
index 0000000..a8bc096
--- /dev/null
+++ b/bin/nextcloud-sync
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -e
+set -u
+set -o pipefail
+
+if [[ "${1:-}" == "-h" ]] || [[ "${1:-}" == "--help" ]]; then
+    cat <<EOF
+Usage: nextcloud-sync [--resync]
+
+Sync Nextcloud to ~/nextcloud using rclone bisync, excluding the transmission folder.
+
+Options:
+  --resync    Force resync (required for first run or after errors)
+
+Examples:
+  nextcloud-sync           - Normal bidirectional sync
+  nextcloud-sync --resync  - Force resync from scratch
+EOF
+    exit 0
+fi
+
+RESYNC_FLAG=""
+if [[ "${1:-}" == "--resync" ]]; then
+    RESYNC_FLAG="--resync"
+fi
+
+mkdir -p ~/nextcloud
+
+rclone bisync nextcloud: ~/nextcloud --exclude "transmission/**" $RESYNC_FLAG
diff --git a/mac/packages b/mac/packages
index 54e3417..71ca72c 100644
--- a/mac/packages
+++ b/mac/packages
@@ -75,6 +75,7 @@ torsocks
 tree
 typescript-language-server
 uv
+watch
 xq
 yamllint
 yt-dlp
diff --git a/rclone/setup.sh b/rclone/setup.sh
new file mode 100755
index 0000000..28abd3b
--- /dev/null
+++ b/rclone/setup.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+
+# Populate rclone config from KeePassXC database
+"$DOTFILES_HOME/bin/update-secrets" rclone