diff --git a/debian/README.md b/debian/README.md
index c2baf0e..eb4d74b 100644
--- a/debian/README.md
+++ b/debian/README.md
@@ -28,7 +28,8 @@ ansible-playbook ~/dotfiles/debian/ansible/update.yml --ask-become-pass
 
 ## What setup.yml does
 
-- apt packages: thunderbird, zsh, git, curl, gnupg, jq, xdg-utils
+- apt packages: thunderbird, zsh, git, curl, gnupg, jq, wl-clipboard,
+  xdg-utils
 - apt repos + install: Helium (`helium-bin`), 1Password (+ `op` CLI),
   Tailscale, Signal (amd64 only — no arm64 build)
 - ghostty and obsidian: latest GitHub-release .debs
@@ -38,8 +39,10 @@ ansible-playbook ~/dotfiles/debian/ansible/update.yml --ask-become-pass
   force-install policy
 - clones dotfiles to `~/dotfiles` and runs `sync.sh`
 - homebrew at `/home/linuxbrew/.linuxbrew`, then brewsync
-  (`brew bundle --zap --force-cleanup`; casks and `mas` entries are skipped
-  on Linux; mac-only formulae need an `if OS.mac?` guard in the Brewfile)
+  (`brew bundle --zap --force-cleanup`; app casks and `mas` entries are
+  skipped on Linux — font casks are not, they install to
+  `~/.local/share/fonts`, which is how ghostty's Iosevka nerd font gets
+  there; mac-only formulae need an `if OS.mac?` guard in the Brewfile)
 - `mise install` for all tools in the mise config
 - caps lock → ctrl (kernel-level udev hwdb remap, applies in every session)
 - login shell → zsh; default browser → Helium
diff --git a/debian/ansible/setup.yml b/debian/ansible/setup.yml
index bc81821..3206a28 100644
--- a/debian/ansible/setup.yml
+++ b/debian/ansible/setup.yml
@@ -61,6 +61,7 @@
           - libglib2.0-bin
           - python3-debian
           - thunderbird
+          - wl-clipboard
           - xdg-utils
           - zsh
         state: present