diff --git a/.bashrc.d/00_env.sh b/.bashrc.d/00_env.sh
index dde44f9..637e67b 100644
--- a/.bashrc.d/00_env.sh
+++ b/.bashrc.d/00_env.sh
@@ -34,7 +34,9 @@ Linux)
     export PAGER=$(type less >/dev/null 2>&1 && echo less || echo more)
 
     function yaml2json {
-        python -c 'import sys, yaml, json; print(json.dumps(yaml.safe_load(sys.stdin.read())))'
+        # python3 on Ubuntu 20+; fall back to python2 if needed
+        local _py; _py=$(command -v python3 2>/dev/null || command -v python 2>/dev/null)
+        "$_py" -c 'import sys, yaml, json; print(json.dumps(yaml.safe_load(sys.stdin.read())))'
     }
     ;;
 Darwin)
@@ -42,14 +44,6 @@ Darwin)
     export CLICOLOR=1
     export DOCKER_DEFAULT_PLATFORM=linux/amd64
     export BASH_SILENCE_DEPRECATION_WARNING=1
-
-    # pyenv — only init if installed
-    if command -v pyenv >/dev/null 2>&1; then
-        export PYENV_ROOT="$HOME/.pyenv"
-        export PATH="$PYENV_ROOT/bin:$PATH"
-        eval "$(pyenv init --path)"
-        eval "$(pyenv init -)"
-    fi
     ;;
 FreeBSD)
     export CLICOLOR=1
@@ -57,12 +51,27 @@ FreeBSD)
     ;;
 esac
 
+# -----------------------------------------------------------------------
+# pyenv — init if installed (works on both Linux and macOS)
+# -----------------------------------------------------------------------
+if command -v pyenv >/dev/null 2>&1; then
+    export PYENV_ROOT="${PYENV_ROOT:-$HOME/.pyenv}"
+    [[ ":$PATH:" != *":$PYENV_ROOT/bin:"* ]] && export PATH="$PYENV_ROOT/bin:$PATH"
+    eval "$(pyenv init --path)"
+    eval "$(pyenv init -)"
+fi
+
 # -----------------------------------------------------------------------
 # Terminal-specific
 # -----------------------------------------------------------------------
 case $TERM in
 xterm*)
     export LS_COLORS='no=00:fi=00:di=00;35:ln=00;36:pi=40;33:so=00;35:bd=40;33;01:cd=40;33;01:or=01;05;37;41:mi=01;05;37;41:ex=00;31:*.cmd=00;32:*.exe=00;32:*.com=00;32:*.btm=00;32:*.bat=00;32:*.sh=00;32:*.csh=00;32:*.tar=00;31:*.tgz=00;31:*.arj=00;31:*.taz=00;31:*.lzh=00;31:*.zip=00;31:*.z=00;31:*.Z=00;31:*.gz=00;31:*.bz2=00;31:*.bz=00;31:*.tz=00;31:*.rpm=00;31:*.cpio=00;31:*.jpg=00;35:*.gif=00;35:*.bmp=00;35:*.xbm=00;35:*.xpm=00;35:*.png=00;35:*.tif=00;35:*.pl=00;32:'
-    alias ls='ls -F --color'
+    # GNU ls (Linux) uses --color; BSD ls (macOS/FreeBSD) uses -G / CLICOLOR
+    if [[ "$(uname -s)" == "Linux" ]]; then
+        alias ls='ls -F --color=auto'
+    else
+        alias ls='ls -F -G'
+    fi
     ;;
 esac
diff --git a/.bashrc.d/10_aliases.sh b/.bashrc.d/10_aliases.sh
index bc623f8..4df549c 100644
--- a/.bashrc.d/10_aliases.sh
+++ b/.bashrc.d/10_aliases.sh
@@ -17,8 +17,10 @@ alias sl='screen -list'
 alias sr='screen -r'
 
 # Process inspection
-alias psg='pstree | grep'
-alias ps-m='ps aux --sort -rss'
+# pstree may not be installed on all systems
+command -v pstree >/dev/null 2>&1 && alias psg='pstree | grep'
+# --sort is a GNU ps flag (Linux only)
+[[ "$(uname -s)" == "Linux" ]] && alias ps-m='ps aux --sort -rss'
 
 # Docker — short forms
 alias d='docker'
@@ -29,5 +31,10 @@ alias db='docker build'
 
 # Git helpers
 alias giturl='git config --get remote.origin.url'
-alias gitresetpw='git config --global credential.helper osxkeychain'
+# Git credential helper is OS-specific
+if [[ "$(uname -s)" == "Darwin" ]]; then
+    alias gitresetpw='git config --global credential.helper osxkeychain'
+else
+    alias gitresetpw='git config --global credential.helper store'
+fi
 alias git-clean='git-prune-branches'
diff --git a/scripts/dotfiles_manager.sh b/scripts/dotfiles_manager.sh
index 8525b7d..e2b35f9 100755
--- a/scripts/dotfiles_manager.sh
+++ b/scripts/dotfiles_manager.sh
@@ -129,6 +129,15 @@ _authed_url() {
     fi
 }
 
+# Check gpg is installed with OS-appropriate install hint
+_require_gpg() {
+    command -v gpg &>/dev/null && return 0
+    case "$(uname -s)" in
+        Darwin*) die "gpg not installed. Install with: brew install gnupg" ;;
+        *)       die "gpg not installed. Install with: sudo apt-get install gnupg" ;;
+    esac
+}
+
 # -----------------------------------------------------------------------
 # COMMAND: init
 # -----------------------------------------------------------------------
@@ -692,7 +701,7 @@ SSH_CONFIG
 # -----------------------------------------------------------------------
 cmd_ssh_export() {
     bold "=== Export SSH Private Keys (GPG-encrypted) ==="
-    command -v gpg &>/dev/null || die "gpg not installed. Install with: brew install gnupg"
+    _require_gpg
 
     local dotfiles_ssh="$DOTFILES_DIR/.ssh/keys"
     mkdir -p "$dotfiles_ssh"
@@ -752,7 +761,7 @@ cmd_ssh_export() {
 # -----------------------------------------------------------------------
 cmd_ssh_import() {
     bold "=== Import SSH Private Keys (GPG decrypt) ==="
-    command -v gpg &>/dev/null || die "gpg not installed. Install with: brew install gnupg"
+    _require_gpg
 
     local dotfiles_ssh="$DOTFILES_DIR/.ssh/keys"
     local gpg_keys=()