diff --git a/pkgbuilds/omarchy-settings-dev/PKGBUILD b/pkgbuilds/omarchy-settings-dev/PKGBUILD
index 3535f702..fa509e87 100644
--- a/pkgbuilds/omarchy-settings-dev/PKGBUILD
+++ b/pkgbuilds/omarchy-settings-dev/PKGBUILD
@@ -220,6 +220,16 @@ package() {
   if [[ -f default/systemd/user/omarchy-brightness-keyboard-auto.service ]]; then
     install -Dm644 default/systemd/user/omarchy-brightness-keyboard-auto.service "$pkgdir/usr/lib/systemd/user/omarchy-brightness-keyboard-auto.service"
   fi
+  # First-run, a migration and their own setup commands enable the USB and
+  # Thunderbolt approval watchers. Left in /usr/share/omarchy/default alone,
+  # systemd cannot find them: the Thunderbolt migration fails, which holds back
+  # every migration after it, and first-run enables none of its units.
+  if [[ -f default/systemd/user/omarchy-usb-authorization.service ]]; then
+    install -Dm644 default/systemd/user/omarchy-usb-authorization.service "$pkgdir/usr/lib/systemd/user/omarchy-usb-authorization.service"
+  fi
+  if [[ -f default/systemd/user/omarchy-thunderbolt-authorization.service ]]; then
+    install -Dm644 default/systemd/user/omarchy-thunderbolt-authorization.service "$pkgdir/usr/lib/systemd/user/omarchy-thunderbolt-authorization.service"
+  fi
   # Marks app.slice (and only app.slice) as a systemd-oomd kill candidate, so
   # memory pressure costs one app scope instead of the compositor session.
   # Thresholds live in etc/systemd/oomd.conf.d/10-omarchy.conf. Both this and
diff --git a/pkgbuilds/omarchy-settings/PKGBUILD b/pkgbuilds/omarchy-settings/PKGBUILD
index 37fde6fe..b960e1f8 100644
--- a/pkgbuilds/omarchy-settings/PKGBUILD
+++ b/pkgbuilds/omarchy-settings/PKGBUILD
@@ -225,6 +225,16 @@ package() {
   if [[ -f default/systemd/user/omarchy-brightness-keyboard-auto.service ]]; then
     install -Dm644 default/systemd/user/omarchy-brightness-keyboard-auto.service "$pkgdir/usr/lib/systemd/user/omarchy-brightness-keyboard-auto.service"
   fi
+  # First-run, a migration and their own setup commands enable the USB and
+  # Thunderbolt approval watchers. Left in /usr/share/omarchy/default alone,
+  # systemd cannot find them: the Thunderbolt migration fails, which holds back
+  # every migration after it, and first-run enables none of its units.
+  if [[ -f default/systemd/user/omarchy-usb-authorization.service ]]; then
+    install -Dm644 default/systemd/user/omarchy-usb-authorization.service "$pkgdir/usr/lib/systemd/user/omarchy-usb-authorization.service"
+  fi
+  if [[ -f default/systemd/user/omarchy-thunderbolt-authorization.service ]]; then
+    install -Dm644 default/systemd/user/omarchy-thunderbolt-authorization.service "$pkgdir/usr/lib/systemd/user/omarchy-thunderbolt-authorization.service"
+  fi
   # Marks app.slice (and only app.slice) as a systemd-oomd kill candidate, so
   # memory pressure costs one app scope instead of the compositor session.
   # Thresholds live in etc/systemd/oomd.conf.d/10-omarchy.conf. Both this and