diff --git a/bin/omarchy-channel-set b/bin/omarchy-channel-set
index a00c9d92..039d3292 100755
--- a/bin/omarchy-channel-set
+++ b/bin/omarchy-channel-set
@@ -15,8 +15,10 @@ set -euo pipefail
 omarchy_security_sanitize_bash_environment "$0" "$@"
 omarchy_security_require_source_root "$0"
 user_path=$PATH
-omarchy_security_revoke_sudo_timestamp || exit 1
+# Traps first, so a signal or failure during the entry revocation still
+# exits through the cleanup path.
 omarchy_security_install_sudo_cleanup_traps
+omarchy_security_revoke_sudo_timestamp || exit 1
 omarchy_security_enable_no_update_sudo
 
 usage() { echo "Usage: omarchy-channel-set [stable|rc|edge|dev]"; }
diff --git a/bin/omarchy-refresh-pacman b/bin/omarchy-refresh-pacman
index cd9eab11..7406e6ad 100755
--- a/bin/omarchy-refresh-pacman
+++ b/bin/omarchy-refresh-pacman
@@ -18,8 +18,10 @@ omarchy_security_require_source_root "$0"
 # caller's original path over the same way the updater receives it.
 user_path=${OMARCHY_UPDATE_USER_PATH:-$PATH}
 unset OMARCHY_UPDATE_USER_PATH
-omarchy_security_revoke_sudo_timestamp || exit 1
+# Traps first, so a signal or failure during the entry revocation still
+# exits through the cleanup path.
 omarchy_security_install_sudo_cleanup_traps
+omarchy_security_revoke_sudo_timestamp || exit 1
 omarchy_security_enable_no_update_sudo
 
 channel="${1:-stable}"
diff --git a/bin/omarchy-restart-shell b/bin/omarchy-restart-shell
index 4ca6ba29..8d3d6ce9 100755
--- a/bin/omarchy-restart-shell
+++ b/bin/omarchy-restart-shell
@@ -61,8 +61,10 @@ relock_session() {
   return 1
 }
 
+# A short timeout keeps an unresponsive user bus from stalling the restart;
+# busctl would otherwise wait 25 seconds per probe.
 notifications_ready() {
-  [[ $(busctl --user call org.freedesktop.DBus /org/freedesktop/DBus \
+  [[ $(busctl --user --timeout=1s call org.freedesktop.DBus /org/freedesktop/DBus \
     org.freedesktop.DBus NameHasOwner s org.freedesktop.Notifications 2>/dev/null) == "b true" ]]
 }
 
diff --git a/bin/omarchy-update b/bin/omarchy-update
index 2d5ad474..9c6d21d7 100755
--- a/bin/omarchy-update
+++ b/bin/omarchy-update
@@ -20,8 +20,10 @@ omarchy_security_require_source_root "$0"
 # Preserve the caller's path only for the later unprivileged hook/mise phases.
 user_path=${OMARCHY_UPDATE_USER_PATH:-$PATH}
 unset OMARCHY_UPDATE_USER_PATH
-omarchy_security_revoke_sudo_timestamp || exit 1
+# Traps first, so a signal or failure during the entry revocation still
+# exits through the cleanup path.
 omarchy_security_install_sudo_cleanup_traps
+omarchy_security_revoke_sudo_timestamp || exit 1
 omarchy_security_enable_no_update_sudo
 
 update_stay_awake_stopped=0
diff --git a/bin/omarchy-update-stay-awake b/bin/omarchy-update-stay-awake
index af941c4a..be27a2cc 100755
--- a/bin/omarchy-update-stay-awake
+++ b/bin/omarchy-update-stay-awake
@@ -15,8 +15,10 @@ omarchy_security_require_privileged_bash_startup || exit 126
 set -e
 omarchy_security_sanitize_bash_environment "$0" "$@"
 omarchy_security_require_source_root "$0"
-omarchy_security_revoke_sudo_timestamp || exit 1
+# Traps first, so a signal or failure during the entry revocation still
+# exits through the cleanup path.
 omarchy_security_install_sudo_cleanup_traps
+omarchy_security_revoke_sudo_timestamp || exit 1
 omarchy_security_enable_no_update_sudo
 
 state_dir="${XDG_RUNTIME_DIR:-/tmp/omarchy-$UID}/omarchy-update-stay-awake"