diff --git a/bin/omarchy-remove-preinstalls b/bin/omarchy-remove-preinstalls
index 2c5adea3..626c79a2 100755
--- a/bin/omarchy-remove-preinstalls
+++ b/bin/omarchy-remove-preinstalls
@@ -15,8 +15,7 @@ if gum confirm "Are you sure you want to remove all preinstalled web apps, TUI w
   # Remove mise stubs
   rm -f ~/.local/bin/codex ~/.local/bin/claude ~/.local/bin/agy ~/.local/bin/copilot \
        ~/.local/bin/gh ~/.local/bin/opencode ~/.local/bin/playwright ~/.local/bin/playwright-cli ~/.local/bin/pi \
-       ~/.local/bin/omp ~/.local/bin/ori ~/.local/bin/grok ~/.local/bin/crush ~/.local/bin/ghui ~/.local/bin/hunk \
-       ~/.local/bin/dim ~/.local/bin/kimi
+       ~/.local/bin/omp ~/.local/bin/ori ~/.local/bin/grok ~/.local/bin/crush ~/.local/bin/ghui ~/.local/bin/hunk
 
   # Cursor's own installer links ~/.local/bin/cursor-agent as well, so only
   # the mise wrapper omarchy-mise-install wrote is a preinstall.
@@ -25,6 +24,15 @@ if gum confirm "Are you sure you want to remove all preinstalled web apps, TUI w
     rm -f ~/.local/bin/cursor-agent
   fi
 
+  # Only Omarchy's mise wrappers for Dim and Kimi are preinstalls.
+  for wrapper in "dim npm:dimcode" "kimi npm:@moonshot-ai/kimi-code"; do
+    read -r command package <<<"$wrapper"
+    if [[ -f ~/.local/bin/$command && ! -L ~/.local/bin/$command ]] &&
+      grep -qF "mise use -g --quiet \"$package\"" ~/.local/bin/$command; then
+      rm -f ~/.local/bin/$command
+    fi
+  done
+
   # Preserve a user-managed Muse launcher at the same path.
   if [[ -f ~/.local/bin/muse && ! -L ~/.local/bin/muse ]] &&
     grep -Eq '^mise use -g .*"http:muse\[' ~/.local/bin/muse; then
diff --git a/bin/omarchy-setup-claude-api b/bin/omarchy-setup-claude-api
index 146ef3ca..ac86106b 100755
--- a/bin/omarchy-setup-claude-api
+++ b/bin/omarchy-setup-claude-api
@@ -12,17 +12,15 @@ keys=(ANTHROPIC_BASE_URL ANTHROPIC_AUTH_TOKEN ANTHROPIC_MODEL ANTHROPIC_DEFAULT_
 
 keys_json=$(printf '%s\n' "${keys[@]}" | jq -R . | jq -s .)
 
-# rewrite <file> <jq filter> [jq args...] keeps the file private.
+# rewrite <file> <jq filter> [jq args...] replaces the file with a fresh 0600 copy.
 rewrite() {
-  local file=$1 filter=$2
+  local file=$1 filter=$2 tmp
   shift 2
   mkdir -p "${file%/*}"
   [[ -f $file ]] || echo '{}' >"$file"
-  (
-    umask 077
-    jq --argjson keys "$keys_json" "$@" "$filter" "$file" >"$file.tmp"
-  )
-  mv "$file.tmp" "$file"
+  tmp=$(mktemp "$file.XXXXXX")
+  jq --argjson keys "$keys_json" "$@" "$filter" "$file" >"$tmp" || { rm -f "$tmp"; exit 1; }
+  mv "$tmp" "$file"
 }
 
 if [[ ${1:-} == "--remove" ]]; then
diff --git a/install/user/mise.sh b/install/user/mise.sh
index 3ed6cdcd..8ba6c885 100644
--- a/install/user/mise.sh
+++ b/install/user/mise.sh
@@ -21,8 +21,8 @@ omarchy-mise-install github:basecamp/hey-cli hey
 omarchy-mise-install github:basecamp/basecamp-cli basecamp
 omarchy-mise-install npm:cf cf
 omarchy-mise-install github:OpenRouterLabs/ori-releases ori
-omarchy-mise-install npm:dimcode dim
-omarchy-mise-install npm:@moonshot-ai/kimi-code kimi
+omarchy-cmd-missing dim && omarchy-mise-install npm:dimcode dim
+omarchy-cmd-missing kimi && omarchy-mise-install npm:@moonshot-ai/kimi-code kimi
 if omarchy-cmd-missing muse; then
   omarchy-mise-install "http:muse[url=https://api.meta.ai/muse-launcher.sh,bin=muse,version_list_url=https://api.meta.ai/muse-code/channels/muse-stable,version_json_path=.version]" muse
 fi
diff --git a/test/shell.d/default-agent-test.sh b/test/shell.d/default-agent-test.sh
index 9bbcf779..b9614793 100644
--- a/test/shell.d/default-agent-test.sh
+++ b/test/shell.d/default-agent-test.sh
@@ -166,7 +166,9 @@ grep -Fx "$cursor_agent_package" "$stub_log" >/dev/null || fail "user setup crea
 grep -Fx "$omp_package omp" "$stub_log" >/dev/null || fail "user setup creates the Oh My Pi lazy stub"
 grep -Fx "$crush_package" "$stub_log" >/dev/null || fail "user setup creates the Crush lazy stub"
 grep -Fx "$ori_package ori" "$stub_log" >/dev/null || fail "user setup creates the Ori lazy stub"
+OMARCHY_TEST_MISSING_COMMAND=dim source "$ROOT/install/user/mise.sh"
 grep -Fx "$dim_package dim" "$stub_log" >/dev/null || fail "user setup creates the Dim Agent lazy stub"
+OMARCHY_TEST_MISSING_COMMAND=kimi source "$ROOT/install/user/mise.sh"
 grep -Fx "$kimi_package kimi" "$stub_log" >/dev/null || fail "user setup creates the Kimi Code lazy stub"
 OMARCHY_TEST_MISSING_COMMAND=muse source "$ROOT/install/user/mise.sh"
 grep -Fx "$muse_package muse" "$stub_log" >/dev/null || fail "user setup creates the Muse lazy stub"
@@ -177,6 +179,7 @@ source "$ROOT/install/user/mise.sh"
 grep -Fx "$cursor_agent_package" "$stub_log" >/dev/null && fail "user setup replaces an existing cursor-agent command"
 pass "user setup keeps an existing Cursor CLI install"
 grep -Fx "$muse_package muse" "$stub_log" >/dev/null && fail "user setup replaces an existing Muse command"
+grep -E "^($dim_package dim|$kimi_package kimi)$" "$stub_log" >/dev/null && fail "user setup replaces an existing Dim or Kimi command"
 
 : >"$stub_log"
 OMARCHY_TEST_MISSING_COMMAND=muse source "$ROOT/migrations/1788724825.sh" >/dev/null
@@ -448,6 +451,17 @@ for command in agy omp ori grok crush cursor-agent muse dim kimi; do
 done
 pass "Remove Preinstalls deletes every optional agent lazy stub"
 
+for command in dim kimi; do
+  printf '#!/bin/bash\necho user-%s\n' "$command" >"$test_home/.local/bin/$command"
+  chmod +x "$test_home/.local/bin/$command"
+done
+omarchy-remove-preinstalls >/dev/null
+for command in dim kimi; do
+  [[ $("$test_home/.local/bin/$command") == "user-$command" ]] || fail "Remove Preinstalls keeps a user-managed $command"
+  rm "$test_home/.local/bin/$command"
+done
+pass "Remove Preinstalls keeps user-managed Dim and Kimi launchers"
+
 # Cursor's installer links the same path, so anything but the mise wrapper is
 # the user's own install.
 touch "$test_home/.local/bin/cursor-agent.official"
diff --git a/test/shell.d/setup-claude-api-test.sh b/test/shell.d/setup-claude-api-test.sh
index cab9a000..8f5b7bba 100755
--- a/test/shell.d/setup-claude-api-test.sh
+++ b/test/shell.d/setup-claude-api-test.sh
@@ -25,6 +25,8 @@ run_setup() {
 }
 
 echo '{"theme":"dark","env":{"KEEP_ME":"1"}}' >"$settings"
+chmod 644 "$settings"
+install -m 644 /dev/null "$settings.tmp"
 echo '{"userID":"abc"}' >"$HOME/.claude.json"
 run_setup DeepSeek sk-test "deepseek-flash[1m]"