diff --git a/bin/omarchy-theme-color b/bin/omarchy-theme-color
index cdf2592d..c5d09ca2 100755
--- a/bin/omarchy-theme-color
+++ b/bin/omarchy-theme-color
@@ -151,6 +151,21 @@ parse_colors_file() {
       value="${value%"${value##*[![:space:]]}"}" # trim unquoted values
     fi
 
+    # Values reach consumers as sed replacement text, so the charset excludes
+    # the delimiter, backslash, and & while still covering everything a real
+    # palette holds: hex, rgb()/rgba() lists, gradient angles like -45deg,
+    # decimals, and bare words. Rejections are announced so a third-party theme
+    # doesn't lose a key silently and leave a raw {{ placeholder }} behind.
+    if [[ ! $key =~ ^[abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-]+$ ]]; then
+      printf 'omarchy-theme-color: skipping key with unsupported characters\n' >&2
+      continue
+    fi
+
+    if [[ ! $value =~ ^[abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789#(),._+/%\ -]*$ ]]; then
+      printf 'omarchy-theme-color: skipping %s: unsupported characters in value\n' "$key" >&2
+      continue
+    fi
+
     THEME_COLORS[$key]="$value"
     [[ $OUTPUT == "raw" ]] && printf '%s\t%s\n' "$key" "$value"
   done <"$COLORS_FILE"
diff --git a/bin/omarchy-theme-set-keyboard-asus-rog b/bin/omarchy-theme-set-keyboard-asus-rog
index 37956214..5dd42ee5 100755
--- a/bin/omarchy-theme-set-keyboard-asus-rog
+++ b/bin/omarchy-theme-set-keyboard-asus-rog
@@ -5,6 +5,8 @@
 
 ASUSCTL_THEME=$HOME/.local/state/omarchy/current/theme/keyboard.rgb
 
-if omarchy-cmd-present asusctl; then
-  asusctl aura effect static -c $(sed 's/^#//' $ASUSCTL_THEME)
+if omarchy-cmd-present asusctl && [[ -f $ASUSCTL_THEME ]]; then
+  color=$(sed 's/^#//' "$ASUSCTL_THEME")
+  [[ $color =~ ^[0-9A-Fa-f]{6}$ ]] || exit 0
+  asusctl aura effect static -c "$color"
 fi
diff --git a/bin/omarchy-theme-set-keyboard-f16 b/bin/omarchy-theme-set-keyboard-f16
index fecceed1..0fab5174 100755
--- a/bin/omarchy-theme-set-keyboard-f16
+++ b/bin/omarchy-theme-set-keyboard-f16
@@ -9,13 +9,16 @@ if omarchy-cmd-present qmk_hid && [[ -f $FRAMEWORK16_THEME ]]; then
   hex=$(cat "$FRAMEWORK16_THEME")
   hex="${hex#\#}"
 
+  [[ $hex =~ ^[0-9A-Fa-f]{6}$ ]] || exit 0
+
   # Convert hex to QMK HSV (0-255 scale) using Python's colorsys
   read -r h s <<< $(python3 -c "
-import colorsys
-r, g, b = int('$hex'[:2],16)/255, int('$hex'[2:4],16)/255, int('$hex'[4:6],16)/255
+import sys, colorsys
+hex = sys.argv[1]
+r, g, b = int(hex[:2],16)/255, int(hex[2:4],16)/255, int(hex[4:6],16)/255
 h, s, v = colorsys.rgb_to_hsv(r, g, b)
 print(int(h * 255), int(s * 255))
-")
+" "$hex")
 
   qmk_hid via --rgb-effect 1 2>/dev/null
   qmk_hid via --rgb-hue "$h" 2>/dev/null
diff --git a/bin/omarchy-theme-set-vscode b/bin/omarchy-theme-set-vscode
index c7daef73..d91b8ba0 100755
--- a/bin/omarchy-theme-set-vscode
+++ b/bin/omarchy-theme-set-vscode
@@ -103,12 +103,20 @@ set_theme() {
   local theme_name=""
 
   if [[ -f "$VS_CODE_THEME_DESCRIPTOR" ]]; then
-    # Theme specifies a preferred 3rd-party extension/theme pair.
-    theme_name=$(jq -r '.name' "$VS_CODE_THEME_DESCRIPTOR")
+    # Theme specifies a preferred 3rd-party extension/theme pair. Both fields
+    # come from the theme, so neither is trusted as a shell or sed argument.
     local extension
-    extension=$(jq -r '.extension' "$VS_CODE_THEME_DESCRIPTOR")
+    theme_name=$(jq -r '.name // empty' "$VS_CODE_THEME_DESCRIPTOR")
+    extension=$(jq -r '.extension // empty' "$VS_CODE_THEME_DESCRIPTOR")
 
-    if [[ -n $extension ]] && ! "$editor_cmd" --list-extensions 2>/dev/null | grep -Fxq "$extension"; then
+    # A label with quotes, backslashes, or control characters can't land in
+    # settings.json as valid JSON, so drop it rather than write it out.
+    [[ $theme_name =~ ^[^[:cntrl:]\"\\]+$ ]] || theme_name=""
+
+    # Only install a well-formed publisher.name id; a malformed one skips the
+    # install without skipping the colorTheme write below.
+    if [[ $extension =~ ^[a-zA-Z0-9._-]+$ ]] &&
+      ! "$editor_cmd" --list-extensions 2>/dev/null | grep -Fxq "$extension"; then
       "$editor_cmd" --install-extension "$extension" >/dev/null 2>&1
     fi
   elif [[ -f "$GENERATED_THEME" ]]; then
@@ -121,12 +129,18 @@ set_theme() {
     mkdir -p "$(dirname "$settings_path")"
     [[ -f $settings_path ]] || printf '{\n}\n' >"$settings_path"
 
+    # settings.json is JSONC: comments and trailing commas are legal there and
+    # common in practice, so it's edited in place rather than round-tripped
+    # through a strict JSON parser that would reject it and reformat the rest.
+    local escaped=${theme_name//&/\\&}
+    escaped=${escaped//|/\\|}
+
     if ! grep -q '"workbench.colorTheme"' "$settings_path"; then
       sed -i --follow-symlinks -E '0,/\{/{s/\{/{\ "workbench.colorTheme": "",/}' "$settings_path"
     fi
 
     sed -i --follow-symlinks -E \
-      "s/(\"workbench.colorTheme\"[[:space:]]*:[[:space:]]*\")[^\"]*(\")/\1$theme_name\2/" \
+      "s|(\"workbench.colorTheme\"[[:space:]]*:[[:space:]]*\")[^\"]*(\")|\1$escaped\2|" \
       "$settings_path"
   elif [[ -f $settings_path ]]; then
     sed -i --follow-symlinks -E 's/\"workbench\.colorTheme\"[[:space:]]*:[^,}]*,?//' "$settings_path"
diff --git a/etc/sudoers.d/omarchy-tzupdate b/etc/sudoers.d/omarchy-tzupdate
index 913fa174..d35adb82 100644
--- a/etc/sudoers.d/omarchy-tzupdate
+++ b/etc/sudoers.d/omarchy-tzupdate
@@ -1 +1 @@
-%wheel ALL=(root) NOPASSWD: /usr/bin/tzupdate, /usr/bin/timedatectl set-timezone *
+%wheel ALL=(root) NOPASSWD: /usr/bin/timedatectl set-timezone *
diff --git a/test/shell.d/timezone-test.sh b/test/shell.d/timezone-test.sh
index 3a03c65f..c1880a14 100644
--- a/test/shell.d/timezone-test.sh
+++ b/test/shell.d/timezone-test.sh
@@ -7,9 +7,12 @@ source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
 timezone_menu="$ROOT/bin/omarchy-menu-timezone"
 sudoers_file="$ROOT/etc/sudoers.d/omarchy-tzupdate"
 
-grep -F '%wheel ALL=(root) NOPASSWD: /usr/bin/tzupdate, /usr/bin/timedatectl set-timezone *' "$sudoers_file" >/dev/null ||
+grep -F '%wheel ALL=(root) NOPASSWD: /usr/bin/timedatectl set-timezone *' "$sudoers_file" >/dev/null ||
   fail "timezone sudoers rule allows passwordless timedatectl timezone changes"
 
+! grep -F 'tzupdate' "$sudoers_file" >/dev/null ||
+  fail "timezone sudoers rule does not grant passwordless tzupdate"
+
 grep -F 'sudo timedatectl set-timezone "$timezone"' "$timezone_menu" >/dev/null ||
   fail "timezone menu uses the passwordless sudoers timedatectl rule"