diff --git a/nixos/imalison.nix b/nixos/imalison.nix
index 75e1cd3b..871ea06e 100644
--- a/nixos/imalison.nix
+++ b/nixos/imalison.nix
@@ -200,15 +200,15 @@
         "x-scheme-handler/https"
         "x-scheme-handler/google-chrome"
       ];
-      exec = "${pkgs.google-chrome}/bin/google-chrome-stable --remote-debugging-port=46649 --remote-allow-origins=http://127.0.0.1,http://localhost %U";
+      exec = "${pkgs.google-chrome}/bin/google-chrome-stable --user-data-dir=/home/imalison/.cache/google-chrome-devtools --remote-debugging-port=46649 --remote-allow-origins=http://127.0.0.1,http://localhost %U";
       actions = {
         new-window = {
           name = "New Window";
-          exec = "${pkgs.google-chrome}/bin/google-chrome-stable --remote-debugging-port=46649 --remote-allow-origins=http://127.0.0.1,http://localhost";
+          exec = "${pkgs.google-chrome}/bin/google-chrome-stable --user-data-dir=/home/imalison/.cache/google-chrome-devtools --remote-debugging-port=46649 --remote-allow-origins=http://127.0.0.1,http://localhost";
         };
         new-private-window = {
           name = "New Incognito Window";
-          exec = "${pkgs.google-chrome}/bin/google-chrome-stable --remote-debugging-port=46649 --remote-allow-origins=http://127.0.0.1,http://localhost --incognito";
+          exec = "${pkgs.google-chrome}/bin/google-chrome-stable --user-data-dir=/home/imalison/.cache/google-chrome-devtools --remote-debugging-port=46649 --remote-allow-origins=http://127.0.0.1,http://localhost --incognito";
         };
       };
     };
diff --git a/nixos/overlay.nix b/nixos/overlay.nix
index ffd8618a..dc1ba6d1 100644
--- a/nixos/overlay.nix
+++ b/nixos/overlay.nix
@@ -30,9 +30,41 @@ let
   #   hash = "sha256-OqvLiwB5TwZaxDvyN/+/+eueBdWNaYxd81cd5AZK/mA=";
   #   npmDepsHash = "sha256-vy7osk3UAOEgsJx9jdcGe2wICOk5Urzxh1WLAHyHM+U=";
   # };
+  # Chrome 136+ ignores remote debugging switches on the default profile.
+  # Keep the wrapper in place, but do not inject remote debugging flags into
+  # the normal Chrome launcher. The supported path for a real profile is the
+  # Chrome remote debugging permission flow used by chrome-devtools-mcp
+  # --auto-connect.
+  chromeRemoteDebuggingFlags = [];
   placeholder = null; # Dummy binding to keep let block valid
 in
 {
+  google-chrome = prev.symlinkJoin {
+    name = prev.google-chrome.name;
+    paths = [ prev.google-chrome ];
+    nativeBuildInputs = [ final.makeWrapper ];
+    postBuild = ''
+      rm "$out/bin/google-chrome" "$out/bin/google-chrome-stable"
+
+      makeWrapper ${prev.google-chrome}/bin/google-chrome "$out/bin/google-chrome" \
+        ${final.lib.concatMapStringsSep " " (flag: "--add-flags ${final.lib.escapeShellArg flag}") chromeRemoteDebuggingFlags}
+
+      makeWrapper ${prev.google-chrome}/bin/google-chrome-stable "$out/bin/google-chrome-stable" \
+        ${final.lib.concatMapStringsSep " " (flag: "--add-flags ${final.lib.escapeShellArg flag}") chromeRemoteDebuggingFlags}
+
+      for desktopName in google-chrome.desktop com.google.Chrome.desktop; do
+        desktopFile="$out/share/applications/$desktopName"
+        if [ -f "$desktopFile" ]; then
+          rm "$desktopFile"
+          cp "${prev.google-chrome}/share/applications/$desktopName" "$desktopFile"
+          substituteInPlace "$desktopFile" \
+            --replace-fail "${prev.google-chrome}/bin/google-chrome-stable" "$out/bin/google-chrome-stable"
+        fi
+      done
+    '';
+    meta = prev.google-chrome.meta;
+  };
+
   # Fix poetry pbs-installer version constraint issue
   poetry = prev.poetry.overrideAttrs (oldAttrs: {
     dontCheckRuntimeDeps = true;
diff --git a/nixos/secrets/gws-client-secret.json.age b/nixos/secrets/gws-client-secret.json.age
new file mode 100644
index 00000000..d0dae6ae
Binary files /dev/null and b/nixos/secrets/gws-client-secret.json.age differ