{ ... }: {
  flake.homeManagerModules.wisdomBrowsersOrion =
    { config, lib, pkgs, ... }:
    let
      root = config.chiasson.home;
      cfg = config.chiasson.home.browsers.orion;

      pname = "oriongtk";
      version = "0.3.0";
      flatpakBundle = pkgs.fetchurl {
        url = "https://cdn.kagi.com/downloads/oriongtk.${version}.flatpak";
        hash = "sha256-0NOWPS2Yv5NpnTxqsiMvshHFyTyDotPi964/2og/bCw=";
      };

      appId = "com.kagi.OrionGtk";

      oriongtk = pkgs.runCommand "oriongtk-${version}"
        {
          nativeBuildInputs = [ pkgs.makeWrapper ];
          passthru = {
            inherit pname version;
          };
        }
        ''
          mkdir -p "$out/bin"
          makeWrapper ${pkgs.flatpak}/bin/flatpak "$out/bin/${pname}" \
            --add-flags "run" \
            --add-flags ${lib.escapeShellArg appId}
        '';
    in
    {
      options.chiasson.home.browsers.orion.enable = lib.mkEnableOption ''
        [Orion](https://orionbrowser.com/) (Kagi) — installs the upstream Flatpak bundle and provides `oriongtk`.
      '';

      config = lib.mkIf (root.enable && cfg.enable) {
        home.packages = [ oriongtk ];

        home.activation.oriongtkFlatpak = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
          set -eu

          if [ ! -x "${pkgs.flatpak}/bin/flatpak" ]; then
            echo "oriongtk: flatpak missing; enable Flatpak (e.g. services.flatpak on NixOS)." >&2
            exit 1
          fi

          echo "oriongtk: ensuring ${appId} from ${flatpakBundle} (user)"
          # `--or-update` still exits non-zero when the same ref is already installed from this bundle;
          # `--reinstall` is idempotent for HM switches (uninstall first only if present).
          ${pkgs.flatpak}/bin/flatpak --user install \
            --assumeyes \
            --noninteractive \
            --reinstall \
            --bundle \
            ${lib.escapeShellArg (builtins.toString flatpakBundle)}
        '';
      };
    };
}