diff --git a/dot_config/zsh/dot_zshrc.tmpl b/dot_config/zsh/dot_zshrc.tmpl
index 3acf887..ff56212 100644
--- a/dot_config/zsh/dot_zshrc.tmpl
+++ b/dot_config/zsh/dot_zshrc.tmpl
@@ -1,3 +1,9 @@
+{{- $brewPrefix := "" -}}
+{{- $brewPrefixLlvm := "" -}}
+{{- if eq .chezmoi.os "darwin" -}}
+{{-   $brewPrefix = output "brew" "--prefix" | trim -}}
+{{-   $brewPrefixLlvm = output "brew" "--prefix" "llvm" | trim -}}
+{{- end -}}
 typeset -U path PATH
 path+=("$HOME/.local/bin" "$HOME/.cargo/bin")
 
@@ -57,7 +63,7 @@ export FZF_ALT_C_COMMAND="$FZF_DEFAULT_COMMAND --type d"
 if [[ "$TERM_PROGRAM" == "ghostty" ]] && command -v starship >/dev/null 2>&1; then
     eval "$(starship init zsh)"
 else
-    source "$(brew --prefix)/share/powerlevel10k/powerlevel10k.zsh-theme"
+    source "{{ $brewPrefix }}/share/powerlevel10k/powerlevel10k.zsh-theme"
     [ -s "$ZCONFDIR/.p10k.zsh" ] && . "$ZCONFDIR/.p10k.zsh"
 fi
 {{- else if eq .chezmoi.os "linux" }}
@@ -68,13 +74,11 @@ command -v starship >/dev/null 2>&1 && eval "$(starship init zsh)"
 {{ if eq .chezmoi.os "darwin" }}
 # some brew packages are installed in sbin (e.g. mtr)
 path=("/usr/local/sbin" "$path[@]")
-if [[ -n $(brew --prefix llvm) ]]; then
-    # clang-tidy is not installed in brew --prefix
-    path=("$(brew --prefix llvm)/bin" "$path[@]")
+if [[ -d "{{ $brewPrefixLlvm }}" ]]; then
+    path=("{{ $brewPrefixLlvm }}/bin" "$path[@]")
 fi
 
-[ -s "$(brew --prefix)/share/zsh-autosuggestions/zsh-autosuggestions.zsh" ] && source "$(brew --prefix)/share/zsh-autosuggestions/zsh-autosuggestions.zsh"
-[ -s "$(brew --prefix asdf)/libexec/asdf.sh" ] && . "$(brew --prefix asdf)/libexec/asdf.sh"
+[ -s "{{ $brewPrefix }}/share/zsh-autosuggestions/zsh-autosuggestions.zsh" ] && source "{{ $brewPrefix }}/share/zsh-autosuggestions/zsh-autosuggestions.zsh"
 {{ else if eq .chezmoi.os "linux" }}
 {{   if eq .chezmoi.osRelease.id "ubuntu" }}
 [ -s /home/guilhem/.autojump/etc/profile.d/autojump.sh ] && source /home/guilhem/.autojump/etc/profile.d/autojump.sh
@@ -97,7 +101,7 @@ autoload -Uz tldr-fzf
 autoload -Uz volta-yarn-cleanup
 
 {{- if eq .chezmoi.os "darwin" }}
-fpath+="$(brew --prefix)/share/zsh/site-functions"
+fpath+="{{ $brewPrefix }}/share/zsh/site-functions"
 {{ end }}
 fpath+=($HOME/.rustup/toolchains/stable-x86_64-apple-darwin/share/zsh/site-functions(N/))
 fpath+=($HOME/.docker/completions(N/))
@@ -108,8 +112,8 @@ autoload -Uz compinit && compinit
 autoload -Uz select-word-style && select-word-style bash
 
 {{- if eq .chezmoi.os "darwin" }}
-source $(brew --prefix)/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
-source $(brew --prefix)/share/zsh-history-substring-search/zsh-history-substring-search.zsh
+source {{ $brewPrefix }}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
+source {{ $brewPrefix }}/share/zsh-history-substring-search/zsh-history-substring-search.zsh
 bindkey '^[[A' history-substring-search-up
 bindkey '^[[B' history-substring-search-down
 {{ end -}}
diff --git a/dot_config/zsh/tools.zsh.tmpl b/dot_config/zsh/tools.zsh.tmpl
index d17949d..48e0c9e 100644
--- a/dot_config/zsh/tools.zsh.tmpl
+++ b/dot_config/zsh/tools.zsh.tmpl
@@ -2,7 +2,7 @@
 export ASDF_CONFIG_FILE="$XDG_CONFIG_HOME/asdf/config"
 export ASDF_DATA_DIR="$XDG_DATA_HOME/asdf"
 {{- if eq .chezmoi.os "darwin" }}
-asdf_source="$(brew --prefix asdf)/libexec/asdf.sh"
+asdf_source="{{ output "brew" "--prefix" "asdf" | trim }}/libexec/asdf.sh"
 {{  else if eq .chezmoi.os "linux" }}
 {{- if eq .chezmoi.osRelease.id "ubuntu" }}
 asdf_source="$HOME/.asdf/asdf.sh"
@@ -14,14 +14,17 @@ fi
 fpath=(${ASDF_DIR}/completions $fpath)
 
 # delta
-if which delta &>/dev/null; then
+if command -v delta &>/dev/null; then
     compdef _gnu_generic delta
 fi
 
 # graphite
-if which gt &>/dev/null; then
-    eval "$(gt completion)"
+_gt_cache="$XDG_CACHE_HOME/zsh/gt-completion.zsh"
+if [[ ! -s "$_gt_cache" ]] && command -v gt &>/dev/null; then
+    mkdir -p "${_gt_cache:h}"
+    gt completion > "$_gt_cache"
 fi
+[ -s "$_gt_cache" ] && source "$_gt_cache"
 
 {{- if eq .chezmoi.os "darwin" }}
 # homebrew
@@ -31,7 +34,7 @@ export HOMEBREW_CASK_OPTS=--require-sha
 {{- end }}
 
 # kubectl
-if which kubectl &>/dev/null; then
+if command -v kubectl &>/dev/null; then
     alias k='kubectl'
     alias kd='kubectl describe'
     alias ke='kubectl edit'
@@ -43,7 +46,7 @@ if which kubectl &>/dev/null; then
 fi
 
 # k9s
-if which k9s &>/dev/null; then
+if command -v k9s &>/dev/null; then
     alias k9s='EDITOR=nvim k9s'
 fi
 
@@ -54,9 +57,15 @@ export LESSKEY="$XDG_STATE_HOME/less/keys"
 # mypy
 export MYPY_CACHE_DIR="$XDG_CACHE_HOME/mypy"
 
-# op
-if which op &>/dev/null; then
-    eval "$(op completion zsh)"
+# op — cache completions to avoid running `op` on every shell init
+# (op accesses 1Password app data, which triggers macOS privacy prompts)
+if command -v op &>/dev/null; then
+    _op_comp_cache="${XDG_CACHE_HOME:-$HOME/.cache}/zsh/op_completion.zsh"
+    if [[ ! -f "$_op_comp_cache" || "$(op --version 2>/dev/null)" != "$(head -1 "$_op_comp_cache" 2>/dev/null | sed 's/^# //')" ]]; then
+        mkdir -p "${_op_comp_cache:h}"
+        { echo "# $(op --version 2>/dev/null)"; op completion zsh; } > "$_op_comp_cache"
+    fi
+    source "$_op_comp_cache"
     compdef _op op
 fi
 
@@ -84,9 +93,12 @@ alias v='nvim'
 export WGETRC="$XDG_CONFIG_HOME/wget/wgetrc"
 
 # zoxide
-if which zoxide &>/dev/null; then
-    eval "$(zoxide init --cmd cd zsh)"
+_zoxide_cache="$XDG_CACHE_HOME/zsh/zoxide-init.zsh"
+if [[ ! -s "$_zoxide_cache" ]] && command -v zoxide &>/dev/null; then
+    mkdir -p "${_zoxide_cache:h}"
+    zoxide init --cmd cd zsh > "$_zoxide_cache"
 fi
+[ -s "$_zoxide_cache" ] && source "$_zoxide_cache"
 
 # Re-assert Yarn Switch + Volta PATH ordering. dot_zshenv already puts them
 # ahead of system PATH for non-interactive shells, but in interactive shells