diff --git a/home/.chezmoiscripts/universal/run_before_01-macos-privileges.sh.tmpl b/home/.chezmoiscripts/universal/run_before_01-macos-privileges.sh.tmpl
index 7657c9e1..2d70705c 100644
--- a/home/.chezmoiscripts/universal/run_before_01-macos-privileges.sh.tmpl
+++ b/home/.chezmoiscripts/universal/run_before_01-macos-privileges.sh.tmpl
@@ -36,10 +36,12 @@ ensureFullDiskAccess() {
             ensureFullDiskAccess
         else
             logg success 'Current terminal has full disk access'
-            if command -v gsed > /dev/null; then
-                sudo gsed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
-            else
-                sudo sed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
+            if [ -f "$HOME/.zshrc" ]; then
+                if command -v gsed > /dev/null; then
+                    sudo gsed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
+                else
+                    sudo sed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
+                fi
             fi
         fi
     fi
diff --git a/home/.chezmoiscripts/universal/run_before_01-system-homebrew.sh.tmpl b/home/.chezmoiscripts/universal/run_before_01-system-homebrew.sh.tmpl
index 86afb0f0..452c11af 100644
--- a/home/.chezmoiscripts/universal/run_before_01-system-homebrew.sh.tmpl
+++ b/home/.chezmoiscripts/universal/run_before_01-system-homebrew.sh.tmpl
@@ -46,10 +46,12 @@ if [ -d /Applications ] && [ -d /Library ] && [ -z "$NO_RESTART" ]; then
     logg info 'Reboot required - shutting down immediately' && sudo shutdown -r now
     # TODO - Automatically log in after reboot
   fi
-  if command -v gsed > /dev/null; then
-    sudo gsed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
-  else
-    sudo sed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
+  if [ -f "$HOME/.zshrc" ]; then
+    if command -v gsed > /dev/null; then
+      sudo gsed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
+    else
+      sudo sed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
+    fi
   fi
 fi
 
diff --git a/home/.chezmoiscripts/universal/run_onchange_after_03-macos-headless.sh.tmpl b/home/.chezmoiscripts/universal/run_onchange_after_03-macos-headless.sh.tmpl
index c4239d3b..c56ce343 100644
--- a/home/.chezmoiscripts/universal/run_onchange_after_03-macos-headless.sh.tmpl
+++ b/home/.chezmoiscripts/universal/run_onchange_after_03-macos-headless.sh.tmpl
@@ -18,8 +18,10 @@ if [ -n "$HEADLESS_INSTALL" ] && [ -z "$SSH_CONNECTION" ] && [ -d /System ] && [
     # Source: https://developers.cloudflare.com/cloudflare-one/static/documentation/connections/Cloudflare_CA.pem
     ### Ensure certificate installed on macOS
     logg info '**macOS Manual Security Permission** Requesting security authorization for Cloudflare trusted certificate'
-    sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "$HOME/.local/etc/ssl/cloudflare/Cloudflare_CA.crt"
-
+    CRT_TMP="$(mktemp)"
+    curl -sSL https://developers.cloudflare.com/cloudflare-one/static/documentation/connections/Cloudflare_CA.crt > "$CRT_TMP"
+    sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "$CRT_TMP" && logg success 'Successfully imported Cloudflare_CA.crt into System.keychain'
+    rm -f "$CRT_TMP"
     # Source: https://apple.stackexchange.com/questions/30238/how-to-enable-os-x-screen-sharing-vnc-through-ssh
     # To disable, run: sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off
     # Only enable when computer is not a corporate / work computer