diff --git a/.forgejo/workflows/dev-bakery.yml b/.forgejo/workflows/dev-bakery.yml
index a7c4bde..f63769e 100644
--- a/.forgejo/workflows/dev-bakery.yml
+++ b/.forgejo/workflows/dev-bakery.yml
@@ -8,7 +8,6 @@ on:
     branches: ['main']
     paths:
       - 'bakery/**'
-      - 'bread-utils/**'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - '.forgejo/workflows/dev-bakery.yml'
diff --git a/.forgejo/workflows/package.yml b/.forgejo/workflows/package.yml
index ca941f2..6725e22 100644
--- a/.forgejo/workflows/package.yml
+++ b/.forgejo/workflows/package.yml
@@ -6,9 +6,6 @@ on:
 
 jobs:
   package:
-    # PKGBUILD pkgver cannot contain `-`; skip RC tags the same way
-    # release-bakery.yml does.
-    if: ${{ !contains(github.ref_name, '-rc.') }}
     runs-on: [self-hosted, hestia]
     container:
       image: archlinux:latest
diff --git a/.forgejo/workflows/rc-bakery.yml b/.forgejo/workflows/rc-bakery.yml
index d4e7853..dc7f695 100644
--- a/.forgejo/workflows/rc-bakery.yml
+++ b/.forgejo/workflows/rc-bakery.yml
@@ -7,9 +7,11 @@ name: beta (rc) bakery
 on:
   push:
     tags: ['v*']
-    # No paths: filter. Tag pushes compare against an unrelated commit and
-    # would skip the RC publish if bakery/** wasn't in that diff; the job
-    # `if: contains -rc.` is the real gate.
+    paths:
+      - 'bakery/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.forgejo/workflows/beta-bakery.yml'
 
 jobs:
   build:
@@ -33,7 +35,6 @@ jobs:
         run: |
           set -euo pipefail
           VERSION="${GITHUB_REF_NAME#v}"
-          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
           PKG_DIR="/srv/breadway-dl/beta/bakery/${VERSION}"
           mkdir -p "${PKG_DIR}"
           cp "src/target/release/bakery" "${PKG_DIR}/bakery-x86_64"
diff --git a/.forgejo/workflows/rc-bread-theme.yml b/.forgejo/workflows/rc-bread-theme.yml
index bd53ba1..c364ce6 100644
--- a/.forgejo/workflows/rc-bread-theme.yml
+++ b/.forgejo/workflows/rc-bread-theme.yml
@@ -7,9 +7,11 @@ name: beta (rc) bread-theme
 on:
   push:
     tags: ['v*']
-    # No paths: filter. Tag pushes compare against an unrelated commit and
-    # would skip the RC publish if bread-theme/** wasn't in that diff; the
-    # job `if: contains -rc.` is the real gate.
+    paths:
+      - 'bread-theme/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.forgejo/workflows/beta-bread-theme.yml'
 
 jobs:
   build:
@@ -30,7 +32,6 @@ jobs:
         run: |
           set -euo pipefail
           VERSION="${GITHUB_REF_NAME#v}"
-          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
           PKG_DIR="/srv/breadway-dl/beta/bread-theme/${VERSION}"
           mkdir -p "${PKG_DIR}"
           cp "src/target/release/bread-theme" "${PKG_DIR}/bread-theme-x86_64"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 349d06b..cb4d0e1 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -5,9 +5,7 @@ are `bakery` (the ecosystem package manager) and `bread-theme` (the shared
 theming crate). Shared crates that sibling apps pin — not bakery packages
 of their own — are `bread-utils`, `bread-app`, `bread-onnx`,
 `bread-screenshots`, and `bread-capture`. `bread-polkit` is an in-tree
-session agent: it has `bread-polkit/bakery.toml` so it *can* be published,
-but it is not in `registry/bread-ecosystem.toml` (unpublished — not on
-the bakery index, not on the BOS ISO). Other ecosystem products
+session agent, also not a bakery product. Other ecosystem products
 (`bread`, `breadbar`, `breadbox`, …) live in their own repos under
 `Breadway/` but follow the same workflow described here. The product list
 is `registry/bread-ecosystem.toml`. New GTK tools should depend on
diff --git a/Cargo.lock b/Cargo.lock
index 0598260..feaba0f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -145,7 +145,7 @@ dependencies = [
  "chrono",
  "clap",
  "clap_complete",
- "dirs 5.0.1",
+ "dirs",
  "fs4",
  "hex",
  "minisign-verify",
@@ -243,21 +243,20 @@ dependencies = [
 
 [[package]]
 name = "bread-shared"
-version = "0.8.0"
-source = "git+https://git.breadway.dev/Breadway/bread?tag=v0.8.0#cdd5de8f58e437b3fc6d9b9087eb7b3d0fd09704"
+version = "0.7.0"
+source = "git+https://git.breadway.dev/Breadway/bread?tag=v0.7.0#22e34e2cf2202305d7960759dfccb54dc79f948b"
 dependencies = [
- "dirs 6.0.0",
+ "dirs",
  "serde",
  "serde_json",
  "toml 0.8.23",
- "uuid",
 ]
 
 [[package]]
 name = "bread-theme"
 version = "0.7.4"
 dependencies = [
- "dirs 5.0.1",
+ "dirs",
  "gtk4",
  "libadwaita",
  "serde",
@@ -269,7 +268,7 @@ name = "bread-utils"
 version = "0.7.4"
 dependencies = [
  "bread-shared",
- "dirs 5.0.1",
+ "dirs",
  "gtk4",
  "gtk4-layer-shell",
  "serde",
@@ -611,16 +610,7 @@ version = "5.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
 dependencies = [
- "dirs-sys 0.4.1",
-]
-
-[[package]]
-name = "dirs"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
-dependencies = [
- "dirs-sys 0.5.0",
+ "dirs-sys",
 ]
 
 [[package]]
@@ -631,22 +621,10 @@ checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
 dependencies = [
  "libc",
  "option-ext",
- "redox_users 0.4.6",
+ "redox_users",
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "dirs-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
-dependencies = [
- "libc",
- "option-ext",
- "redox_users 0.5.2",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "displaydoc"
 version = "0.2.6"
@@ -1988,17 +1966,6 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
-[[package]]
-name = "redox_users"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
-dependencies = [
- "getrandom 0.2.17",
- "libredox",
- "thiserror 2.0.18",
-]
-
 [[package]]
 name = "regex"
 version = "1.13.1"
@@ -2736,7 +2703,6 @@ version = "1.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
 dependencies = [
- "getrandom 0.4.3",
  "js-sys",
  "serde_core",
  "wasm-bindgen",
diff --git a/README.md b/README.md
index 927c629..34ccf27 100644
--- a/README.md
+++ b/README.md
@@ -153,7 +153,7 @@ bread-ecosystem/
 ├── bread-theme/         # shared pywal + fixed-dark-base theming crate
 ├── bread-utils/         # shared plumbing (Hyprland IPC, singleton, XDG, BreadClient, …)
 ├── bread-app/           # GTK bootstrap new tools should use (app id, singleton, overlay, command listen)
-├── bread-polkit/        # themed PolicyKit agent (bakery.toml present; unpublished)
+├── bread-polkit/        # themed PolicyKit authentication agent (not a bakery product)
 ├── bread-onnx/          # shared ONNX runtime helpers
 ├── bread-screenshots/   # grim capture primitive used by app `--screenshot` modes
 ├── bread-capture/       # orchestrator that drives those `--screenshot` modes
@@ -179,10 +179,8 @@ tree; `bread-polkit` is the first in-tree consumer.
 ### bread-polkit
 
 A session PolicyKit authentication agent (password prompt, cancel,
-identity). Not a wrapper around `polkit-gnome`. `bread-polkit/bakery.toml`
-exists so it can be published via bakery; it is not in
-`registry/bread-ecosystem.toml` and is therefore unpublished — not on the
-bakery index and not on the BOS ISO lockfile.
+identity). Not a wrapper around `polkit-gnome`. Not published via bakery
+and not on the BOS ISO lockfile.
 
 ```sh
 cargo run -p bread-polkit
diff --git a/bread-polkit/bakery.toml b/bread-polkit/bakery.toml
deleted file mode 100644
index 4dd8e44..0000000
--- a/bread-polkit/bakery.toml
+++ /dev/null
@@ -1,11 +0,0 @@
-name = "bread-polkit"
-description = "Themed PolicyKit authentication agent for the bread desktop"
-binaries = ["bread-polkit"]
-system_deps = ["gtk4", "gtk4-layer-shell", "polkit"]
-optional_system_deps = ["hyprland"]
-bread_deps = []
-license_file = "LICENSE"
-desktop_file = "bread-polkit.desktop"
-
-[install]
-post_install = []
diff --git a/bread-theme/src/lib.rs b/bread-theme/src/lib.rs
index 2111c17..f280027 100644
--- a/bread-theme/src/lib.rs
+++ b/bread-theme/src/lib.rs
@@ -32,13 +32,6 @@ pub mod tokens {
     pub const RADIUS_PILL: u16 = 999;
 }
 
-/// CSS `font-family` list: quote the named face, leave the generic fallback
-/// unquoted. Wrapping [`tokens::FONT_FAMILY`] in one pair of quotes would
-/// make a single family named "Varela Round, sans-serif" and drop sans-serif.
-fn css_font_family() -> &'static str {
-    "'Varela Round', sans-serif"
-}
-
 /// Emit the `@define-color` block that all bread apps use, plus the shared
 /// font rule.
 ///
@@ -54,9 +47,9 @@ fn css_font_family() -> &'static str {
 /// one color-block implementation and it cannot drift again.
 pub fn css_vars(p: &Palette) -> String {
     format!(
-        "{vars}* {{ font-family: {font}; font-size: {size}px; }}\n",
+        "{vars}* {{ font-family: '{font}'; font-size: {size}px; }}\n",
         vars = define_colors(p),
-        font = css_font_family(),
+        font = tokens::FONT_FAMILY,
         size = tokens::FONT_SIZE_BASE,
     )
 }
@@ -151,7 +144,7 @@ pub fn css_tokens() -> String {
     use tokens::*;
     format!(
         ":root {{\n\
-         \x20\x20--font-family: {font};\n\
+         \x20\x20--font-family: '{font}';\n\
          \x20\x20--font-size-base: {base}px;\n\
          \x20\x20--font-size-secondary: {sec}px;\n\
          \x20\x20--space-xs: {xs}px;\n\
@@ -164,7 +157,7 @@ pub fn css_tokens() -> String {
          \x20\x20--radius-tertiary: {r3}px;\n\
          \x20\x20--radius-pill: {pill}px;\n\
          }}\n",
-        font = css_font_family(),
+        font = FONT_FAMILY,
         base = FONT_SIZE_BASE,
         sec = FONT_SIZE_SECONDARY,
         xs = SPACE_XS,
@@ -189,7 +182,7 @@ pub fn stylesheet(p: &Palette) -> String {
     use tokens::*;
     format!(
         "{vars}\
-         * {{ font-family: {font}; font-size: {base}px; }}\n\
+         * {{ font-family: '{font}'; font-size: {base}px; }}\n\
          /* Colour is set on containers; labels inherit it, so text on any panel,\
             button, or accent is always the legible ink for that background. Bare\
             `label {{ color }}` is deliberately avoided — as a type selector it\
@@ -272,7 +265,7 @@ pub fn stylesheet(p: &Palette) -> String {
          textview, .mono {{ font-family: monospace; }}\n\
          textview text {{ background-color: @surface; color: @on-surface; }}\n",
         vars = define_colors(p),
-        font = css_font_family(),
+        font = FONT_FAMILY,
         base = FONT_SIZE_BASE,
         sec = FONT_SIZE_SECONDARY,
         xs = SPACE_XS, sm = SPACE_SM, md = SPACE_MD, lg = SPACE_LG,
@@ -349,11 +342,7 @@ mod tests {
     #[test]
     fn css_vars_contains_font_rule() {
         let css = css_vars(&Palette::default());
-        assert!(css.contains("font-family: 'Varela Round', sans-serif;"));
-        assert!(
-            !css.contains("font-family: 'Varela Round, sans-serif'"),
-            "named face and generic fallback must not be one quoted family"
-        );
+        assert!(css.contains("Varela Round"));
         assert!(css.contains("14px"));
     }
 
@@ -424,11 +413,7 @@ mod tests {
         ] {
             assert!(css.contains(sel), "stylesheet missing selector: {sel}");
         }
-        assert!(css.contains("font-family: 'Varela Round', sans-serif;"));
-        assert!(
-            !css.contains("font-family: 'Varela Round, sans-serif'"),
-            "named face and generic fallback must not be one quoted family"
-        );
+        assert!(css.contains("Varela Round"));
     }
 
     #[test]
@@ -460,11 +445,7 @@ mod tests {
     #[test]
     fn css_tokens_contains_font_and_spacing_vars() {
         let css = css_tokens();
-        assert!(css.contains("--font-family: 'Varela Round', sans-serif;"));
-        assert!(
-            !css.contains("--font-family: 'Varela Round, sans-serif'"),
-            "named face and generic fallback must not be one quoted family"
-        );
+        assert!(css.contains("--font-family: 'Varela Round, sans-serif';"));
         assert!(css.contains("--font-size-base: 14px;"));
         assert!(css.contains("--space-md: 12px;"));
         assert!(css.contains("--radius-pill: 999px;"));
diff --git a/bread-utils/Cargo.toml b/bread-utils/Cargo.toml
index a0ab6c2..69e2172 100644
--- a/bread-utils/Cargo.toml
+++ b/bread-utils/Cargo.toml
@@ -15,7 +15,7 @@ dirs = { workspace = true }
 gtk4 = { version = "0.11", features = ["v4_12"], optional = true }
 gtk4-layer-shell = { version = "0.8", optional = true }
 toml_edit = { version = "0.22", optional = true }
-bread-shared = { git = "https://git.breadway.dev/Breadway/bread", tag = "v0.8.0", optional = true }
+bread-shared = { git = "https://git.breadway.dev/Breadway/bread", tag = "v0.7.0", optional = true }
 
 [features]
 # Enable the layer-shell popup scaffold (breadbox, breadclip). Kept optional