diff --git a/.forgejo/workflows/dev-bakery.yml b/.forgejo/workflows/dev-bakery.yml
index f63769e..a7c4bde 100644
--- a/.forgejo/workflows/dev-bakery.yml
+++ b/.forgejo/workflows/dev-bakery.yml
@@ -8,6 +8,7 @@ on:
     branches: ['main']
     paths:
       - 'bakery/**'
+      - 'bread-utils/**'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - '.forgejo/workflows/dev-bakery.yml'
diff --git a/.forgejo/workflows/package.yml b/.forgejo/workflows/package.yml
index 6725e22..ca941f2 100644
--- a/.forgejo/workflows/package.yml
+++ b/.forgejo/workflows/package.yml
@@ -6,6 +6,9 @@ on:
 
 jobs:
   package:
+    # PKGBUILD pkgver cannot contain `-`; skip RC tags the same way
+    # release-bakery.yml does.
+    if: ${{ !contains(github.ref_name, '-rc.') }}
     runs-on: [self-hosted, hestia]
     container:
       image: archlinux:latest
diff --git a/.forgejo/workflows/rc-bakery.yml b/.forgejo/workflows/rc-bakery.yml
index dc7f695..d4e7853 100644
--- a/.forgejo/workflows/rc-bakery.yml
+++ b/.forgejo/workflows/rc-bakery.yml
@@ -7,11 +7,9 @@ name: beta (rc) bakery
 on:
   push:
     tags: ['v*']
-    paths:
-      - 'bakery/**'
-      - 'Cargo.toml'
-      - 'Cargo.lock'
-      - '.forgejo/workflows/beta-bakery.yml'
+    # No paths: filter. Tag pushes compare against an unrelated commit and
+    # would skip the RC publish if bakery/** wasn't in that diff; the job
+    # `if: contains -rc.` is the real gate.
 
 jobs:
   build:
@@ -35,6 +33,7 @@ jobs:
         run: |
           set -euo pipefail
           VERSION="${GITHUB_REF_NAME#v}"
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
           PKG_DIR="/srv/breadway-dl/beta/bakery/${VERSION}"
           mkdir -p "${PKG_DIR}"
           cp "src/target/release/bakery" "${PKG_DIR}/bakery-x86_64"
diff --git a/.forgejo/workflows/rc-bread-theme.yml b/.forgejo/workflows/rc-bread-theme.yml
index c364ce6..bd53ba1 100644
--- a/.forgejo/workflows/rc-bread-theme.yml
+++ b/.forgejo/workflows/rc-bread-theme.yml
@@ -7,11 +7,9 @@ name: beta (rc) bread-theme
 on:
   push:
     tags: ['v*']
-    paths:
-      - 'bread-theme/**'
-      - 'Cargo.toml'
-      - 'Cargo.lock'
-      - '.forgejo/workflows/beta-bread-theme.yml'
+    # No paths: filter. Tag pushes compare against an unrelated commit and
+    # would skip the RC publish if bread-theme/** wasn't in that diff; the
+    # job `if: contains -rc.` is the real gate.
 
 jobs:
   build:
@@ -32,6 +30,7 @@ jobs:
         run: |
           set -euo pipefail
           VERSION="${GITHUB_REF_NAME#v}"
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
           PKG_DIR="/srv/breadway-dl/beta/bread-theme/${VERSION}"
           mkdir -p "${PKG_DIR}"
           cp "src/target/release/bread-theme" "${PKG_DIR}/bread-theme-x86_64"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index cb4d0e1..349d06b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -5,7 +5,9 @@ are `bakery` (the ecosystem package manager) and `bread-theme` (the shared
 theming crate). Shared crates that sibling apps pin — not bakery packages
 of their own — are `bread-utils`, `bread-app`, `bread-onnx`,
 `bread-screenshots`, and `bread-capture`. `bread-polkit` is an in-tree
-session agent, also not a bakery product. Other ecosystem products
+session agent: it has `bread-polkit/bakery.toml` so it *can* be published,
+but it is not in `registry/bread-ecosystem.toml` (unpublished — not on
+the bakery index, not on the BOS ISO). Other ecosystem products
 (`bread`, `breadbar`, `breadbox`, …) live in their own repos under
 `Breadway/` but follow the same workflow described here. The product list
 is `registry/bread-ecosystem.toml`. New GTK tools should depend on
diff --git a/Cargo.lock b/Cargo.lock
index feaba0f..0598260 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -145,7 +145,7 @@ dependencies = [
  "chrono",
  "clap",
  "clap_complete",
- "dirs",
+ "dirs 5.0.1",
  "fs4",
  "hex",
  "minisign-verify",
@@ -243,20 +243,21 @@ dependencies = [
 
 [[package]]
 name = "bread-shared"
-version = "0.7.0"
-source = "git+https://git.breadway.dev/Breadway/bread?tag=v0.7.0#22e34e2cf2202305d7960759dfccb54dc79f948b"
+version = "0.8.0"
+source = "git+https://git.breadway.dev/Breadway/bread?tag=v0.8.0#cdd5de8f58e437b3fc6d9b9087eb7b3d0fd09704"
 dependencies = [
- "dirs",
+ "dirs 6.0.0",
  "serde",
  "serde_json",
  "toml 0.8.23",
+ "uuid",
 ]
 
 [[package]]
 name = "bread-theme"
 version = "0.7.4"
 dependencies = [
- "dirs",
+ "dirs 5.0.1",
  "gtk4",
  "libadwaita",
  "serde",
@@ -268,7 +269,7 @@ name = "bread-utils"
 version = "0.7.4"
 dependencies = [
  "bread-shared",
- "dirs",
+ "dirs 5.0.1",
  "gtk4",
  "gtk4-layer-shell",
  "serde",
@@ -610,7 +611,16 @@ version = "5.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
 dependencies = [
- "dirs-sys",
+ "dirs-sys 0.4.1",
+]
+
+[[package]]
+name = "dirs"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
+dependencies = [
+ "dirs-sys 0.5.0",
 ]
 
 [[package]]
@@ -621,10 +631,22 @@ checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
 dependencies = [
  "libc",
  "option-ext",
- "redox_users",
+ "redox_users 0.4.6",
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users 0.5.2",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.6"
@@ -1966,6 +1988,17 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
+[[package]]
+name = "redox_users"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "regex"
 version = "1.13.1"
@@ -2703,6 +2736,7 @@ version = "1.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
 dependencies = [
+ "getrandom 0.4.3",
  "js-sys",
  "serde_core",
  "wasm-bindgen",
diff --git a/README.md b/README.md
index 34ccf27..927c629 100644
--- a/README.md
+++ b/README.md
@@ -153,7 +153,7 @@ bread-ecosystem/
 ├── bread-theme/         # shared pywal + fixed-dark-base theming crate
 ├── bread-utils/         # shared plumbing (Hyprland IPC, singleton, XDG, BreadClient, …)
 ├── bread-app/           # GTK bootstrap new tools should use (app id, singleton, overlay, command listen)
-├── bread-polkit/        # themed PolicyKit authentication agent (not a bakery product)
+├── bread-polkit/        # themed PolicyKit agent (bakery.toml present; unpublished)
 ├── bread-onnx/          # shared ONNX runtime helpers
 ├── bread-screenshots/   # grim capture primitive used by app `--screenshot` modes
 ├── bread-capture/       # orchestrator that drives those `--screenshot` modes
@@ -179,8 +179,10 @@ tree; `bread-polkit` is the first in-tree consumer.
 ### bread-polkit
 
 A session PolicyKit authentication agent (password prompt, cancel,
-identity). Not a wrapper around `polkit-gnome`. Not published via bakery
-and not on the BOS ISO lockfile.
+identity). Not a wrapper around `polkit-gnome`. `bread-polkit/bakery.toml`
+exists so it can be published via bakery; it is not in
+`registry/bread-ecosystem.toml` and is therefore unpublished — not on the
+bakery index and not on the BOS ISO lockfile.
 
 ```sh
 cargo run -p bread-polkit
diff --git a/bread-polkit/bakery.toml b/bread-polkit/bakery.toml
new file mode 100644
index 0000000..4dd8e44
--- /dev/null
+++ b/bread-polkit/bakery.toml
@@ -0,0 +1,11 @@
+name = "bread-polkit"
+description = "Themed PolicyKit authentication agent for the bread desktop"
+binaries = ["bread-polkit"]
+system_deps = ["gtk4", "gtk4-layer-shell", "polkit"]
+optional_system_deps = ["hyprland"]
+bread_deps = []
+license_file = "LICENSE"
+desktop_file = "bread-polkit.desktop"
+
+[install]
+post_install = []
diff --git a/bread-theme/src/lib.rs b/bread-theme/src/lib.rs
index f280027..2111c17 100644
--- a/bread-theme/src/lib.rs
+++ b/bread-theme/src/lib.rs
@@ -32,6 +32,13 @@ pub mod tokens {
     pub const RADIUS_PILL: u16 = 999;
 }
 
+/// CSS `font-family` list: quote the named face, leave the generic fallback
+/// unquoted. Wrapping [`tokens::FONT_FAMILY`] in one pair of quotes would
+/// make a single family named "Varela Round, sans-serif" and drop sans-serif.
+fn css_font_family() -> &'static str {
+    "'Varela Round', sans-serif"
+}
+
 /// Emit the `@define-color` block that all bread apps use, plus the shared
 /// font rule.
 ///
@@ -47,9 +54,9 @@ pub mod tokens {
 /// one color-block implementation and it cannot drift again.
 pub fn css_vars(p: &Palette) -> String {
     format!(
-        "{vars}* {{ font-family: '{font}'; font-size: {size}px; }}\n",
+        "{vars}* {{ font-family: {font}; font-size: {size}px; }}\n",
         vars = define_colors(p),
-        font = tokens::FONT_FAMILY,
+        font = css_font_family(),
         size = tokens::FONT_SIZE_BASE,
     )
 }
@@ -144,7 +151,7 @@ pub fn css_tokens() -> String {
     use tokens::*;
     format!(
         ":root {{\n\
-         \x20\x20--font-family: '{font}';\n\
+         \x20\x20--font-family: {font};\n\
          \x20\x20--font-size-base: {base}px;\n\
          \x20\x20--font-size-secondary: {sec}px;\n\
          \x20\x20--space-xs: {xs}px;\n\
@@ -157,7 +164,7 @@ pub fn css_tokens() -> String {
          \x20\x20--radius-tertiary: {r3}px;\n\
          \x20\x20--radius-pill: {pill}px;\n\
          }}\n",
-        font = FONT_FAMILY,
+        font = css_font_family(),
         base = FONT_SIZE_BASE,
         sec = FONT_SIZE_SECONDARY,
         xs = SPACE_XS,
@@ -182,7 +189,7 @@ pub fn stylesheet(p: &Palette) -> String {
     use tokens::*;
     format!(
         "{vars}\
-         * {{ font-family: '{font}'; font-size: {base}px; }}\n\
+         * {{ font-family: {font}; font-size: {base}px; }}\n\
          /* Colour is set on containers; labels inherit it, so text on any panel,\
             button, or accent is always the legible ink for that background. Bare\
             `label {{ color }}` is deliberately avoided — as a type selector it\
@@ -265,7 +272,7 @@ pub fn stylesheet(p: &Palette) -> String {
          textview, .mono {{ font-family: monospace; }}\n\
          textview text {{ background-color: @surface; color: @on-surface; }}\n",
         vars = define_colors(p),
-        font = FONT_FAMILY,
+        font = css_font_family(),
         base = FONT_SIZE_BASE,
         sec = FONT_SIZE_SECONDARY,
         xs = SPACE_XS, sm = SPACE_SM, md = SPACE_MD, lg = SPACE_LG,
@@ -342,7 +349,11 @@ mod tests {
     #[test]
     fn css_vars_contains_font_rule() {
         let css = css_vars(&Palette::default());
-        assert!(css.contains("Varela Round"));
+        assert!(css.contains("font-family: 'Varela Round', sans-serif;"));
+        assert!(
+            !css.contains("font-family: 'Varela Round, sans-serif'"),
+            "named face and generic fallback must not be one quoted family"
+        );
         assert!(css.contains("14px"));
     }
 
@@ -413,7 +424,11 @@ mod tests {
         ] {
             assert!(css.contains(sel), "stylesheet missing selector: {sel}");
         }
-        assert!(css.contains("Varela Round"));
+        assert!(css.contains("font-family: 'Varela Round', sans-serif;"));
+        assert!(
+            !css.contains("font-family: 'Varela Round, sans-serif'"),
+            "named face and generic fallback must not be one quoted family"
+        );
     }
 
     #[test]
@@ -445,7 +460,11 @@ mod tests {
     #[test]
     fn css_tokens_contains_font_and_spacing_vars() {
         let css = css_tokens();
-        assert!(css.contains("--font-family: 'Varela Round, sans-serif';"));
+        assert!(css.contains("--font-family: 'Varela Round', sans-serif;"));
+        assert!(
+            !css.contains("--font-family: 'Varela Round, sans-serif'"),
+            "named face and generic fallback must not be one quoted family"
+        );
         assert!(css.contains("--font-size-base: 14px;"));
         assert!(css.contains("--space-md: 12px;"));
         assert!(css.contains("--radius-pill: 999px;"));
diff --git a/bread-utils/Cargo.toml b/bread-utils/Cargo.toml
index 69e2172..a0ab6c2 100644
--- a/bread-utils/Cargo.toml
+++ b/bread-utils/Cargo.toml
@@ -15,7 +15,7 @@ dirs = { workspace = true }
 gtk4 = { version = "0.11", features = ["v4_12"], optional = true }
 gtk4-layer-shell = { version = "0.8", optional = true }
 toml_edit = { version = "0.22", optional = true }
-bread-shared = { git = "https://git.breadway.dev/Breadway/bread", tag = "v0.7.0", optional = true }
+bread-shared = { git = "https://git.breadway.dev/Breadway/bread", tag = "v0.8.0", optional = true }
 
 [features]
 # Enable the layer-shell popup scaffold (breadbox, breadclip). Kept optional