diff --git a/config/atuin/config.toml b/config/atuin/config.toml
new file mode 100644
index 0000000..a96e69d
--- /dev/null
+++ b/config/atuin/config.toml
@@ -0,0 +1,21 @@
+# Sync settings
+auto_sync = true
+sync_frequency = "5m"
+sync_address = "https://api.atuin.sh"
+
+# Search behavior
+search_mode = "fuzzy"
+filter_mode = "global"
+filter_mode_shell_up_key_binding = "host"
+
+# UI
+style = "auto"
+show_preview = true
+enter_accept = true
+inline_height = 0
+
+# Security: filter secrets from history
+secrets_filter = true
+
+[sync]
+records = true
diff --git a/config/zsh/zshrc b/config/zsh/zshrc
index 9b05004..f4a166e 100644
--- a/config/zsh/zshrc
+++ b/config/zsh/zshrc
@@ -56,6 +56,9 @@ if [[ -o interactive ]]; then
     elif command -v fzf &> /dev/null; then
         eval "$(fzf --zsh)"
     fi
+
+    # Atuin (shell history sync)
+    command -v atuin &> /dev/null && eval "$(atuin init zsh)"
 fi
 
 # ============================================================================
diff --git a/platforms/macos/bundles/core/setup.sh b/platforms/macos/bundles/core/setup.sh
index a8457e3..1be15e3 100755
--- a/platforms/macos/bundles/core/setup.sh
+++ b/platforms/macos/bundles/core/setup.sh
@@ -55,5 +55,32 @@ fi
 ## Restore file-type licenses (auto-import only)
 "$DOTFILES_DIR/scripts/licenses" --auto --bundle "$BUNDLE_NAME"
 
+## Atuin first-time setup (register or login for history sync)
+if command -v atuin &>/dev/null && [[ ! -f "$HOME/.local/share/atuin/key" ]]; then
+    echo ""
+    echo "Atuin shell history sync setup..."
+    echo "  Options: register (new account) or login (existing account)"
+    echo -n "  Setup atuin sync? [r]egister/[l]ogin/[s]kip: "
+    read -r atuin_choice < /dev/tty
+    case "$atuin_choice" in
+        r|R|register)
+            atuin register
+            echo ""
+            echo "Importing existing shell history..."
+            atuin import auto
+            atuin sync
+            ;;
+        l|L|login)
+            atuin login
+            echo ""
+            echo "Syncing history from server..."
+            atuin sync
+            ;;
+        *)
+            echo "  Skipped. Run 'atuin register' or 'atuin login' later."
+            ;;
+    esac
+fi
+
 echo ""
 echo "Core setup complete!"
diff --git a/platforms/macos/bundles/work/config/atuin/config.toml b/platforms/macos/bundles/work/config/atuin/config.toml
new file mode 100644
index 0000000..7233cec
--- /dev/null
+++ b/platforms/macos/bundles/work/config/atuin/config.toml
@@ -0,0 +1,25 @@
+# Sync settings
+auto_sync = true
+sync_frequency = "5m"
+sync_address = "https://api.atuin.sh"
+
+# Search behavior
+search_mode = "fuzzy"
+filter_mode = "host"
+filter_mode_shell_up_key_binding = "host"
+
+# UI
+style = "auto"
+show_preview = true
+enter_accept = true
+inline_height = 0
+
+# Security: filter secrets from history
+secrets_filter = true
+
+# Restrict filter modes to prevent cross-host history exposure
+[search]
+filters = ["host", "session", "workspace", "directory"]
+
+[sync]
+records = true
diff --git a/scripts/secrets b/scripts/secrets
index 856de05..2e41922 100755
--- a/scripts/secrets
+++ b/scripts/secrets
@@ -844,6 +844,7 @@ cmd_env() {
 cmd_backup() {
     local do_ssh=false
     local do_gpg=false
+    local do_atuin=false
     local dir=""
 
     # Parse arguments
@@ -851,16 +852,18 @@ cmd_backup() {
         case $1 in
             --ssh) do_ssh=true; shift ;;
             --gpg) do_gpg=true; shift ;;
+            --atuin) do_atuin=true; shift ;;
             --dir) dir="$2"; shift 2 ;;
             --help|-h)
-                echo "Usage: secrets.sh backup [--ssh] [--gpg] [--dir <path>]"
+                echo "Usage: secrets.sh backup [--ssh] [--gpg] [--atuin] [--dir <path>]"
                 echo ""
                 echo "Options:"
                 echo "  --ssh       Backup SSH keys only"
                 echo "  --gpg       Backup GPG keys only (requires cloud)"
+                echo "  --atuin     Backup Atuin encryption key only"
                 echo "  --dir PATH  Cloud storage location (shorthand or path)"
                 echo ""
-                echo "If no --ssh or --gpg specified, backs up both."
+                echo "If no --ssh, --gpg, or --atuin specified, backs up all."
                 echo ""
                 show_cloud_shorthands
                 exit 0
@@ -869,10 +872,11 @@ cmd_backup() {
         esac
     done
 
-    # If neither specified, do both
-    if [[ "$do_ssh" == false && "$do_gpg" == false ]]; then
+    # If none specified, do all
+    if [[ "$do_ssh" == false && "$do_gpg" == false && "$do_atuin" == false ]]; then
         do_ssh=true
         do_gpg=true
+        do_atuin=true
     fi
 
     # Expand shorthand
@@ -997,7 +1001,25 @@ cmd_backup() {
     # Backup GPG
     if [[ "$do_gpg" == true ]]; then
         backup_gpg
+        echo ""
+    fi
+
+    # Backup Atuin
+    if [[ "$do_atuin" == true ]]; then
+        backup_atuin
+    fi
+}
+
+backup_atuin() {
+    echo "Backing up Atuin encryption key..."
+    local atuin_key="$HOME/.local/share/atuin/key"
+    if [[ ! -f "$atuin_key" ]]; then
+        echo "  No Atuin key found (not registered?)"
+        return 0
     fi
+    mkdir -p "$SECRETS_DIR/atuin"
+    cmd_encrypt_raw "$atuin_key" "$SECRETS_DIR/atuin/key.age"
+    echo "Atuin backup complete."
 }
 
 ## Restore command
@@ -1005,6 +1027,7 @@ cmd_backup() {
 cmd_restore() {
     local do_ssh=false
     local do_gpg=false
+    local do_atuin=false
     local dir=""
 
     # Parse arguments
@@ -1012,16 +1035,18 @@ cmd_restore() {
         case $1 in
             --ssh) do_ssh=true; shift ;;
             --gpg) do_gpg=true; shift ;;
+            --atuin) do_atuin=true; shift ;;
             --dir) dir="$2"; shift 2 ;;
             --help|-h)
-                echo "Usage: secrets.sh restore [--ssh] [--gpg] [--dir <path>]"
+                echo "Usage: secrets.sh restore [--ssh] [--gpg] [--atuin] [--dir <path>]"
                 echo ""
                 echo "Options:"
                 echo "  --ssh       Restore SSH keys only"
                 echo "  --gpg       Restore GPG keys only"
+                echo "  --atuin     Restore Atuin encryption key only"
                 echo "  --dir PATH  Cloud storage location (shorthand or path)"
                 echo ""
-                echo "If no --ssh or --gpg specified, restores both."
+                echo "If no --ssh, --gpg, or --atuin specified, restores all."
                 echo ""
                 show_cloud_shorthands
                 exit 0
@@ -1030,10 +1055,11 @@ cmd_restore() {
         esac
     done
 
-    # If neither specified, do both
-    if [[ "$do_ssh" == false && "$do_gpg" == false ]]; then
+    # If none specified, do all
+    if [[ "$do_ssh" == false && "$do_gpg" == false && "$do_atuin" == false ]]; then
         do_ssh=true
         do_gpg=true
+        do_atuin=true
     fi
 
     # Expand shorthand
@@ -1177,6 +1203,24 @@ cmd_restore() {
     if [[ "$do_gpg" == true ]]; then
         restore_gpg
     fi
+
+    # Restore Atuin
+    if [[ "$do_atuin" == true ]]; then
+        restore_atuin
+    fi
+}
+
+restore_atuin() {
+    echo "Restoring Atuin encryption key..."
+    local atuin_age="$SECRETS_DIR/atuin/key.age"
+    if [[ ! -f "$atuin_age" ]]; then
+        echo "  No Atuin key found in secrets/atuin/"
+        return 0
+    fi
+    mkdir -p "$HOME/.local/share/atuin"
+    cmd_decrypt_raw "$atuin_age" "$HOME/.local/share/atuin/key"
+    chmod 600 "$HOME/.local/share/atuin/key"
+    echo "Atuin encryption key restored."
 }
 
 ## Reset command