diff --git a/ansible.cfg b/ansible.cfg
index 5db6cc0..0671520 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -2,3 +2,5 @@
 inventory = inventory.yml
 roles_path = roles
 lookup_plugins = lookup_plugins
+forks = 5
+strategy = free
\ No newline at end of file
diff --git a/full.yml b/full.yml
index ba045e1..4410340 100644
--- a/full.yml
+++ b/full.yml
@@ -12,6 +12,7 @@
   hosts: musikserverwohnzimmeroben
   roles:
     - unattended_upgrades
+    - pi_modern_shell_env
     - pi_standard_setup
     - pi_hifiberry_amp
     - pi_squeezelite_custom
@@ -24,6 +25,7 @@
   hosts: kitchenpi
   roles:
     - unattended_upgrades
+    - pi_modern_shell_env
     - pi_standard_setup
     - pi_hifiberry_amp
     - pi_squeezelite_custom
@@ -37,6 +39,7 @@
   hosts: bedroompi
   roles:
     - unattended_upgrades
+    - pi_modern_shell_env
     - pi_standard_setup
     - pi_squeezelite_custom
     - pi_shairport
@@ -49,6 +52,7 @@
   hosts: musicmouse
   roles:
     - unattended_upgrades
+    - pi_modern_shell_env
     - pi_standard_setup
     - pi_hifiberry_amp
     - pi_musicmouse
diff --git a/roles/pi_modern_shell_env/README.md b/roles/pi_modern_shell_env/README.md
new file mode 100644
index 0000000..e0d42f9
--- /dev/null
+++ b/roles/pi_modern_shell_env/README.md
@@ -0,0 +1,14 @@
+# pi_modern_shell_env
+
+Installs modern CLI tooling (fish, ripgrep, fd, bat, fzf, zoxide, lsd,
+tmux) plus a starship prompt for the login user on `iot` Pi hosts, and
+makes fish the default login shell. Purely a convenience layer for
+interactive SSH sessions into otherwise single-purpose appliance boxes —
+does not affect any of the audio/sensor services these hosts run.
+
+**Key vars:**
+
+- `pi_modern_shell_env_target_user` — user to configure (defaults to
+  `main_user`, falling back to `root`).
+- `pi_modern_shell_env_set_default_shell` — whether to `chsh` the target
+  user to fish (default `true`).
diff --git a/roles/pi_modern_shell_env/defaults/main.yml b/roles/pi_modern_shell_env/defaults/main.yml
new file mode 100644
index 0000000..8fff01e
--- /dev/null
+++ b/roles/pi_modern_shell_env/defaults/main.yml
@@ -0,0 +1,23 @@
+---
+# Debian names these bat/fd-find, and ships the binaries as batcat/fdfind
+# to avoid clashing with other packages — symlinked to bat/fd below.
+pi_modern_shell_env_packages:
+  - fish
+  - ripgrep
+  - fd-find
+  - bat
+  - fzf
+  - zoxide
+  - lsd
+  - tmux
+  - curl
+
+# Bookworm's apt coverage for starship is inconsistent across releases/
+# arches, so it's installed via the official install script instead.
+pi_modern_shell_env_starship_install_url: https://starship.rs/install.sh
+
+pi_modern_shell_env_target_user: "{{ main_user | default('root') }}"
+
+# Off switch for anyone who wants the tools installed without disrupting
+# their existing login shell.
+pi_modern_shell_env_set_default_shell: true
diff --git a/roles/pi_modern_shell_env/tasks/main.yml b/roles/pi_modern_shell_env/tasks/main.yml
new file mode 100644
index 0000000..67d290f
--- /dev/null
+++ b/roles/pi_modern_shell_env/tasks/main.yml
@@ -0,0 +1,59 @@
+---
+- name: Install modern CLI packages
+  ansible.builtin.apt:
+    name: "{{ pi_modern_shell_env_packages }}"
+    state: present
+    update_cache: true
+
+- name: Symlink fdfind to fd
+  ansible.builtin.file:
+    src: /usr/bin/fdfind
+    dest: /usr/local/bin/fd
+    state: link
+
+- name: Symlink batcat to bat
+  ansible.builtin.file:
+    src: /usr/bin/batcat
+    dest: /usr/local/bin/bat
+    state: link
+
+- name: Download starship install script
+  ansible.builtin.get_url:
+    url: "{{ pi_modern_shell_env_starship_install_url }}"
+    dest: /tmp/starship-install.sh
+    mode: "0755"
+
+- name: Run starship install script
+  ansible.builtin.command:
+    cmd: /tmp/starship-install.sh --yes
+    creates: /usr/local/bin/starship
+
+- name: Determine target user's home directory
+  ansible.builtin.set_fact:
+    pi_modern_shell_env_target_home: "{{ '/root' if pi_modern_shell_env_target_user == 'root' else '/home/' + pi_modern_shell_env_target_user }}"
+
+- name: Ensure fish config directory exists
+  ansible.builtin.file:
+    path: "{{ pi_modern_shell_env_target_home }}/.config/fish"
+    state: directory
+    owner: "{{ pi_modern_shell_env_target_user }}"
+    mode: "0700"
+
+- name: Deploy fish config
+  ansible.builtin.template:
+    src: config.fish.j2
+    dest: "{{ pi_modern_shell_env_target_home }}/.config/fish/config.fish"
+    owner: "{{ pi_modern_shell_env_target_user }}"
+    mode: "0644"
+
+- name: Ensure fish is a known login shell
+  ansible.builtin.lineinfile:
+    path: /etc/shells
+    line: /usr/bin/fish
+    state: present
+
+- name: Set fish as the default login shell
+  ansible.builtin.user:
+    name: "{{ pi_modern_shell_env_target_user }}"
+    shell: /usr/bin/fish
+  when: pi_modern_shell_env_set_default_shell
diff --git a/roles/pi_modern_shell_env/templates/config.fish.j2 b/roles/pi_modern_shell_env/templates/config.fish.j2
new file mode 100644
index 0000000..89cac5c
--- /dev/null
+++ b/roles/pi_modern_shell_env/templates/config.fish.j2
@@ -0,0 +1,7 @@
+{{ ansible_managed | comment }}
+
+starship init fish | source
+
+abbr --add ls lsd
+abbr --add ll 'lsd -l'
+abbr --add la 'lsd -la'
diff --git a/roles/pi_standard_setup/tasks/main.yml b/roles/pi_standard_setup/tasks/main.yml
index 159ef08..706cdd8 100644
--- a/roles/pi_standard_setup/tasks/main.yml
+++ b/roles/pi_standard_setup/tasks/main.yml
@@ -27,6 +27,11 @@
     regexp: "^#?AcceptEnv LANG LC_*"
     line: "#AcceptEnv LANG LC_*"
   notify: Restart sshd
+- name: Remove first-run "SSH may not work until a valid user has been set up" banner
+  ansible.builtin.file:
+    path: /etc/ssh/sshd_config.d/rename_user.conf
+    state: absent
+  notify: Restart sshd
 - name: Get hostname
   ansible.builtin.command: "raspi-config nonint get_hostname"
   register: pi_standard_setup_pi_hostname