diff --git a/home/pay.nix b/home/pay.nix
index 2c4f884..6010701 100644
--- a/home/pay.nix
+++ b/home/pay.nix
@@ -7,6 +7,8 @@
   stdenv,
   fetchurl,
   lib,
+  autoPatchelfHook,
+  openssl,
   system ? builtins.currentSystem,
 }:
 let
@@ -31,7 +33,7 @@ let
       };
       "x86_64-linux" = {
         name = "pay-x86_64-unknown-linux-gnu.tar.gz";
-        hash = lib.fakeSha256; # fill if needed
+          hash = "1vyf5pw4j7phyffa1aw66ms2j3r983qjj47wlsiyi0sdmwvzy9pi";
       };
     }
     .${system} or (throw "pay: no prebuilt binary for system ${system}");
@@ -49,6 +51,9 @@ stdenv.mkDerivation {
   sourceRoot = ".";
 
   # tarball contains a single prebuilt `pay` binary at its root.
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = [ openssl stdenv.cc.cc.lib ];
+
   dontConfigure = true;
   dontBuild = true;
 
diff --git a/home/server.nix b/home/server.nix
index 4be827c..0e030f9 100644
--- a/home/server.nix
+++ b/home/server.nix
@@ -7,11 +7,35 @@
 {
   home.stateVersion = "25.11";
 
-  # Expose pi only; do not add the whole npm global bin (which also contains pi-web).
+  # User-level tools installed outside Nix (PinchTab, pi wrapper, etc.).
   home.sessionPath = [
     "${config.home.homeDirectory}/.local/bin"
+    "${config.home.homeDirectory}/.local/libexec"
   ];
 
+  # Keep the browser control plane alive across SSH logout and reboots.
+  # PinchTab itself is installed outside Nix because its upstream release
+  # binary is dynamically linked; the local NixOS-compatible build lives in
+  # ~/.local/libexec/pinchtab.
+  systemd.user.services.pinchtab = {
+    Unit = {
+      Description = "PinchTab browser control plane";
+      After = [ "dbus-broker.service" ];
+    };
+    Service = {
+      ExecStart = "%h/.local/libexec/pinchtab server";
+      Restart = "on-failure";
+      RestartSec = 5;
+      Environment = [
+        "HOME=%h"
+        "PATH=/run/current-system/sw/bin:/home/mikl/.npm-global/bin:/home/mikl/.local/bin:/home/mikl/.local/libexec"
+      ];
+    };
+    Install = {
+      WantedBy = [ "default.target" ];
+    };
+  };
+
   home.file.".local/bin/pi" = {
     executable = true;
     text = ''
@@ -39,6 +63,7 @@
 
     # Git
     git
+    tea             # Forgejo/Gitea CLI
 
     # Nix
     alejandra       # форматтер
@@ -47,6 +72,9 @@
     # Утилиты
     delta           # красивый git diff
     trash-cli       # rm с корзиной
+
+    # x402 / MPP agentic payments CLI (Solana Foundation)
+    (pkgs.callPackage ./pay.nix {})
   ];
 
   # --- FZF ---
diff --git a/hosts/heather/default.nix b/hosts/heather/default.nix
index eda8b5f..0120156 100644
--- a/hosts/heather/default.nix
+++ b/hosts/heather/default.nix
@@ -28,7 +28,11 @@
 
   # First server-to-server WireGuard backbone link: heather ↔ hyacinth.
   # The private key is generated on the live host and stays outside the flake.
-  environment.systemPackages = [ pkgs.wireguard-tools ];
+  # Chromium для PinchTab: отдельный headless-браузер для agent automation.
+  environment.systemPackages = [
+    pkgs.wireguard-tools
+    pkgs.chromium
+  ];
 
   # NixOS uses scripted networking here (not systemd-networkd), so create the
   # dummy identity interface through a small idempotent systemd unit.