diff --git a/hosts/pinwheel/modules/firefox/default.nix b/hosts/pinwheel/modules/firefox/default.nix
index 04e5122..6a2ec44 100644
--- a/hosts/pinwheel/modules/firefox/default.nix
+++ b/hosts/pinwheel/modules/firefox/default.nix
@@ -47,6 +47,19 @@ let
     '';
   };
 
+  # Links opened from work checkouts (e.g. `gcloud auth login` in a work
+  # devshell, which ships its own `gcloud`, or `gt`) go to the work profile.
+  # Used both as `$BROWSER` and as the default handler for `xdg-open`.
+  browser = pkgs.writeShellApplication {
+    name = "browser";
+    text = ''
+      case "$PWD/" in
+        "$HOME/code/work/"*) exec ${ff-work}/bin/ff-work "$@" ;;
+        *) exec ${ff-alex}/bin/ff-alex "$@" ;;
+      esac
+    '';
+  };
+
   sharedSettings = {
     "general.smoothScroll" = true;
     "apz.gtk.kinetic_scroll.enabled" = false;
@@ -101,21 +114,27 @@ in
           exec = "${ff-alex}/bin/ff-alex %U";
           terminal = false;
         };
+
+        browser = {
+          name = "browser";
+          exec = "${browser}/bin/browser %U";
+          terminal = false;
+        };
       };
 
       mimeApps = {
         enable = true;
 
         defaultApplications = {
-          "text/html" = "ff-alex.desktop";
-          "x-scheme-handler/http" = "ff-alex.desktop";
-          "x-scheme-handler/https" = "ff-alex.desktop";
-          "application/x-exension-htm" = "ff-alex.desktop";
-          "application/x-exension-html" = "ff-alex.desktop";
-          "application/x-exension-shtml" = "ff-alex.desktop";
-          "application/xhtml+xml" = "ff-alex.desktop";
-          "application/x-exension-xhtml" = "ff-alex.desktop";
-          "application/x-exension-xht" = "ff-alex.desktop";
+          "text/html" = "browser.desktop";
+          "x-scheme-handler/http" = "browser.desktop";
+          "x-scheme-handler/https" = "browser.desktop";
+          "application/x-exension-htm" = "browser.desktop";
+          "application/x-exension-html" = "browser.desktop";
+          "application/x-exension-shtml" = "browser.desktop";
+          "application/xhtml+xml" = "browser.desktop";
+          "application/x-exension-xhtml" = "browser.desktop";
+          "application/x-exension-xht" = "browser.desktop";
         };
       };
 
@@ -132,6 +151,6 @@ in
 
   environment.variables = {
     MOZ_ENABLE_WAYLAND = 1;
-    BROWSER = "${ff-alex}/bin/ff-alex $@";
+    BROWSER = "${browser}/bin/browser";
   };
 }
diff --git a/hosts/pinwheel/modules/work/default.nix b/hosts/pinwheel/modules/work/default.nix
index e5e5ff3..10cb83f 100644
--- a/hosts/pinwheel/modules/work/default.nix
+++ b/hosts/pinwheel/modules/work/default.nix
@@ -9,32 +9,6 @@ let
   gitEnabled = config.mod.git.enable;
   goEnabled = config.mod.go.enable;
   openvpnEnabled = config.mod.openvpn.enable;
-
-  xdg-open-work = pkgs.writeShellScriptBin "xdg-open" ''
-    exec ff-work "$@"
-  '';
-  graphite-cli = pkgs.symlinkJoin {
-    name = "graphite-cli";
-    paths = [ pkgs.graphite-cli ];
-    nativeBuildInputs = [ pkgs.makeWrapper ];
-    postBuild = ''
-      wrapProgram $out/bin/gt --prefix PATH : ${xdg-open-work}/bin
-    '';
-  };
-  # `gcloud auth login` opens the browser via python's `webbrowser`, which
-  # follows `$BROWSER` rather than `xdg-open`.
-  google-cloud-sdk = pkgs.symlinkJoin {
-    name = "google-cloud-sdk";
-    paths = [
-      (pkgs.google-cloud-sdk.withExtraComponents [
-        pkgs.google-cloud-sdk.components.gke-gcloud-auth-plugin
-      ])
-    ];
-    nativeBuildInputs = [ pkgs.makeWrapper ];
-    postBuild = ''
-      wrapProgram $out/bin/gcloud --set BROWSER ff-work
-    '';
-  };
 in
 {
   home-manager.users.alex = {
@@ -99,9 +73,11 @@ EOF
       ])
       pkgs.bashInteractive
 
-      google-cloud-sdk
+      (pkgs.google-cloud-sdk.withExtraComponents [
+        pkgs.google-cloud-sdk.components.gke-gcloud-auth-plugin
+      ])
 
-      graphite-cli
+      pkgs.graphite-cli
 
       pkgs.postman
       pkgs.grpcurl