diff --git a/modules/user/dotfiles.sh b/modules/user/dotfiles.sh
index 19a5324..91b44bf 100755
--- a/modules/user/dotfiles.sh
+++ b/modules/user/dotfiles.sh
@@ -17,8 +17,34 @@ if [[ ! -d "$HOME/.config" ]]; then
     mkdir -p "$HOME/.config"
 fi
 
+# --- Install the cfg command, ALWAYS (even if the repo exists already) ---
+# The alias lives in ~/.bash_aliases (user-owned, trackable in fedora-dots),
+# and ~/.bashrc sources that file. Without this, `cfg` exists only on the
+# machine where it was typed by hand (VM-proven: "cfg pull: command not found").
+ALIASES_FILE="$HOME/.bash_aliases"
+BASHRC="$HOME/.bashrc"
+
+if ! grep -q "alias cfg=" "$ALIASES_FILE" 2>/dev/null; then
+    info "Installing cfg alias into ~/.bash_aliases..."
+    cat >> "$ALIASES_FILE" <<'EOF'
+# cfg: manage the bare dotfiles repo (~/.cfg.git, work tree $HOME)
+alias cfg='git --git-dir=$HOME/.cfg.git --work-tree=$HOME'
+EOF
+fi
+
+if ! grep -q "bash_aliases" "$BASHRC" 2>/dev/null; then
+    info "Making ~/.bashrc load ~/.bash_aliases..."
+    touch "$BASHRC"
+    cat >> "$BASHRC" <<'EOF'
+
+# user aliases
+if [ -f ~/.bash_aliases ]; then . ~/.bash_aliases; fi
+EOF
+fi
+
 if [[ -d "$CFG_DIR" ]]; then
-    ok "Dotfiles already set up ($CFG_DIR exists). Skipping."
+    ok "Dotfiles already set up ($CFG_DIR exists)."
+    ok "cfg alias ensured. Open a new shell or run: source ~/.bashrc"
     exit 0
 fi