diff --git a/README.md b/README.md
index f370412..dc03d76 100644
--- a/README.md
+++ b/README.md
@@ -107,9 +107,13 @@ rpm-ostree rebase ostree-unverified-registry:YOUR-FORGEJO-DOMAIN/YOUR-USERNAME/k
 
 - **Add/remove system packages:** edit [`build_files/packages.list`](build_files/packages.list)
   — one package name per line, `#` for comments. Push, CI rebuilds.
-- **Add/remove default apps (Flatpaks):** edit
-  [`system_files/usr/share/kamos/flatpaks.list`](system_files/usr/share/kamos/flatpaks.list)
-  with Flathub app IDs — installed automatically on each machine's first boot.
+- **Add/remove apps (Flatpaks) — no reinstall needed:** edit
+  [`system_files/usr/share/kamos/flatpaks.list`](system_files/usr/share/kamos/flatpaks.list),
+  push, wait ~8 min for the rebuild. New machines get the apps at first boot;
+  machines already running KAMOS install them automatically after their next
+  `rpm-ostree upgrade` + reboot (updates are staged weekly on their own).
+  Users can of course also install anything themselves from the Discover
+  store at any time — the list is just what ships by default.
 - **Wallpaper/logo:** replace
   `system_files/usr/share/backgrounds/kamos/kamos-default.png` and
   `system_files/usr/share/pixmaps/kamos-logo.png`. The build stamps the
diff --git a/system_files/usr/lib/systemd/system/kamos-flatpaks.service b/system_files/usr/lib/systemd/system/kamos-flatpaks.service
index 28bb1a7..69269b7 100644
--- a/system_files/usr/lib/systemd/system/kamos-flatpaks.service
+++ b/system_files/usr/lib/systemd/system/kamos-flatpaks.service
@@ -1,8 +1,7 @@
 [Unit]
-Description=Install KAMOS default Flatpak apps (first boot)
+Description=Sync KAMOS default Flatpak apps
 Wants=network-online.target
 After=network-online.target
-ConditionPathExists=!/var/lib/kamos-flatpaks-done
 
 [Service]
 Type=oneshot
diff --git a/system_files/usr/libexec/kamos-install-flatpaks b/system_files/usr/libexec/kamos-install-flatpaks
index 0f3feb6..269883e 100644
--- a/system_files/usr/libexec/kamos-install-flatpaks
+++ b/system_files/usr/libexec/kamos-install-flatpaks
@@ -1,11 +1,18 @@
 #!/usr/bin/env bash
-# Installs the default KAMOS Flatpak apps on first boot (runs once).
+# Keeps the machine's Flatpak apps in sync with /usr/share/kamos/flatpaks.list.
+# Runs on every boot but does nothing unless the list changed since last time,
+# so adding an app to the list + rebuilding the image is enough — installed
+# machines pick it up on their next update, no reinstall needed.
 set -u
 
 LIST=/usr/share/kamos/flatpaks.list
-STAMP=/var/lib/kamos-flatpaks-done
+STATE=/var/lib/kamos-flatpaks.sha
 
-[ -f "$STAMP" ] && exit 0
+[ -f "$LIST" ] || exit 0
+
+NEW="$(sha256sum "$LIST" | awk '{print $1}')"
+OLD="$(cat "$STATE" 2>/dev/null || true)"
+[ "$NEW" = "$OLD" ] && exit 0
 
 flatpak remote-add --if-not-exists --system flathub \
     https://dl.flathub.org/repo/flathub.flatpakrepo || true
@@ -15,9 +22,10 @@ while IFS= read -r app; do
     case "$app" in ''|\#*) continue ;; esac
     app="${app%%#*}"; app="$(echo "$app" | xargs)"
     [ -z "$app" ] && continue
+    echo "KAMOS: installing $app"
     flatpak install --system --noninteractive --or-update flathub "$app" || ok=0
 done < "$LIST"
 
-# Only mark done when everything succeeded, so it retries next boot otherwise
-[ "$ok" = 1 ] && touch "$STAMP"
+# Only record success, so a failed run (e.g. no network yet) retries next boot
+[ "$ok" = 1 ] && echo "$NEW" > "$STATE"
 exit 0
diff --git a/system_files/usr/share/kamos/flatpaks.list b/system_files/usr/share/kamos/flatpaks.list
index ad119cb..59d245f 100644
--- a/system_files/usr/share/kamos/flatpaks.list
+++ b/system_files/usr/share/kamos/flatpaks.list
@@ -1,13 +1,20 @@
-# Flatpak apps KAMOS installs automatically on first boot (one per line).
-# Add a Flathub app ID to include it; delete a line to remove it from new
-# installs. Find IDs at https://flathub.org (page URL ends with the ID).
+# Apps KAMOS installs automatically — on new installs AND on machines that
+# are already running KAMOS (they pick up changes on their next update).
+#
+# Add a Flathub app ID on its own line, push, and the image rebuilds in ~8 min.
+# Find IDs at https://flathub.org — the ID is at the end of the app's page URL.
 # Lines starting with # are ignored.
 
-com.heroicgameslauncher.hgl
-net.davidotek.pupgui2
+com.heroicgameslauncher.hgl        # Epic / GOG / Amazon games
+net.davidotek.pupgui2              # ProtonUp-Qt (Proton versions)
+com.discordapp.Discord             # Discord
 
-# --- popular extras (remove the # to enable) ---
-# com.discordapp.Discord
-# com.obsproject.Studio
-# org.videolan.VLC
-# com.spotify.Client
+# --- more popular picks (delete the # to enable) ---
+# com.obsproject.Studio            # OBS Studio (streaming/recording)
+# net.lutris.Lutris                # Lutris (game launcher)
+# org.videolan.VLC                 # VLC media player
+# com.spotify.Client               # Spotify
+# org.prismlauncher.PrismLauncher  # Minecraft
+# com.usebottles.bottles           # Windows apps via Wine
+# io.mpv.Mpv                       # mpv video player
+# org.qbittorrent.qBittorrent      # qBittorrent