diff --git a/CLAUDE.md b/CLAUDE.md
index 6b09e34..de93089 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -49,8 +49,11 @@ core  plugins  aliases  mise  wt  path  agent-vault       (+ commands/ai)
 - `mise` / `wt` / `path` — runtime version manager, worktrunk integration, PATH additions
 - `agent-vault` — credential-broker client env + `avc`/`av` wrappers (see below)
 
-compinit runs once in `.zshrc` (brew completions fpath is set before it). Tool-managed blocks
-(OpenSpec, Kiro CLI pre/post, bun, Antigravity) are kept in `.zshrc` as-is.
+compinit runs once in `.zshrc` (brew completions fpath is set before it), so any brew formula
+that ships a zsh completion (e.g. `openspec`) is picked up with no extra wiring. Tool-managed
+blocks (Kiro CLI pre/post, bun, Antigravity) are kept in `.zshrc` as-is. The old
+`# OPENSPEC:START/END` block was removed: it pointed fpath at the deleted oh-my-zsh tree, and
+its `compinit` is now the plain, unmarked one. OpenSpec itself is installed by the Brewfile.
 
 ## Secrets (never committed)
 
diff --git a/dot_config/brew/Brewfile.tmpl b/dot_config/brew/Brewfile.tmpl
index 8173f08..7046287 100644
--- a/dot_config/brew/Brewfile.tmpl
+++ b/dot_config/brew/Brewfile.tmpl
@@ -47,6 +47,7 @@ brew "git-absorb"
 brew "go"
 brew "mise"
 brew "nx"
+brew "openspec"        # spec-driven dev CLI; pulls Homebrew node; zsh completion via site-functions
 brew "jq"
 brew "pandoc"
 brew "gnupg"
diff --git a/dot_zshrc b/dot_zshrc
index aa81046..02e4f41 100644
--- a/dot_zshrc
+++ b/dot_zshrc
@@ -28,12 +28,9 @@ if [[ -n "$HOMEBREW_PREFIX" && -d "$HOMEBREW_PREFIX/share" ]]; then
   fpath=("$HOMEBREW_PREFIX/share/zsh/site-functions" "$HOMEBREW_PREFIX/share/zsh-completions" $fpath)
 fi
 
-# OPENSPEC:START
-# OpenSpec shell completions configuration
-fpath=("$HOME/.oh-my-zsh/custom/completions" $fpath)
+# --- Completion init (the single compinit; fragments below rely on it) ---
 autoload -Uz compinit
 compinit
-# OPENSPEC:END
 
 # --- Machine-local secrets (gitignored; NOT in the dotfiles repo) ---
 # See ~/.config/.secrets. Holds OP_SERVICE_ACCOUNT_TOKEN + API keys.