diff --git a/.chezmoiignore b/.chezmoiignore
index c2620fc460c..64d9d125631 100644
--- a/.chezmoiignore
+++ b/.chezmoiignore
@@ -34,4 +34,5 @@ com.googlecode.iterm2.plist
 .claude
 CLAUDE.md
 .chezmoiscripts/**
+.config/namecheap
 {{ end -}}
diff --git a/dot_aliases b/dot_aliases
index a0f0d01e744..814dee5cb70 100644
--- a/dot_aliases
+++ b/dot_aliases
@@ -169,5 +169,10 @@ alias reload="exec ${SHELL} -l"
 # Sync dotfiles repo to $HOME (chezmoi's sourceDir points at the clone)
 alias dotfiles='chezmoi apply'
 
+# namecheap-cli with credentials injected per-invocation from 1Password.
+# ~/.config/namecheap/env holds op:// references, not secrets; `op run`
+# resolves them into just this process. One biometric okay per app unlock.
+alias nc-cli='op run --env-file ~/.config/namecheap/env -- namecheap-cli'
+
 # Print each PATH entry on a separate line
 alias path='echo -e ${PATH//:/\\n}'
diff --git a/dot_config/namecheap/env b/dot_config/namecheap/env
new file mode 100644
index 00000000000..424a553c487
--- /dev/null
+++ b/dot_config/namecheap/env
@@ -0,0 +1,4 @@
+# 1Password secret REFERENCES for namecheap-cli — not secrets, safe to commit.
+# Resolved at runtime by `op run --env-file` (see nc-cli alias in .aliases).
+NAMECHEAP_USERNAME="op://Personal/www.namecheap.com/username"
+NAMECHEAP_API_KEY="op://Personal/www.namecheap.com/API/credential"
diff --git a/dot_gitconfig.local.tmpl b/dot_gitconfig.local.tmpl
index 20a275df809..61e87790422 100644
--- a/dot_gitconfig.local.tmpl
+++ b/dot_gitconfig.local.tmpl
@@ -18,11 +18,16 @@
 	allowedSignersFile = ~/.config/git/allowed_signers
 
 # Work identity follows the remote: any repo whose remote uses the
-# github-icaevan SSH alias gets the icanalytica identity (requires git 2.36+).
+# github-icaevan SSH alias or an HTTPS URL under a work org gets the
+# icanalytica identity (requires git 2.36+).
 [includeIf "hasconfig:remote.*.url:github-icaevan:*/**"]
 	path = ~/.gitconfig-ica
 [includeIf "hasconfig:remote.*.url:git@github-icaevan:*/**"]
 	path = ~/.gitconfig-ica
+[includeIf "hasconfig:remote.*.url:https://github.com/icanalytica/**"]
+	path = ~/.gitconfig-ica
+[includeIf "hasconfig:remote.*.url:https://github.com/icarichie/**"]
+	path = ~/.gitconfig-ica
 [commit]
 	gpgsign = true