diff --git a/fish/conf.d/ssh-keychain.fish b/fish/conf.d/ssh-keychain.fish
new file mode 100644
index 0000000..e03dade
--- /dev/null
+++ b/fish/conf.d/ssh-keychain.fish
@@ -0,0 +1,15 @@
+# Start keychain and source SSH agent variables for all private keys in ~/.ssh
+if status is-interactive
+    if type -q keychain
+        set -l _ssh_keys
+        for _pub in ~/.ssh/*.pub
+            set -l _key (string replace -r '\.pub$' '' $_pub)
+            if test -f $_key
+                set -a _ssh_keys $_key
+            end
+        end
+        if test (count $_ssh_keys) -gt 0
+            keychain --eval --quiet $_ssh_keys | source
+        end
+    end
+end
diff --git a/fish/config.fish b/fish/config.fish
new file mode 100644
index 0000000..c5227cb
--- /dev/null
+++ b/fish/config.fish
@@ -0,0 +1,4 @@
+# Machine-specific config (secrets, local overrides) — not tracked in dotfiles
+if test -f ~/.config/fish/local.fish
+    source ~/.config/fish/local.fish
+end
diff --git a/setup.sh b/setup.sh
index d60870f..81aefc9 100755
--- a/setup.sh
+++ b/setup.sh
@@ -14,6 +14,20 @@ link() {
     ln -s "$2" "$1"
   fi
 }
+# Like link(), but backs up existing regular files instead of skipping them
+smartlink() {
+  local target="$1" source="$2"
+  echo "Linking $target to $source"
+  if [ -L "$target" ]; then
+    : # already a symlink, nothing to do
+  elif [ -e "$target" ]; then
+    mv "$target" "${target}.bak"
+    echo "  Backed up existing file to ${target}.bak"
+    ln -s "$source" "$target"
+  else
+    ln -s "$source" "$target"
+  fi
+}
 configlink() {
   link ~/.config/$1 ~/.dotfiles/$1
 }
@@ -33,3 +47,16 @@ configlink kanshi
 
 checkdir ~/.claude
 link ~/.claude/settings.json ~/.dotfiles/claude/settings.json
+
+# Fish shell config
+checkdir ~/.config/fish
+checkdir ~/.config/fish/conf.d
+smartlink ~/.config/fish/config.fish ~/.dotfiles/fish/config.fish
+link ~/.config/fish/conf.d/ssh-keychain.fish ~/.dotfiles/fish/conf.d/ssh-keychain.fish
+
+# Migrate BW_SESSION and other machine-specific fish vars to local.fish
+if [ -f ~/.config/fish/config.fish.bak ] && [ ! -f ~/.config/fish/local.fish ]; then
+  echo "  Migrating machine-specific config from config.fish.bak to local.fish"
+  grep -v '^#' ~/.config/fish/config.fish.bak | grep -v '^\s*$' > ~/.config/fish/local.fish
+  echo "  Review ~/.config/fish/local.fish and remove anything now handled by dotfiles"
+fi