diff --git a/setup.yml b/setup.yml
index 0e98bfb..fbaafed 100644
--- a/setup.yml
+++ b/setup.yml
@@ -40,3 +40,4 @@
       when: install_typora
     - ansible.builtin.import_tasks: tasks/duckdb.yml
       when: install_duckdb
+    - ansible.builtin.import_tasks: tasks/rpm.yml
diff --git a/tasks/duckdb.yml b/tasks/duckdb.yml
index 6ba0712..d33599a 100644
--- a/tasks/duckdb.yml
+++ b/tasks/duckdb.yml
@@ -1,16 +1,22 @@
----
+- name: Stat DuckDB CLI installation
+  ansible.builtin.stat:
+    path: /usr/local/bin/duckdb
+  register: duckdb_installed_result
+
 - name: Download DuckDB CLI
   ansible.builtin.get_url:
     url: "https://install.duckdb.org/v{{ duckdb_version }}/duckdb_cli-linux-amd64.gz"
     dest: /tmp/duckdb_cli-linux-amd64.gz
     mode: "0644"
     timeout: 300
+  when: not duckdb_installed_result.stat.exists
 
 - name: Install DuckDB CLI
   ansible.builtin.shell: gzip -dc /tmp/duckdb_cli-linux-amd64.gz > /usr/local/bin/duckdb
   args:
     executable: /bin/bash
     creates: /usr/local/bin/duckdb
+  when: not duckdb_installed_result.stat.exists
 
 - name: Make DuckDB executable
   ansible.builtin.file:
@@ -18,8 +24,10 @@
     mode: "0755"
     owner: root
     group: root
+  when: not duckdb_installed_result.stat.exists
 
 - name: Remove DuckDB archive
   ansible.builtin.file:
     path: /tmp/duckdb_cli-linux-amd64.gz
     state: absent
+  when: not duckdb_installed_result.stat.exists
diff --git a/tasks/rpm.yml b/tasks/rpm.yml
new file mode 100644
index 0000000..17340ca
--- /dev/null
+++ b/tasks/rpm.yml
@@ -0,0 +1,53 @@
+- name: Stat Proton Pass installation
+  ansible.builtin.command: rpm -qa proton-pass
+  register: proton_pass_installed_result
+  changed_when: false
+  failed_when: false
+
+- name: Download Proton Pass
+  ansible.builtin.get_url:
+    url: "https://proton.me/download/pass/linux/proton-pass-{{ proton_pass_version }}.x86_64.rpm"
+    dest: "/tmp/proton-pass-{{ proton_pass_version }}.x86_64.rpm"
+    mode: "0644"
+    timeout: 300
+  when: "proton_pass_installed_result.rc != 0"
+
+- name: Install Proton Pass
+  ansible.builtin.dnf:
+    name: "/tmp/proton-pass-{{ proton_pass_version }}.x86_64.rpm"
+    state: present
+    disable_gpg_check: yes
+  when: "proton_pass_installed_result.rc != 0"
+
+- name: Stat Proton Authenticator installation
+  ansible.builtin.command: rpm -qa proton-authenticator
+  register: proton_authenticator_installed_result
+  changed_when: false
+  failed_when: false
+
+- name: Download Proton Authenticator
+  ansible.builtin.get_url:
+    url: "https://proton.me/download/authenticator/linux/ProtonAuthenticator-{{ proton_authenticator_version }}.x86_64.rpm"
+    dest: "/tmp/proton-authenticator-{{ proton_authenticator_version }}.x86_64.rpm"
+    mode: "0644"
+    timeout: 300
+  when: "proton_authenticator_installed_result.rc != 0"
+
+- name: Install Proton Authenticator
+  ansible.builtin.dnf:
+    name: "/tmp/proton-authenticator-{{ proton_authenticator_version }}.x86_64.rpm"
+    state: present
+    disable_gpg_check: yes
+  when: "proton_authenticator_installed_result.rc != 0"
+
+- name: Delete Proton Pass downloaded RPM
+  ansible.builtin.file:
+    path: "/tmp/proton-pass-{{ proton_pass_version }}.x86_64.rpm"
+    state: absent
+  when: "proton_pass_installed_result.rc != 0"
+
+- name: Delete Proton Authenticator downloaded RPM
+  ansible.builtin.file:
+    path: "/tmp/proton-authenticator-{{ proton_authenticator_version }}.x86_64.rpm"
+    state: absent
+  when: "proton_authenticator_installed_result.rc != 0"
diff --git a/tasks/tooling.yml b/tasks/tooling.yml
index 769074f..167d2ca 100644
--- a/tasks/tooling.yml
+++ b/tasks/tooling.yml
@@ -91,9 +91,15 @@
   when: not starship_binary.stat.exists
 
 - name: Run Starship installer
-  ansible.builtin.command: /tmp/install_starship.sh -y
+  ansible.builtin.command: /tmp/install_starship.sh -y --bin-dir "{{ user_home }}/.local/bin"
+  become: false
+  when: not starship_binary.stat.exists
+
+- name: Remove the Starship installer
+  ansible.builtin.file:
+    path: /tmp/install_starship.sh
+    state: absent
   when: not starship_binary.stat.exists
-  become: true
 
 - name: Check for Bun
   ansible.builtin.stat:
@@ -112,3 +118,9 @@
   ansible.builtin.command: /tmp/bun-install.sh
   become: false
   when: not bun_binary.stat.exists
+
+- name: Remove the Bun installer
+  ansible.builtin.file:
+    path: /tmp/bun-install.sh
+    state: absent
+  when: not bun_binary.stat.exists
diff --git a/tasks/typora.yml b/tasks/typora.yml
index 4781cd5..e655f14 100644
--- a/tasks/typora.yml
+++ b/tasks/typora.yml
@@ -1,4 +1,8 @@
----
+- name: Stat Typora installation directory
+  ansible.builtin.stat:
+    path: /opt/typora
+  register: typora_installed_result
+
 - name: Create Typora install directory
   ansible.builtin.file:
     path: /opt/typora
@@ -6,6 +10,7 @@
     owner: root
     group: root
     mode: "0755"
+  when: not typora_installed_result.stat.exists
 
 - name: Download Typora Linux binary archive
   ansible.builtin.get_url:
@@ -13,6 +18,7 @@
     dest: "{{ typora_archive }}"
     mode: "0644"
     timeout: 300
+  when: not typora_installed_result.stat.exists
 
 - name: Extract Typora
   ansible.builtin.unarchive:
@@ -22,6 +28,7 @@
     owner: root
     group: root
     mode: "0755"
+  when: not typora_installed_result.stat.exists
 
 - name: Ensure Typora files are readable
   ansible.builtin.file:
@@ -31,6 +38,13 @@
     group: root
     mode: "0755"
     recurse: true
+  when: not typora_installed_result.stat.exists
+
+- name: Ensure system desktop application directory exists
+  ansible.builtin.file:
+    path: /usr/local/share/applications
+    state: directory
+    mode: "0755"
 
 - name: Create Typora launcher wrapper
   ansible.builtin.copy:
@@ -42,12 +56,7 @@
 
       cd /opt/typora/bin/Typora-linux-x64
       exec /opt/typora/bin/Typora-linux-x64/Typora "$@"
-
-- name: Ensure system desktop application directory exists
-  ansible.builtin.file:
-    path: /usr/local/share/applications
-    state: directory
-    mode: "0755"
+  when: not typora_installed_result.stat.exists
 
 - name: Create Typora desktop launcher
   ansible.builtin.copy:
@@ -62,3 +71,4 @@
       Terminal=false
       Categories=Office;WordProcessor;TextEditor;
       MimeType=text/markdown;text/x-markdown;
+  when: not typora_installed_result.stat.exists
diff --git a/vars.yml b/vars.yml
index 9988ba6..d7636f6 100644
--- a/vars.yml
+++ b/vars.yml
@@ -14,6 +14,8 @@ jdtls_download_retries: 3
 jdtls_download_delay: 10
 install_duckdb: true
 duckdb_version: "1.5.2"
+proton_pass_version: "1.37.0-1"
+proton_authenticator_version: "1.1.6-1"
 
 system_timezone: Atlantic/Faroe
 system_locale: en_US.UTF-8