diff --git a/README.md b/README.md
index 13490b4..348482a 100644
--- a/README.md
+++ b/README.md
@@ -127,7 +127,7 @@ My machine differs slightly      →  ~/.config/dots/profiles/<name>.toml
 |---------|----------------|---------------------|-------------|-----|
 | `base` | core, modern | none | tmux | minimal |
 | `home` | core…gui + infra/media + dev/network/data/geo/security | personal stack (incl. Herdr) | herdr | yes |
-| `work` | core, modern, workstation, dev, data, security | **none** unless `--with` / custom | tmux | limited |
+| `work` | core, modern, workstation, dev, data, geo, security, gui | **none** unless `--with` / custom | tmux | yes (font) |
 | `server` | core, modern, server | **Herdr** (no AI providers) | tmux | no |
 | `all` | full workstation (incl. new tool groups) | all optional | tmux | yes |
 
diff --git a/configs/bootstrap/profiles/work.toml b/configs/bootstrap/profiles/work.toml
index 7a0c610..384883c 100644
--- a/configs/bootstrap/profiles/work.toml
+++ b/configs/bootstrap/profiles/work.toml
@@ -7,14 +7,14 @@
 # IMPORTANT: Do NOT infer employer AI policy. Start with NO AI clients.
 # Cursor MUST NOT be included without approval.
 #
-# Package groups: +dev +data +security (install-only CLIs). Network/geo omitted
-# by default — add via custom profile or --packages if needed.
+# Package groups: +dev +data +geo +security +gui (font). Network omitted by default
+# — add via custom profile or --packages if needed.
 
 [profile]
 name = "work"
 description = "Conservative allowlist — no AI clients by default"
 with = []
-packages = ["core", "modern", "workstation", "dev", "data", "security"]
+packages = ["core", "modern", "workstation", "dev", "data", "geo", "security", "gui"]
 open_apps = ["iTerm"]
 
 [runtime]
diff --git a/docs/concepts/profiles.md b/docs/concepts/profiles.md
index 004c70a..31fe76b 100644
--- a/docs/concepts/profiles.md
+++ b/docs/concepts/profiles.md
@@ -12,7 +12,7 @@ Authority: `configs/bootstrap/profiles/*.toml`
 |---------|----------------|---------------------|-------------|-----|
 | `base` | `core`, `modern` | none | tmux | minimal |
 | `home` | `core`…`gui` + `infra`/`media` + `dev`/`network`/`data`/`geo`/`security` | `ai` + herdr, skills, ai-skills, images, tex; FluidVoice excluded by default | herdr | yes |
-| `work` | `core`, `modern`, `workstation`, `dev`, `data`, `security` | **none** unless `--with` / custom | tmux | limited |
+| `work` | `core`, `modern`, `workstation`, `dev`, `data`, `geo`, `security`, `gui` | **none** unless `--with` / custom | tmux | yes (font) |
 | `server` | `core`, `modern`, `server` | **Herdr** only (no AI providers) | tmux | no |
 | `all` | full workstation groups incl. `dev`/`security`/`network`/`data`/`geo` | all optional (`include_all_optional`; respects `omit_from_all`) | tmux | yes |
 
@@ -31,8 +31,8 @@ members are omitted automatically.
 
 Conservative allowlist. **Do not** infer employer AI policy. Start with no AI
 clients. Cursor must not be included without approval. Package groups add
-`dev` / `data` / `security` (install-only CLIs); `network` and `geo` stay off
-unless a custom profile or `--packages` opts in.
+`dev` / `data` / `geo` / `security` (install-only CLIs) plus `gui` (JetBrains Mono
+Nerd Font). `network` stays off unless a custom profile or `--packages` opts in.
 
 ### `server`
 
diff --git a/docs/reference/generated/profiles.md b/docs/reference/generated/profiles.md
index bb4c4fd..01cb302 100644
--- a/docs/reference/generated/profiles.md
+++ b/docs/reference/generated/profiles.md
@@ -51,7 +51,7 @@ Headless server — tmux + Herdr available, no GUI/AI providers by default
 Conservative allowlist — no AI clients by default
 
 - **Source:** `configs/bootstrap/profiles/work.toml`
-- **packages:** `core`, `modern`, `workstation`, `dev`, `data`, `security`
+- **packages:** `core`, `modern`, `workstation`, `dev`, `data`, `geo`, `security`, `gui`
 - **with:** (none)
 - **runtime.multiplexer:** `tmux`
 
diff --git a/docs/using/package-groups.md b/docs/using/package-groups.md
index d437807..ae428a9 100644
--- a/docs/using/package-groups.md
+++ b/docs/using/package-groups.md
@@ -50,7 +50,7 @@ Builtin profiles declare membership in TOML (SoT):
 | Profile | Groups (summary) |
 |---------|------------------|
 | `base` | `core` `modern` |
-| `work` | + `workstation` `dev` `data` `security` |
+| `work` | + `workstation` `dev` `data` `geo` `security` `gui` |
 | `home` | + `infra` `media` `gui` + `dev` `network` `data` `geo` `security` |
 | `server` | `core` `modern` `server` |
 | `all` | workstation set + `dev` `security` `network` `data` `geo` |
diff --git a/scripts/profile_resolution_test.sh b/scripts/profile_resolution_test.sh
index be8012e..6160616 100755
--- a/scripts/profile_resolution_test.sh
+++ b/scripts/profile_resolution_test.sh
@@ -186,21 +186,16 @@ for g in dev network data geo security; do
 done
 if [[ "${PROFILE_RUNTIME_MULTIPLEXER}" == "herdr" ]]; then ok "home multiplexer=herdr"; else bad "home mux=${PROFILE_RUNTIME_MULTIPLEXER}"; fi
 
-# WORK has no AI; has lean workstation tool groups (no geo/network)
+# WORK has no AI; workstation tool groups + geo/gui; network still off by default
 resolve_named work
 if [[ ${#EFFECTIVE_WITH[@]} -eq 0 ]]; then ok "work AI empty"; else bad "work leaked AI"; fi
-for g in dev data security; do
+for g in dev data geo security gui; do
   if dots_array_contains "${g}" "${PROFILE_PACKAGES[@]+"${PROFILE_PACKAGES[@]}"}"; then
     ok "work has ${g} group"
   else
     bad "work missing ${g}"
   fi
 done
-if dots_array_contains geo "${PROFILE_PACKAGES[@]+"${PROFILE_PACKAGES[@]}"}"; then
-  bad "work should omit geo"
-else
-  ok "work omits geo"
-fi
 if dots_array_contains network "${PROFILE_PACKAGES[@]+"${PROFILE_PACKAGES[@]}"}"; then
   bad "work should omit network"
 else
diff --git a/scripts/tests/package_groups_control_plane_test.sh b/scripts/tests/package_groups_control_plane_test.sh
index e59019b..c03cca4 100644
--- a/scripts/tests/package_groups_control_plane_test.sh
+++ b/scripts/tests/package_groups_control_plane_test.sh
@@ -150,7 +150,8 @@ plan_work="$("${ROOT}/dots" packages plan --profile work 2>&1)" || {
 	plan_work=""
 }
 echo "${plan_work}" | grep -qE '^\s+dev$' && ok "plan work has dev" || bad "plan work missing dev"
-echo "${plan_work}" | grep -qE '^\s+geo$' && bad "plan work should omit geo" || ok "plan work omits geo"
+echo "${plan_work}" | grep -qE '^\s+geo$' && ok "plan work has geo" || bad "plan work missing geo"
+echo "${plan_work}" | grep -qE '^\s+gui$' && ok "plan work has gui" || bad "plan work missing gui"
 
 echo "=== plan / groups are non-mutating ==="
 before="$(find "${TMP}" -type f 2>/dev/null | sort | cksum)"