diff --git a/lib/brew.sh b/lib/brew.sh
index b8424cb..8d763d9 100644
--- a/lib/brew.sh
+++ b/lib/brew.sh
@@ -141,17 +141,29 @@ ssr::brew::restore() {
     # prompt individually for each package that needs admin privileges.
     _ssr_sudo_keepalive_start
 
-    # Suppress per-app Spotlight indexing: mas would otherwise run mdimport
-    # after every App Store installation. One batch pass runs below instead.
+    # HOMEBREW_NO_QUARANTINE=1: skip the post-install `xattr -d com.apple.quarantine`
+    # pass that Homebrew runs on every cask.  That xattr walk can block for
+    # several minutes on large apps (WhatsApp, Electron apps, …) because macOS
+    # Gatekeeper verifies every binary in the bundle.  Apps will show a standard
+    # one-time Gatekeeper dialog on first launch instead — normal macOS behaviour.
+    #
+    # HOMEBREW_NO_INSTALL_CLEANUP=1: skip per-package cache cleanup after each
+    # install.  A single `brew cleanup` runs in ssr-sync after the full bundle.
+    #
+    # MAS_NO_AUTO_INDEX=1: suppress per-app mdimport after every App Store app.
+    # One batch mdimport runs in the background below instead.
     local rc=0
-    MAS_NO_AUTO_INDEX=1 brew bundle install --file="$brewfile" --verbose || rc=$?
+    HOMEBREW_NO_QUARANTINE=1 \
+    HOMEBREW_NO_INSTALL_CLEANUP=1 \
+    MAS_NO_AUTO_INDEX=1 \
+        brew bundle install --file="$brewfile" --verbose || rc=$?
 
     _ssr_sudo_keepalive_stop
 
-    # Single batch Spotlight index of /Applications after all installs.
-    ssr::log "Indexing /Applications in Spotlight (one-time batch)"
-    mdimport /Applications 2>/dev/null || true
-    [[ -d "$HOME/Applications" ]] && mdimport "$HOME/Applications" 2>/dev/null || true
+    # Trigger Spotlight indexing in the background so it never blocks the restore.
+    ssr::log "Triggering background Spotlight index of /Applications"
+    mdimport /Applications &>/dev/null &
+    [[ -d "$HOME/Applications" ]] && mdimport "$HOME/Applications" &>/dev/null &
 
     if [[ $rc -ne 0 ]]; then
         ssr::warn "brew bundle install finished with errors (rc=$rc) — some packages were not installed."