diff --git a/lib/brew.sh b/lib/brew.sh
index e30a2a4..093de7d 100644
--- a/lib/brew.sh
+++ b/lib/brew.sh
@@ -62,19 +62,61 @@ ssr::brew::dump() {
     ssr::ok "Brewfile written ($(wc -l < "$brewfile" | tr -d ' ') lines)"
 }
 
+# Pre-authenticate sudo once and keep credentials alive in the background.
+# macOS caches sudo credentials for 5 minutes (300s); the keepalive loop
+# refreshes every 60s so Homebrew cask installers never hit a timeout mid-run.
+#
+# Usage:
+#   _ssr_sudo_keepalive_start   # prompts once, starts background loop
+#   … long-running commands …
+#   _ssr_sudo_keepalive_stop    # kills the loop
+
+_SSR_SUDO_KEEPALIVE_PID=""
+
+_ssr_sudo_keepalive_start() {
+    # Check whether sudo is available at all (may already be cached).
+    if ! sudo -v 2>/dev/null; then
+        ssr::warn "sudo authentication failed — cask installs may prompt per-package."
+        return 0
+    fi
+    ssr::ok "sudo credentials cached — Homebrew casks will not prompt during install."
+
+    # Background loop: re-validate every 60s to prevent 5-minute timeout.
+    (
+        while true; do
+            sleep 60
+            sudo -n true 2>/dev/null || break
+        done
+    ) &
+    _SSR_SUDO_KEEPALIVE_PID=$!
+}
+
+_ssr_sudo_keepalive_stop() {
+    if [[ -n "$_SSR_SUDO_KEEPALIVE_PID" ]]; then
+        kill "$_SSR_SUDO_KEEPALIVE_PID" 2>/dev/null || true
+        wait "$_SSR_SUDO_KEEPALIVE_PID" 2>/dev/null || true
+        _SSR_SUDO_KEEPALIVE_PID=""
+    fi
+}
+
 ssr::brew::restore() {
     local brewfile="$1"
     [[ -f "$brewfile" ]] || ssr::die "Brewfile not found: $brewfile"
     ssr::log "brew bundle install ← $brewfile"
 
+    # Authenticate sudo once up front so Homebrew cask installers don't
+    # prompt individually for each package that needs admin privileges.
+    _ssr_sudo_keepalive_start
+
     # Suppress per-app Spotlight indexing: mas would otherwise run mdimport
-    # after every single App Store installation, which adds minutes of latency
-    # spread across the run. We do one batch mdimport after bundle completes.
+    # after every App Store installation. One batch pass runs below instead.
     local rc=0
     MAS_NO_AUTO_INDEX=1 brew bundle install --file="$brewfile" --verbose || rc=$?
 
+    _ssr_sudo_keepalive_stop
+
     # Single batch Spotlight index of /Applications after all installs.
-    ssr::log "Indexing /Applications in Spotlight (one-time batch after all installs)"
+    ssr::log "Indexing /Applications in Spotlight (one-time batch)"
     mdimport /Applications 2>/dev/null || true
     [[ -d "$HOME/Applications" ]] && mdimport "$HOME/Applications" 2>/dev/null || true