diff --git a/README.md b/README.md
index 82bb2f7..54b3764 100644
--- a/README.md
+++ b/README.md
@@ -113,7 +113,7 @@ The Makefile's `full-install` target runs 7 sequential scripts for a complete se
 Installs essential packages based on your OS:
 - **Common packages**: tmux, neovim, git, fish, curl, bat, go, eza, ripgrep, lazygit
 - **macOS**: Uses Homebrew (installs it first if missing)
-- **Arch Linux**: Uses pacman and installs the yay AUR helper
+- **Arch Linux**: Uses pacman, installs the yay AUR helper, and installs `cronie` (cron daemon) for the hourly pacman sync job set up in `07-last-touches.sh`
 - **Debian/Ubuntu**: Uses apt (`go` → `golang`, skips lazygit)
 - **Alpine**: Uses apk
 - **Fedora/RHEL/CentOS**: Uses dnf (skips curl and lazygit)
@@ -152,6 +152,10 @@ Completes the setup:
 - Changes the default shell to Fish
 - Creates `~/bin` for personal scripts
 - On Gentoo, installs the appropriate kernel-upgrade helper (OpenRC or systemd)
+- On Arch, enables the cron daemon and installs an hourly `sudo pacman -Syy`
+  cron job for the current user; if that user isn't root, grants them
+  passwordless sudo (`/etc/sudoers.d/99-<user>-nopasswd`) so the unattended
+  job can actually run
 
 ## Manual Setup
 
diff --git a/install-scripts/01-install-packages.sh b/install-scripts/01-install-packages.sh
index 719bf3e..5f1e29a 100755
--- a/install-scripts/01-install-packages.sh
+++ b/install-scripts/01-install-packages.sh
@@ -46,6 +46,10 @@ if [ -f /etc/arch-release ]; then
 
     # install packages
     sudo pacman -S --noconfirm "${PACKAGES[@]}"
+
+    # cronie provides the cron daemon + crontab, needed for the hourly
+    # pacman sync job set up in 07-last-touches.sh
+    sudo pacman -S --noconfirm cronie
 fi
 
 # if debian or ubuntu install
diff --git a/install-scripts/07-last-touches.sh b/install-scripts/07-last-touches.sh
index fea14e1..9846c3c 100755
--- a/install-scripts/07-last-touches.sh
+++ b/install-scripts/07-last-touches.sh
@@ -29,4 +29,32 @@ if [ -f /etc/gentoo-release ]; then
 
     sudo cp scripts/gentoo-kernel-upgrade-$init_system /usr/bin/gentoo-kernel-upgrade
 
-fi
\ No newline at end of file
+fi
+
+# Arch specific: keep the local package database fresh via an hourly cron job
+if [ -f /etc/arch-release ]; then
+    user="$(id -un)"
+
+    # enable & start the cron daemon (cronie was installed in 01-install-packages.sh).
+    # Skip if systemd isn't actually running, e.g. inside a container build.
+    if [ -d /run/systemd/system ]; then
+        sudo systemctl enable --now cronie.service
+    fi
+
+    # cron runs the job non-interactively, so the invoking user needs
+    # passwordless sudo for it to be able to run pacman unattended
+    if [ "$EUID" -ne 0 ]; then
+        sudoers_file="/etc/sudoers.d/99-$user-nopasswd"
+        sudoers_tmp="$(mktemp)"
+        echo "$user ALL=(ALL) NOPASSWD: ALL" > "$sudoers_tmp"
+        sudo visudo -cf "$sudoers_tmp"
+        sudo install -m 440 "$sudoers_tmp" "$sudoers_file"
+        rm -f "$sudoers_tmp"
+    fi
+
+    # install/refresh the hourly job, replacing any previous copy of it
+    cron_cmd="sudo pacman -Syy"
+    cron_line="0 * * * * $cron_cmd"
+    existing_cron="$(crontab -l 2>/dev/null | grep -vF "$cron_cmd" || true)"
+    printf '%s\n%s\n' "$existing_cron" "$cron_line" | crontab -
+fi