diff --git a/home/base/gpg.nix b/home/base/gpg.nix
index 1911ff7..d9d0117 100644
--- a/home/base/gpg.nix
+++ b/home/base/gpg.nix
@@ -13,63 +13,78 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
-    programs.gpg = {
-      enable = true;
-      homedir = home;
-      mutableKeys = true;
-      mutableTrust = true;
-      publicKeys = [
-        # gpg -a --export
-        { source = ./assets/pubring.asc; trust = "ultimate"; }
-      ];
-      scdaemonSettings = {
-        disable-ccid = true;
+  config = mkIf cfg.enable (mkMerge [
+    {
+      programs.gpg = {
+        enable = true;
+        homedir = home;
+        mutableKeys = true;
+        mutableTrust = true;
+        publicKeys = [
+          # gpg -a --export
+          { source = ./assets/pubring.asc; trust = "ultimate"; }
+        ];
+        scdaemonSettings = {
+          disable-ccid = true;
+        };
       };
-    };
 
-    services.gpg-agent = {
-      enable = true;
-      enableSshSupport = true;
-      enableScDaemon = false;
-      verbose = true;
-      defaultCacheTtl = 30;
-      defaultCacheTtlSsh = 30;
-      maxCacheTtl = 30;
-      maxCacheTtlSsh = 30;
-      pinentry = mkMerge [
-        (helpers.mkIfDarwin {
-          package = pkgs.pinentry-touchid;
-          program = "pinentry-touchid";
-        })
-        (helpers.mkIfLinux {
-          package = pkgs.pinentry-gnome3;
-          program = "pinentry";
-        })
-      ];
-    };
+      services.gpg-agent = {
+        enable = true;
+        enableSshSupport = true;
+        enableScDaemon = false;
+        verbose = true;
+        defaultCacheTtl = 30;
+        defaultCacheTtlSsh = 30;
+        maxCacheTtl = 30;
+        maxCacheTtlSsh = 30;
+        pinentry = mkMerge [
+          (helpers.mkIfDarwin {
+            package = pkgs.pinentry-touchid;
+            program = "pinentry-touchid";
+          })
+          (helpers.mkIfLinux {
+            package = pkgs.pinentry-gnome3;
+            program = "pinentry";
+          })
+        ];
+      };
 
-    systemd.user.services.gpg-agent.Service.Slice = "session.slice";
+      systemd.user.services.gpg-agent.Service.Slice = "session.slice";
 
-    modules.git.signingKey = mkDefault "4EAF3D43CDBB01C9";
+      # enableSshSupport sets SSH_AUTH_SOCK in .zshenv via `gpgconf`, which needs GNUPGHOME
+      programs.zsh.envExtra = mkBefore ''
+        export GNUPGHOME="${home}"
+      '';
 
-    # ed25519 2025-09-06 [C]
-    age.secrets."147CBD801C5E0D0C27DD006653D3D96FF952F652.key" = {
-      symlink = true;
-      path = "${home}/private-keys-v1.d/147CBD801C5E0D0C27DD006653D3D96FF952F652.key";
-      file = ./encrypt/147CBD801C5E0D0C27DD006653D3D96FF952F652.key.age;
-    };
-    # ed25519 2025-09-06 [SA]
-    age.secrets."DDA4674BEB2FBE8A1EFB6F542FA66EDC2BFD54F5.key" = {
-      symlink = true;
-      path = "${home}/private-keys-v1.d/DDA4674BEB2FBE8A1EFB6F542FA66EDC2BFD54F5.key";
-      file = ./encrypt/DDA4674BEB2FBE8A1EFB6F542FA66EDC2BFD54F5.key.age;
-    };
-    # cv25519 2025-09-06 [E]
-    age.secrets."F6BECEF8FA360886C588883F90AD03CBE7B6450A.key" = {
-      symlink = true;
-      path = "${home}/private-keys-v1.d/F6BECEF8FA360886C588883F90AD03CBE7B6450A.key";
-      file = ./encrypt/F6BECEF8FA360886C588883F90AD03CBE7B6450A.key.age;
-    };
-  };
+      modules.git.signingKey = mkDefault "4EAF3D43CDBB01C9";
+
+      # ed25519 2025-09-06 [C]
+      age.secrets."147CBD801C5E0D0C27DD006653D3D96FF952F652.key" = {
+        symlink = true;
+        path = "${home}/private-keys-v1.d/147CBD801C5E0D0C27DD006653D3D96FF952F652.key";
+        file = ./encrypt/147CBD801C5E0D0C27DD006653D3D96FF952F652.key.age;
+      };
+      # ed25519 2025-09-06 [SA]
+      age.secrets."DDA4674BEB2FBE8A1EFB6F542FA66EDC2BFD54F5.key" = {
+        symlink = true;
+        path = "${home}/private-keys-v1.d/DDA4674BEB2FBE8A1EFB6F542FA66EDC2BFD54F5.key";
+        file = ./encrypt/DDA4674BEB2FBE8A1EFB6F542FA66EDC2BFD54F5.key.age;
+      };
+      # cv25519 2025-09-06 [E]
+      age.secrets."F6BECEF8FA360886C588883F90AD03CBE7B6450A.key" = {
+        symlink = true;
+        path = "${home}/private-keys-v1.d/F6BECEF8FA360886C588883F90AD03CBE7B6450A.key";
+        file = ./encrypt/F6BECEF8FA360886C588883F90AD03CBE7B6450A.key.age;
+      };
+    }
+
+    (helpers.mkIfDarwin {
+      launchd.agents.gpg-agent.config.ProgramArguments = mkForce [
+        "${pkgs.gnupg}/bin/gpgconf"
+        "--launch"
+        "gpg-agent"
+      ];
+    })
+  ]);
 }