diff --git a/modules/home.nix b/modules/home.nix
index 0113230..17664d2 100644
--- a/modules/home.nix
+++ b/modules/home.nix
@@ -353,6 +353,10 @@ in
   # Notification daemon. notify-send clients (e.g. imv's info/delete toasts in
   # modules/media.nix, gpg-agent errors) need a running server on the bus.
   # Minimal to match the desktop: Nerd Font, no rounding, square border.
+  # Secret Service provider (freedesktop org.freedesktop.secrets). Bare Wayland
+  # session has none otherwise; apps using libsecret/qtkeychain need it.
+  services.gnome-keyring.enable = true;
+
   services.mako = {
     enable = true;
     settings = {
diff --git a/modules/nixos.nix b/modules/nixos.nix
index e36db55..babfb31 100644
--- a/modules/nixos.nix
+++ b/modules/nixos.nix
@@ -92,6 +92,10 @@
     };
   };
 
+  # Unlock the login keyring with the login password at the greetd prompt,
+  # so the Secret Service is open without a second passphrase.
+  security.pam.services.greetd.enableGnomeKeyring = true;
+
   # XDG portals (screen sharing, file pickers, and so on).
   xdg.portal = {
     enable = true;