diff --git a/modules/home.nix b/modules/home.nix
index 3ad82d2..7c5e4e9 100644
--- a/modules/home.nix
+++ b/modules/home.nix
@@ -548,6 +548,17 @@ in
   # gpg's ssh support is off, so this is the only agent. Keys are added on
   # demand — nothing here presumes a particular ssh config.
   services.ssh-agent.enable = true;
+  # The agent, not the ssh client, collects the FIDO PIN when signing with a
+  # verify-required sk-ed25519 key it holds — so the *agent's* environment needs
+  # the askpass helper. The systemd user service starts with a minimal env that
+  # lacks it, so such signatures fail with the misleading "incorrect passphrase
+  # supplied to decrypt private key". REQUIRE=force drives the prompt with no
+  # DISPLAY (a daemon has none); sshAskpass exits 0 for the touch step, so only
+  # the PIN pops a dialog.
+  systemd.user.services.ssh-agent.Service.Environment = [
+    "SSH_ASKPASS=${sshAskpass}"
+    "SSH_ASKPASS_REQUIRE=force"
+  ];
 
   services.mako = {
     enable = true;