diff --git a/modules/home.nix b/modules/home.nix
index 171c7d0..9433121 100644
--- a/modules/home.nix
+++ b/modules/home.nix
@@ -13,7 +13,13 @@ let
   # SSH_ASKPASS helper that drives the GPG pinentry-qt: ssh passphrase/PIN
   # prompts reuse the same Qt dialog as commit signing, adding no extra GUI
   # toolkit (a packaged askpass would drag in KDE/GTK — hundreds of MB).
+  # ssh signals the prompt kind via $SSH_ASKPASS_PROMPT (OpenSSH ≥ 8.4):
+  #   empty          real passphrase/PIN entry — collect input, echo to stdout
+  #   confirm/none   informational, e.g. "Confirm user presence" (touch request)
+  # A FIDO touch can't be faked by software, so those messages need no dialog:
+  # succeed silently instead of popping a spurious PIN box (the token blinks).
   sshAskpass = pkgs.writeShellScript "ssh-askpass-pinentry" ''
+    [ -n "''${SSH_ASKPASS_PROMPT:-}" ] && exit 0
     desc=$(printf '%s' "''${1:-Passphrase:}" | sed 's/%/%25/g')
     printf 'SETTITLE ssh\nSETPROMPT PIN:\nSETDESC %s\nGETPIN\nBYE\n' "$desc" \
       | ${pkgs.pinentry-qt}/bin/pinentry-qt \