From 630e726f5fb7e0cee09922f6f69a09bd1043d8e5 Mon Sep 17 00:00:00 2001
From: mikl <mikl@iscg.dev>
Date: Tue, 29 Sep 2026 02:04:16 +0300
Subject: [PATCH] fix(poppy): disable pinentry external passphrase cache

---
 home/pass.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/home/pass.nix b/home/pass.nix
index bdd5b62..40bf8b0 100644
--- a/home/pass.nix
+++ b/home/pass.nix
@@ -16,8 +16,9 @@
   # GPG agent settings (only for GPG/pass, NOT for SSH)
   services.gpg-agent = {
     enable = true;
-    # Never cache GPG passphrases: pass asks every time.
+    # Neither gpg-agent nor pinentry-mac/Keychain may cache passphrases.
     defaultCacheTtl = 0;
     maxCacheTtl = 0;
+    extraConfig = "no-allow-external-cache";
   };
 }