diff --git a/home/cli.nix b/home/cli.nix
index 5bdfbc3..9ef52cf 100644
--- a/home/cli.nix
+++ b/home/cli.nix
@@ -2,21 +2,38 @@
 {
   # Universal CLI tools for all hosts
   home.packages = with pkgs; [
+    # File navigation & viewing
     eza
     bat
     ripgrep
     fd
     fzf
     tree
+
+    # System info
     htop
     tldr
     fastfetch
+
+    # Node
     pnpm  # fast node package manager
+
+    # Secrets
+    (pass.withExtensions (ext: [ ext.pass-otp ]))
+    gpgme
+    gnupg
   ];
 
   # TODO: global npm/pnpm packages not managed by nix for now
   # install manually: pnpm i -g @mariozechner/pi-coding-agent
 
+  # GPG agent for password caching
+  services.gpg-agent = {
+    enable = true;
+    defaultCacheTtl = 3600;
+    enableSshSupport = true;
+  };
+
   # FZF fuzzy finder
   programs.fzf = {
     enable = true;