diff --git a/home/pass.nix b/home/pass.nix
new file mode 100644
index 0000000..944fa7c
--- /dev/null
+++ b/home/pass.nix
@@ -0,0 +1,55 @@
+{ config, pkgs, ... }:
+{
+  # Password store (gpg-backed)
+  programs.password-store = {
+    enable = true;
+    settings = {
+      # Default password store path
+      PASSWORD_STORE_DIR = "$HOME/.password-store";
+      PASSWORD_STORE_GIT = "git+https://git.iscg.dev/mikl/password-store.git";
+      PASSWORD_STORE_X_SELECTION_TIMEOUT = 5;
+      # extensions
+      extensions = [ "otp" ];
+    };
+  };
+
+  # Activation: ensure GPG key is available
+  # This is a best-effort setup that downloads from forgejo if needed
+  home.activation.passSetup = {
+    data = ''
+      # 1. Check if GPG has any keys
+      if ! ${pkgs.gnupg}/bin/gpg --list-secret-keys michaotic@iscg.dev >/dev/null 2>&1; then
+        echo "⚠️  GPG key for michaotic@iscg.dev not found."
+        echo ""
+        echo "Options:"
+        echo "  1. Import existing key:"
+        echo "     gpg --import /path/to/private-key.asc"
+        echo ""
+        echo "  2. Generate new key:"
+        echo "     gpg --full-gen-key"
+        echo ""
+        echo "  3. Clone from forgejo (if you have access):"
+        echo "     git clone https://git.iscg.dev/mikl/gpg-secrets.git /tmp/gpg-setup"
+        echo "     gpg --import /tmp/gpg-setup/gpg-private.asc"
+        echo "     rm -rf /tmp/gpg-setup"
+        echo ""
+      fi
+      
+      # 2. Initialize pass git remote if needed
+      if [ ! -d "$HOME/.password-store/.git" ] && [ -d "$HOME/.password-store" ]; then
+        cd "$HOME/.password-store"
+        ${pkgs.git}/bin/git init -q
+        ${pkgs.git}/bin/git remote add origin "https://git.iscg.dev/mikl/password-store.git" 2>/dev/null || true
+        cd - >/dev/null
+      fi
+    '';
+  };
+
+  # GPG agent settings
+  services.gpg-agent = {
+    enable = true;
+    defaultCacheTtl = 3600;
+    enableSshSupport = true;
+    pinentryFlavor = "default";
+  };
+}