diff --git a/settings/desktop.nix b/settings/desktop.nix
index 5051b7a..df3e9d5 100644
--- a/settings/desktop.nix
+++ b/settings/desktop.nix
@@ -3,25 +3,30 @@
 {
   config = lib.mkIf (lib.elem config.networking.hostName [ "FredOS-Gaming" "FredOS-Macbook" ]) {
     services.xserver.enable = true;
-    services.displayManager.ly.enable = true;
-    services.displayManager.defaultSession = "hyprland";
+    # Autologin straight into Hyprland; the quickshell lockscreen engages
+    # immediately (see Lock.qml), so the lock *is* the login prompt.
+    services.greetd = {
+      enable = true;
+      settings.default_session = {
+        command = lib.getExe config.programs.hyprland.package;
+        user = "fred";
+      };
+    };
     boot.plymouth.enable = true;
     boot.initrd.verbose = false;
     boot.consoleLogLevel = 3;
     boot.kernelParams = [ "quiet" "udev.log_level=3" ];
 
-    services.displayManager.ly.settings = {
-      animation = "none";
-      bigclock   = true;
-    };
-
     # Flatpak for ad-hoc app installs via Bazaar
     services.flatpak.enable = true;
 
-    # Secret Service for Chromium/Electron credential encryption;
-    # PAM unlocks the keyring with the login password at the ly greeter.
+    # Secret Service for Chromium/Electron credential encryption.
+    # Autologin can't unlock the keyring (no password typed), so greetd only
+    # *starts* the daemon; the quickshell lockscreen authenticates against the
+    # "login" PAM service, where pam_gnome_keyring unlocks it on first unlock.
     services.gnome.gnome-keyring.enable = true;
-    security.pam.services.ly.enableGnomeKeyring = true;
+    security.pam.services.greetd.enableGnomeKeyring = true;
+    security.pam.services.login.enableGnomeKeyring = true;
 
     environment.systemPackages = with pkgs; [
       nemo                 # file manager
diff --git a/settings/quickshell.nix b/settings/quickshell.nix
index c796bc7..64c22e5 100644
--- a/settings/quickshell.nix
+++ b/settings/quickshell.nix
@@ -198,6 +198,7 @@ in
           onChange = qsRestart;
           text = ''
             import Quickshell
+            import Quickshell.Io
             import Quickshell.Wayland
             import Quickshell.Services.Pam
             import QtQuick
@@ -225,6 +226,16 @@ in
                     pam.start();
                 }
 
+                // greetd autologs us in, so lock as soon as the shell comes up:
+                // the lockscreen is the login prompt. mkdir is the atomic
+                // once-per-session test — XDG_RUNTIME_DIR dies with the
+                // session, so quickshell restarts (rebuilds) don't re-lock.
+                Process {
+                    running: true
+                    command: ["mkdir", Quickshell.env("XDG_RUNTIME_DIR") + "/qs-boot-lock"]
+                    onExited: code => { if (code === 0) lock.locked = true; }
+                }
+
                 PamContext {
                     id: pam
                     // NixOS ships a "login" pam service; pam_unix verifies the