diff --git a/settings/quickshell.nix b/settings/quickshell.nix
index 504b9ff..51b15e6 100644
--- a/settings/quickshell.nix
+++ b/settings/quickshell.nix
@@ -635,6 +635,31 @@ in
                     onExited: code => { if (code === 0) lock.locked = true; }
                 }
 
+                // Chromium/Electron apps ask the Secret Service for their
+                // credentials as soon as they launch — spotify autostarts, so
+                // it hit gcr's unlock dialog every boot. The login keyring is
+                // still locked at that point: greetd's autologin gave
+                // pam_gnome_keyring no password to stash, and PamContext only
+                // runs pam_authenticate, never the session phase that
+                // auto_start unlocks from. So feed the daemon the password
+                // ourselves once PAM has accepted it.
+                //
+                // --unlock without --replace reaches the daemon already
+                // running over its control socket; --replace would kill it and
+                // drop the clients that connected first. No trailing newline:
+                // the daemon reads stdin to EOF and doesn't strip one.
+                Process {
+                    id: keyringUnlock
+                    property string secret: ""
+                    command: [ "${pkgs.gnome-keyring}/bin/gnome-keyring-daemon", "--unlock" ]
+                    onStarted: {
+                        write(secret);
+                        secret = "";
+                        // EOF, or the daemon blocks on that read forever.
+                        stdinEnabled = false;
+                    }
+                }
+
                 PamContext {
                     id: pam
                     // NixOS ships a "login" pam service; pam_unix verifies the
@@ -644,9 +669,13 @@ in
                         if (this.responseRequired) this.respond(root.password);
                     }
                     onCompleted: result => {
+                        if (result === PamResult.Success) {
+                            keyringUnlock.secret = root.password;
+                            keyringUnlock.stdinEnabled = true;
+                            keyringUnlock.running = true;
+                            lock.locked = false;
+                        } else root.failed = true;
                         root.password = "";
-                        if (result === PamResult.Success) lock.locked = false;
-                        else root.failed = true;
                     }
                 }