diff --git a/azos-core b/azos-core
index 2818595..83c8370 160000
--- a/azos-core
+++ b/azos-core
@@ -1 +1 @@
-Subproject commit 28185950ad19f7d38b9c0fe1ba0f5ccfde4f9cac
+Subproject commit 83c837025264b22e26e5282bfccaac3a4aafb641
diff --git a/features/encryption/default.nix b/features/encryption/default.nix
index 70d4b9b..86f81e1 100644
--- a/features/encryption/default.nix
+++ b/features/encryption/default.nix
@@ -37,23 +37,31 @@
         '';
       };
 
-      # pinentry-emacs only attempts its Emacs-loopback socket when ITS OWN
-      # process env has INSIDE_EMACS set (see pinentry-emacs.c) -- and that
-      # process is gpg-agent's child, so it inherits gpg-agent's daemon env,
-      # not the env of whichever client (git, pass, ...) asked it to sign.
-      # Without this, any signing request from outside Emacs (e.g. a plain
-      # terminal, or an agent shelling out to git) always falls through to
-      # the curses pinentry, which fails outright when there's no real tty.
+      # pinentry-emacs needs INSIDE_EMACS set, but NOT on gpg-agent itself:
+      # gpg-agent calls gnupg_unsetenv("INSIDE_EMACS") on its own process at
+      # startup (agent/gpg-agent.c, both supervised and daemon mode) -- by
+      # design, it expects this to arrive per-connection from the CLIENT,
+      # not statically from its own daemon environment. Each gpg/git
+      # invocation reads INSIDE_EMACS from its own env and forwards it to
+      # gpg-agent via "OPTION putenv=INSIDE_EMACS=..." (common/asshelp.c:
+      # send_pinentry_environment); gpg-agent stores that per-session and
+      # copies it into the forked pinentry's actual env for that one
+      # request (agent/call-pinentry.c:atfork_core). So the var has to be
+      # set on whatever shell/process runs git or gpg -- a prior attempt
+      # at this set it on gpg-agent.service's systemd Environment instead,
+      # which gpg-agent silently discards before it can ever be read.
       #
-      # Only safe to force on when Emacs is structurally guaranteed to be
-      # up and responsive -- i.e. under EXWM, where Emacs *is* the window
-      # manager. Elsewhere Emacs may not be running (fine: the loopback
-      # socket connect fails instantly, same fast fallback as today) or may
-      # be running but transiently busy (not fine: pinentry then blocks on
-      # the Assuan handshake for up to its 60s timeout before falling back,
-      # which is strictly worse than today's instant failure).
-      systemd.user.services.gpg-agent.Service.Environment =
-        lib.mkIf config.azos.suites.exwm.enable ["INSIDE_EMACS=1"];
+      # Only safe to set globally when Emacs is structurally guaranteed to
+      # be up and responsive -- i.e. under EXWM, where Emacs *is* the
+      # window manager. Elsewhere Emacs may not be running (fine: the
+      # loopback socket connect fails instantly, same fast fallback as
+      # today) or may be running but transiently busy (not fine: pinentry
+      # then blocks on the Assuan handshake for up to its 60s timeout
+      # before falling back, which is strictly worse than today's instant
+      # failure).
+      home.sessionVariables = lib.mkIf config.azos.suites.exwm.enable {
+        INSIDE_EMACS = "t";
+      };
 
       home.file.".ssh/config".source = ./ssh-config;
       home.file.".ssh/gpg-as-ssh.pub".source = ./gpg-as-ssh.pub;