diff --git a/features/chess/emacs/config.org b/features/chess/emacs/config.org
index c52952f..6f2507d 100644
--- a/features/chess/emacs/config.org
+++ b/features/chess/emacs/config.org
@@ -12,6 +12,7 @@
 
 #+begin_src emacs-lisp
 (use-package lichess
+  :demand t
   :init
   (defun azos/chess/open ()
     "Open lichess in its dedicated \"chess\" tab."
diff --git a/features/lauretta/emacs/config.org b/features/lauretta/emacs/config.org
index d5937f4..d2504e2 100644
--- a/features/lauretta/emacs/config.org
+++ b/features/lauretta/emacs/config.org
@@ -295,6 +295,21 @@ Redirect stderr away so only the token itself is ever captured.
       (string-trim (shell-command-to-string "pass lichess.org/token 2>/dev/null | head -1")))
 #+end_src
 
+=gpg-agent= may not have a cached passphrase yet when the =setq= above
+runs at Emacs startup, in which case =pass= fails silently (stderr is
+redirected away) and =lichess-token= is left as =""=. Retry the fetch
+lazily right before each actual use, so a cold agent at startup
+doesn't permanently wedge the token for the rest of the session.
+
+#+begin_src emacs-lisp
+(with-eval-after-load 'lichess
+  (advice-add 'lichess-token :before
+              (lambda ()
+                (when (string-empty-p lichess-token)
+                  (setq lichess-token
+                        (string-trim (shell-command-to-string "pass lichess.org/token 2>/dev/null | head -1")))))))
+#+end_src
+
 ** Beacon Remote Jobs
 
 #+begin_src emacs-lisp