diff --git a/azos-core b/azos-core
index b992dcc..6333b76 160000
--- a/azos-core
+++ b/azos-core
@@ -1 +1 @@
-Subproject commit b992dcc4f7ee0f68f0312b6a59b72f5c762bbd8c
+Subproject commit 6333b768ea21876ccd7d03b5b4f02e6ef61f5715
diff --git a/shells/defaultShell.nix b/shells/defaultShell.nix
index b79ae39..999bc12 100644
--- a/shells/defaultShell.nix
+++ b/shells/defaultShell.nix
@@ -5,7 +5,18 @@ pkgs.mkShell {
     nh
     (pkgs.writeShellScriptBin
       "azos-lauretta-update"
-      "nh os switch '.?submodules=1#lauretta'")
+      ''
+        # Authenticate up front and keep the sudo timestamp fresh during the
+        # build, so nh's activation step doesn't prompt (and time out) at the end.
+        sudo -v || exit 1
+        while true; do
+          sleep 60
+          sudo -n -v 2>/dev/null || exit
+        done &
+        keepalive=$!
+        trap 'kill $keepalive 2>/dev/null' EXIT
+        nh os switch '.?submodules=1#lauretta'
+      '')
     (pkgs.writeShellScriptBin
       "azos-update-azos-core"
       "nix flake update --flake '.?submodules=1' azos-core")