diff --git a/azos-core b/azos-core
index 3b4cb38..2a011bb 160000
--- a/azos-core
+++ b/azos-core
@@ -1 +1 @@
-Subproject commit 3b4cb389908feccbacdb3ed87c99a38549681ad6
+Subproject commit 2a011bbb35d07d36afdbc2813f856e252a794f9a
diff --git a/features/mail/default.nix b/features/mail/default.nix
index 8a04202..9288a5b 100644
--- a/features/mail/default.nix
+++ b/features/mail/default.nix
@@ -27,54 +27,15 @@
         certificatesFile = "/etc/ssl/certs/ca-certificates.crt";
       };
     };
-    # mbsync's PassCmd shells out to `pass`, which needs the GPG smartcard to
-    # decrypt. On a timer, a missing card would otherwise surface as a
-    # pinentry "please insert card" prompt every run. azos-card-present is a
-    # silent presence check (see overlays/default.nix): skip the sync
-    # entirely when the card isn't there, instead of letting mbsync hit that
-    # prompt.
-    #
-    # New mail is detected by counting files under every account's Maildir
-    # "new" subdirectory before and after the sync -- that's where messages
-    # the server hasn't marked seen land, across all three accounts at once,
-    # with no need to touch mu's index. A rise in that count means mail
-    # actually arrived, so only then does it post a desktop notification via
-    # notify-send -- intentionally separate from mu4e's own "mbsync -a" (its
-    # mu4e-get-mail-command), which doesn't go through this script at all.
-    mbsyncSafe = pkgs.writeShellScript "mbsync-safe" ''
-      if ! ${pkgs.azos-card-present}/bin/azos-card-present; then
-        exit 0
-      fi
-      before=$(find "$HOME/Maildir" -path '*/new/*' -type f 2>/dev/null | wc -l)
-      ${pkgs.isync}/bin/mbsync -a
-      after=$(find "$HOME/Maildir" -path '*/new/*' -type f 2>/dev/null | wc -l)
-      new=$((after - before))
-      if [ "$new" -gt 0 ]; then
-        label="new message"
-        [ "$new" -ne 1 ] && label="new messages"
-        ${pkgs.libnotify}/bin/notify-send "Mail" "$new $label"
-      fi
-    '';
   in {
-    options.azos.mail.enable = lib.mkOption {
-      default = true;
-      type = lib.types.bool;
-    };
-    config = lib.mkIf config.azos.mail.enable {
-      programs = {
-        mu.enable = true;
-        mbsync.enable = true;
-        msmtp.enable = true;
-      };
-      home.activation.muInit = lib.hm.dag.entryAfter ["writeBoundary"] ''
-        if [ ! -d "$HOME/.cache/mu" ]; then
-          $DRY_RUN_CMD ${pkgs.mu}/bin/mu init \
-            --maildir="$HOME/Maildir" \
-            --my-address=aner@zakobar.com \
-            --my-address=anerisgreat@gmail.com \
-            --my-address=anerz@post.bgu.ac.il
-        fi
-      '';
+    config = {
+      azos.mail.enable = true;
+
+      # mbsync's PassCmd shells out to `pass`, which needs the GPG smartcard to
+      # decrypt -- only meaningful to gate on when the smartcard/YubiKey setup
+      # is actually in play.
+      azos.mail.presenceCheckCommand = lib.mkIf config.azos.encryption.yubikey.enable "${pkgs.azos-card-present}/bin/azos-card-present";
+
       accounts.email.accounts = {
         gmail =
           default_gmail_params
@@ -106,21 +67,6 @@
             passwordCommand = "pass privateemail.com | head -1";
           };
       };
-      systemd.user.services.mbsync-timer = {
-        Unit.Description = "Sync mail via mbsync (skips silently if smartcard is absent)";
-        Service = {
-          Type = "oneshot";
-          ExecStart = "${mbsyncSafe}";
-        };
-      };
-      systemd.user.timers.mbsync-timer = {
-        Unit.Description = "Periodic mbsync mail sync";
-        Timer = {
-          OnStartupSec = "2m";
-          OnUnitActiveSec = "5m";
-        };
-        Install.WantedBy = ["timers.target"];
-      };
     };
   };
 }