diff --git a/azos-core b/azos-core
index 5f561f5..45f3e20 160000
--- a/azos-core
+++ b/azos-core
@@ -1 +1 @@
-Subproject commit 5f561f5408119e97f71e535395a7bf533c2a2662
+Subproject commit 45f3e2052268c19f9d1bb3ee9a195c77628d449a
diff --git a/features/mail/default.nix b/features/mail/default.nix
index 6c1ddae..60068f6 100644
--- a/features/mail/default.nix
+++ b/features/mail/default.nix
@@ -25,6 +25,17 @@
         certificatesFile = "/etc/ssl/certs/ca-certificates.crt";
       };
     };
+    # mbsync's PassCmd shells out to `pass`, which needs the GPG smartcard to
+    # decrypt. On a timer, a missing card would otherwise surface as a
+    # pinentry "please insert card" prompt every run. `gpg --card-status`
+    # only queries the card reader (no pinentry involved either way), so it's
+    # safe to use as a silent presence check: skip the sync entirely when the
+    # card isn't there, instead of letting mbsync hit that prompt.
+    mbsyncSafe = pkgs.writeShellScript "mbsync-safe" ''
+      if ${pkgs.gnupg}/bin/gpg --card-status >/dev/null 2>&1; then
+        exec ${pkgs.isync}/bin/mbsync -a
+      fi
+    '';
   in {
     options.azos.mail.enable = lib.mkOption {
       default = true;
@@ -35,7 +46,6 @@
         mu.enable = true;
         mbsync.enable = true;
         msmtp.enable = true;
-        lieer.enable = true;
       };
       home.activation.muInit = lib.hm.dag.entryAfter ["writeBoundary"] ''
         if [ ! -d "$HOME/.cache/mu" ]; then
@@ -46,7 +56,6 @@
             --my-address=anerz@post.bgu.ac.il
         fi
       '';
-      services.lieer.enable = true;
       accounts.email.accounts = {
         gmail =
           default_gmail_params
@@ -78,6 +87,21 @@
             passwordCommand = "pass privateemail.com | head -1";
           };
       };
+      systemd.user.services.mbsync-timer = {
+        Unit.Description = "Sync mail via mbsync (skips silently if smartcard is absent)";
+        Service = {
+          Type = "oneshot";
+          ExecStart = "${mbsyncSafe}";
+        };
+      };
+      systemd.user.timers.mbsync-timer = {
+        Unit.Description = "Periodic mbsync mail sync";
+        Timer = {
+          OnStartupSec = "2m";
+          OnUnitActiveSec = "5m";
+        };
+        Install.WantedBy = ["timers.target"];
+      };
     };
   };
 }