diff --git a/lass/2configs/yubikey.nix b/lass/2configs/yubikey.nix
index a37752d5e..bf6a587af 100644
--- a/lass/2configs/yubikey.nix
+++ b/lass/2configs/yubikey.nix
@@ -3,6 +3,7 @@
   environment.systemPackages = with pkgs; [
     yubikey-personalization
     yubikey-manager
+    pinentry-curses pinentry-qt
   ];
 
   services.udev.packages = with pkgs; [ yubikey-personalization ];
@@ -11,6 +12,7 @@
   services.pcscd.enable = true;
   systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" ''
     set -x
+    mkdir -p $HOME/.gnupg
     ${pkgs.coreutils}/bin/ln -sf ${pkgs.writeText "scdaemon.conf" ''
       disable-ccid
       pcsc-driver ${pkgs.pcsclite.out}/lib/libpcsclite.so.1
@@ -25,6 +27,10 @@
       reader-port Yubico YubiKey
     ''} $HOME/.gnupg/scdaemon.conf
   '';
+  systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
+    ${pkgs.gnupg}/bin/gpg --import ${../../kartei/lass/pgp/yubikey.pgp} >/dev/null
+    echo -e '5\ny\n' | gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || :
+  '';
 
   security.polkit.extraConfig = ''
     polkit.addRule(function(action, subject) {
@@ -38,13 +44,14 @@
       }
     });
     polkit.addRule(function(action, subject) {
-     polkit.log("subject: " + subject + " action: " + action);
+      polkit.log("subject: " + subject + " action: " + action);
     });
   '';
 
   environment.shellInit = ''
     if [ "$UID" -eq 1337 ] && [ -z "$SSH_CONNECTION" ]; then
       export GPG_TTY="$(tty)"
+      mkdir -p $HOME/.gnupg
       gpg-connect-agent --quiet updatestartuptty /bye > /dev/null
       export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
       if [ -z "$SSH_AUTH_SOCK" ]; then
@@ -61,6 +68,7 @@
     ssh.startAgent = false;
     gnupg.agent = {
       enable = true;
+      pinentryFlavor = "qt";
       # enableSSHSupport = true;
     };
   };