diff --git a/flake.nix b/flake.nix
index d9b2e66..e129efb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -48,6 +48,10 @@
             --bind "$HOME/.claude" "$HOME/.claude"
             --bind "$HOME/.claude.json" "$HOME/.claude.json"
 
+            # Writable: GPG keyring + agent socket (commit signing)
+            --bind "$HOME/.gnupg" "$HOME/.gnupg"
+            --bind-try "''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/gnupg" "''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/gnupg"
+
             --ro-bind "$HOME/.gitconfig" "$HOME/.gitconfig"
             --ro-bind "$HOME/.ssh" "$HOME/.ssh"
             --setenv GIT_SSH_COMMAND "ssh -F ~/.ssh/config"
@@ -61,6 +65,7 @@
             --setenv PATH "$PATH"
             --setenv TERM "''${TERM:-xterm}"
             --setenv SANDBOX_ACTIVE "1"
+            --setenv GPG_TTY "''${GPG_TTY:-}"
             --chdir "$PROJECT_DIR"
           )