diff --git a/flake.lock b/flake.lock
index acbd4b5..5be8b02 100644
--- a/flake.lock
+++ b/flake.lock
@@ -265,11 +265,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1774412760,
-        "narHash": "sha256-X5xu0MTdqMSSQwRojn8DG8B614FepRR9rJ8CqjG5frI=",
+        "lastModified": 1774622711,
+        "narHash": "sha256-ClwgphRM+reX96UMkNv6LxcOljFPIZEziyV9ikxJ1Ek=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "80c08424d7edbc6a9e6492caa7a68bd64759af19",
+        "rev": "275aaf50be7c4249d77981c2c72ee3db9daa254a",
         "type": "github"
       },
       "original": {
@@ -371,11 +371,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1773840656,
-        "narHash": "sha256-9tpvMGFteZnd3gRQZFlRCohVpqooygFuy9yjuyRL2C0=",
+        "lastModified": 1774273680,
+        "narHash": "sha256-a++tZ1RQsDb1I0NHrFwdGuRlR5TORvCEUksM459wKUA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9cf7092bdd603554bd8b63c216e8943cf9b12512",
+        "rev": "fdc7b8f7b30fdbedec91b71ed82f36e1637483ed",
         "type": "github"
       },
       "original": {
diff --git a/modules/home/secrets.nix b/modules/home/secrets.nix
index 696d88c..34b0fa7 100644
--- a/modules/home/secrets.nix
+++ b/modules/home/secrets.nix
@@ -74,10 +74,11 @@ in
         generateKey = true;
       };
 
-      # Ensure the LaunchAgent on macOS can find `getconf` (needed by
-      # sops-install-secrets to resolve DARWIN_USER_TEMP_DIR).
-      # Without this, age.plugins produces an empty PATH.
-      environment.PATH = lib.mkForce "/usr/bin";
+      # The LaunchAgent runs with a minimal PATH. sops-install-secrets needs:
+      #   /usr/bin   – getconf (resolves DARWIN_USER_TEMP_DIR)
+      #   /usr/sbin  – diskutil (RAM disk management)
+      #   /sbin      – newfs_hfs (creates the HFS RAM disk for decrypted secrets)
+      environment.PATH = lib.mkForce "/usr/bin:/usr/sbin:/sbin";
 
       secrets = lib.mapAttrs sanitizeSecret cfg.secrets;
     }