diff --git a/config/xdg-desktop-portal/hyprland-portals.conf b/config/xdg-desktop-portal/hyprland-portals.conf
new file mode 100644
index 00000000..fd802cbd
--- /dev/null
+++ b/config/xdg-desktop-portal/hyprland-portals.conf
@@ -0,0 +1,3 @@
+[preferred]
+default=hyprland;gtk
+org.freedesktop.impl.portal.Secret=gnome-keyring
diff --git a/migrations/1788261467.sh b/migrations/1788261467.sh
new file mode 100644
index 00000000..b3a6a724
--- /dev/null
+++ b/migrations/1788261467.sh
@@ -0,0 +1,23 @@
+echo "Expose GNOME Keyring to sandboxed apps through the Secret portal"
+
+portal_dir="${XDG_CONFIG_HOME:-$HOME/.config}/xdg-desktop-portal"
+portal_config="$portal_dir/hyprland-portals.conf"
+generic_config="$portal_dir/portals.conf"
+
+# Only apply if not configured yet
+if [[ -e $portal_config || -L $portal_config ]]; then
+  echo "Portal already configured, skipping..."
+  exit 0
+elif [[ -e $generic_config || -L $generic_config ]]; then
+  echo "Portal already configured, skipping..."
+  exit 0
+fi
+
+install -Dm644 "$OMARCHY_PATH/config/xdg-desktop-portal/hyprland-portals.conf" "$portal_config"
+
+# Activate the backend immediately in a live desktop
+if systemctl --user is-active --quiet xdg-desktop-portal.service 2>/dev/null; then
+  if ! systemctl --user restart xdg-desktop-portal.service; then
+    echo "Failed to restart xdg-desktop-portal" >&2
+  fi
+fi