diff --git a/config/chromium-flags.conf b/config/chromium-flags.conf
index 134fa04e..5edf16a7 100644
--- a/config/chromium-flags.conf
+++ b/config/chromium-flags.conf
@@ -1,4 +1,5 @@
 --ozone-platform=wayland
 --ozone-platform-hint=wayland
+--password-store=gnome-libsecret
 --enable-features=TouchpadOverscrollHistoryNavigation
 --load-extension=/usr/share/omarchy/default/chromium/extensions/copy-url,/usr/share/omarchy/default/chromium/extensions/yt-dlp
diff --git a/migrations/1784508556.sh b/migrations/1784508556.sh
new file mode 100644
index 00000000..7859fd01
--- /dev/null
+++ b/migrations/1784508556.sh
@@ -0,0 +1,13 @@
+echo "Pin browser password store to gnome-libsecret (prevents cookie/login loss on Hyprland)"
+
+# Chromium-based browsers auto-detect their os_crypt backend; on Hyprland the xdg-desktop-portal
+# Secret backend has no provider and fails, so they can fall back to the 'basic' (v10) store.
+# A swap from the gnome-libsecret (v11) key to the basic key makes existing cookies and saved
+# passwords undecryptable, so the browser silently drops them and the user is logged out of
+# everything. Pin gnome-libsecret so the backend is deterministic across reboots and updates.
+for conf in ~/.config/{chromium,brave,chrome,microsoft-edge-stable}-flags.conf; do
+  if [[ -f $conf ]] && ! grep -q -- '--password-store=' "$conf"; then
+    [[ -n $(tail -c1 "$conf") ]] && echo >>"$conf"
+    echo '--password-store=gnome-libsecret' >>"$conf"
+  fi
+done