# Shadows /usr/share/dbus-1/services/org.freedesktop.secrets.service so that a
 # bus-activated Secret Service converges on the SAME unit the session starts,
 # rather than on the stock file's bare
 # `gnome-keyring-daemon --start --components=secrets`.
 #
 # That distinction is the whole point. The stock Exec would spawn a keyring
 # daemon OUTSIDE gnome-keyring-daemon.service, so it would miss the drop-in
 # that feeds it the TPM-sealed password — i.e. a LOCKED keyring, and a second
 # daemon racing the unit's own for the bus name. Two daemons fighting over
 # org.freedesktop.secrets is exactly the nondeterminism that made the previous
 # KeePassXC-based chain unlock on only ~75% of logins.
 #
 # SystemdService, not a bare Exec: the first client to touch the bus name at
 # login (cce-mail's keyring lookup beats graphical-session.target) would
 # otherwise activate a provider outside the unit, which then owns the name
 # while the unit's instance finds it taken and exits. With SystemdService both
 # start paths converge on the one unit. Exec is the spec-required fallback and
 # must never fire on a systemd user bus.
 [D-BUS Service]
 Name=org.freedesktop.secrets
 Exec=/usr/bin/false
 SystemdService=gnome-keyring-daemon.service