diff --git a/scripts/keys b/scripts/keys
index 6625394..6ec6fb6 100755
--- a/scripts/keys
+++ b/scripts/keys
@@ -31,7 +31,6 @@ die()  { echo "error: $*" >&2; exit 1; }
 need() { command -v "$1" >/dev/null 2>&1 || die "missing required tool: $1"; }
 
 need pass-cli
-need jq
 
 # Resolve an active vault item by title → item ID, or empty string.
 # Active-only filter avoids the trashed-item-shadows-active bug (see deploy).
@@ -101,18 +100,19 @@ store_age_key() {
 # ---------------------------------------------------------------------------
 
 restore_ssh_key() {
-  local config="$1" title="ssh_host#$1" id json
+  local config="$1" title="ssh_host#$1" id private_key public_key
   id="$(resolve_item "$title")"
   if [ -z "$id" ]; then
     echo ">> $title: not in vault — skipping"
     return
   fi
   echo ">> $title: restoring"
-  json="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" --output json)"
-  private_key="$(jq -r '.item.content.content.SshKey.private_key' <<< "$json")"
-  public_key="$(jq  -r '.item.content.content.SshKey.public_key'  <<< "$json")"
-  [ -n "$private_key" ] || die "$title: private_key missing from vault item JSON"
-  [ -n "$public_key"  ] || die "$title: public_key missing from vault item JSON"
+  private_key="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" \
+    --field private_key --output human 2>/dev/null)"
+  public_key="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" \
+    --field public_key --output human 2>/dev/null)"
+  [ -n "$private_key" ] || die "$title: private_key field missing or empty in vault item"
+  [ -n "$public_key"  ] || die "$title: public_key field missing or empty in vault item"
   mkdir -p "$KEYDIR/$config"
   printf '%s' "$private_key" > "$KEYDIR/$config/ssh_host_ed25519_key"
   chmod 600 "$KEYDIR/$config/ssh_host_ed25519_key"
@@ -130,7 +130,7 @@ restore_age_key() {
   fi
   echo ">> $title: restoring"
   content="$(pass-cli item view --vault-name "$VAULT" --item-id "$id" \
-    --output json | jq -r '.item.content.note')"
+    --field note --output human 2>/dev/null)"
   [ -n "$content" ] || die "$title: note field is empty in vault item"
   mkdir -p "$(dirname "$dest")"
   printf '%s\n' "$content" > "$dest"
diff --git a/services/desktop/desktop-apps.nix b/services/desktop/desktop-apps.nix
index 74dab2a..20d6ad6 100644
--- a/services/desktop/desktop-apps.nix
+++ b/services/desktop/desktop-apps.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, inputs, ... }:
+{ pkgs, lib, ... }:
 
 let
   rishot = pkgs.callPackage ../../pkgs/rishot.nix { };
@@ -16,6 +16,7 @@ in
       "steam-unwrapped"
       "steam-run"
       "claude-code"
+      "proton-pass-cli"
       "vivaldi"
     ];
 
@@ -35,6 +36,7 @@ in
     kdePackages.dolphin
     vivaldi
     rishot
+    jq
     dotnetCorePackages.sdk_10_0
     nodejs
   ];