diff --git a/README.md b/README.md
index 0ebda5d..81ef7f2 100644
--- a/README.md
+++ b/README.md
@@ -9,10 +9,16 @@ git clone https://github.com/andwati/dotfiles ~/dev/dotfiles
 ~/dev/dotfiles/install.sh
 ```
 
-Symlinks `zsh/.zshrc`, `zsh/.zshenv`, `zsh/.zprofile`, and `zsh/.p10k.zsh` into
-`$HOME`, and clones oh-my-zsh plus the theme/plugins `.zshrc` expects
-(powerlevel10k, zsh-autosuggestions, zsh-syntax-highlighting,
-zsh-history-substring-search, zsh-completions, you-should-use).
+Symlinks `zsh/.zshrc`, `zsh/.zshenv`, `zsh/.zprofile`, `zsh/.p10k.zsh`, and
+`gnupg/.gnupg/gpg-agent.conf` into `$HOME`, and clones oh-my-zsh plus the
+theme/plugins `.zshrc` expects (powerlevel10k, zsh-autosuggestions,
+zsh-syntax-highlighting, zsh-history-substring-search, zsh-completions,
+you-should-use).
+
+`gpg-agent.conf` caches your GPG passphrase for 8 hours (24h hard cap)
+instead of the 10-minute default, so signed commits don't re-prompt
+constantly, and uses `pinentry-qt` for a native dialog instead of a
+terminal prompt.
 
 Not installed by the script — grab these separately if a fresh machine needs
 them: `nvm`, `pyenv`, `bun`, `pnpm`, `deno`, `rustup`, `docker`, `fzf`,
diff --git a/gnupg/.gnupg/gpg-agent.conf b/gnupg/.gnupg/gpg-agent.conf
new file mode 100644
index 0000000..ec9fa70
--- /dev/null
+++ b/gnupg/.gnupg/gpg-agent.conf
@@ -0,0 +1,3 @@
+default-cache-ttl 28800
+max-cache-ttl 86400
+pinentry-program /usr/bin/pinentry-qt
diff --git a/install.sh b/install.sh
index cbb7f4b..75d1f9c 100755
--- a/install.sh
+++ b/install.sh
@@ -39,6 +39,11 @@ link "$DOTFILES_DIR/zsh/.zshenv" "$HOME/.zshenv"
 link "$DOTFILES_DIR/zsh/.zprofile" "$HOME/.zprofile"
 link "$DOTFILES_DIR/zsh/.p10k.zsh" "$HOME/.p10k.zsh"
 
+mkdir -p "$HOME/.gnupg"
+chmod 700 "$HOME/.gnupg"
+link "$DOTFILES_DIR/gnupg/.gnupg/gpg-agent.conf" "$HOME/.gnupg/gpg-agent.conf"
+gpgconf --kill gpg-agent 2>/dev/null || true
+
 cat <<'EOF'
 
 Done. This does NOT install (grab these separately if missing):
diff --git a/zsh/.zshrc b/zsh/.zshrc
index 2a30020..105d559 100644
--- a/zsh/.zshrc
+++ b/zsh/.zshrc
@@ -112,6 +112,10 @@ command -v zoxide >/dev/null && eval "$(zoxide init zsh)"
 
 # User configuration
 
+# Needed for gpg-agent to prompt on the right terminal when pinentry falls
+# back to a tty (e.g. pinentry-curses); harmless no-op with pinentry-qt.
+export GPG_TTY=$(tty)
+
 # export MANPATH="/usr/local/man:$MANPATH"
 
 # You may need to manually set your language environment