diff --git a/.chezmoiscripts/run_once_setup-ssh-keys.sh.tmpl b/.chezmoiscripts/run_once_setup-ssh-keys.sh.tmpl
index 4d8be86..ffd397a 100644
--- a/.chezmoiscripts/run_once_setup-ssh-keys.sh.tmpl
+++ b/.chezmoiscripts/run_once_setup-ssh-keys.sh.tmpl
@@ -18,6 +18,29 @@ SSH_DIR="$HOME/.ssh"
 mkdir -p "$SSH_DIR"
 chmod 700 "$SSH_DIR"
 
+# Verify Bitwarden is unlocked before fetching keys
+echo "  Checking Bitwarden vault status..."
+BW_STATUS=$(bw status 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('status','unauthenticated'))" 2>/dev/null || echo "unauthenticated")
+
+if [ "$BW_STATUS" != "unlocked" ]; then
+    if [ -n "${BW_SESSION:-}" ]; then
+        echo "  Session locked — unlocking with BW_SESSION..."
+        export BW_SESSION
+        BW_SESSION=$(bw unlock --raw 2>/dev/null)
+        BW_STATUS=$(bw status 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('status','unauthenticated'))" 2>/dev/null || echo "unauthenticated")
+    fi
+
+    if [ "$BW_STATUS" != "unlocked" ]; then
+        echo "  WARNING: Bitwarden vault is not unlocked. Skipping SSH key setup."
+        echo "  Run: export BW_SESSION=\$(bw unlock --raw) && chezmoi apply"
+        exit 0
+    fi
+fi
+
+# Pre-sync to avoid sequential sync delays per key fetch
+echo "  Syncing vault..."
+bw sync 2>/dev/null || true
+
 write_key() {
     local name="$1"
     local bw_item_name="$2"
@@ -29,8 +52,7 @@ write_key() {
     fi
 
     echo "  Fetching key: $bw_item_name -> $name"
-    # bw get notes "Item Name" returns the secure note content
-    bw get notes "$bw_item_name" 2>/dev/null > "$key_path" || {
+    bw get notes --session "$BW_SESSION" "$bw_item_name" 2>/dev/null > "$key_path" || {
         echo "  WARNING: Could not fetch '$bw_item_name' from Bitwarden. Skipping."
         rm -f "$key_path"
         return
diff --git a/.chezmoiscripts/run_once_windows_setup-ssh-keys.ps1.tmpl b/.chezmoiscripts/run_once_windows_setup-ssh-keys.ps1.tmpl
index d9f08cf..1a62f8e 100644
--- a/.chezmoiscripts/run_once_windows_setup-ssh-keys.ps1.tmpl
+++ b/.chezmoiscripts/run_once_windows_setup-ssh-keys.ps1.tmpl
@@ -17,6 +17,29 @@ Write-Host "==> Setting up SSH keys from Bitwarden..." -ForegroundColor Cyan
 $SshDir = Join-Path $env:USERPROFILE ".ssh"
 New-Item -ItemType Directory -Force $SshDir | Out-Null
 
+# Verify Bitwarden is unlocked before fetching keys
+Write-Host "  Checking Bitwarden vault status... " -NoNewline
+$bwStatus = (bw status 2>&1 | ConvertFrom-Json).status
+if ($bwStatus -ne "unlocked") {
+    Write-Host "locked" -ForegroundColor Yellow
+    if ($env:BW_SESSION) {
+        Write-Host "  Session locked — unlocking with BW_SESSION..." -ForegroundColor Yellow
+        $env:BW_SESSION = bw unlock --raw 2>&1
+        $bwStatus = (bw status 2>&1 | ConvertFrom-Json).status
+    }
+    if ($bwStatus -ne "unlocked") {
+        Write-Host "  WARNING: Bitwarden vault is not unlocked. Skipping SSH key setup." -ForegroundColor Yellow
+        Write-Host "  Run: `$env:BW_SESSION = bw unlock --raw; chezmoi apply"
+        exit 0
+    }
+} else {
+    Write-Host "unlocked" -ForegroundColor Green
+}
+
+# Pre-sync to avoid sequential sync delays per key fetch
+Write-Host "  Syncing vault..."
+bw sync 2>&1 | Out-Null
+
 function Write-Key($name, $bwItemName) {
     $keyPath = Join-Path $SshDir $name
 
@@ -28,7 +51,7 @@ function Write-Key($name, $bwItemName) {
     Write-Host "  Fetching key: $bwItemName -> $name" -NoNewline
 
     try {
-        $content = bw get notes "$bwItemName" 2>&1
+        $content = bw get notes --session $env:BW_SESSION "$bwItemName" 2>&1
         if ($LASTEXITCODE -ne 0) { throw $content }
         [System.IO.File]::WriteAllText($keyPath, $content)
         & icacls $keyPath /inheritance:r /grant "$env:USERNAME:(R,W)" /q 2>&1 | Out-Null