diff --git a/lib/session.sh b/lib/session.sh
index d6f4cde..0ed7a7e 100644
--- a/lib/session.sh
+++ b/lib/session.sh
@@ -82,9 +82,11 @@ write_x11_session() {
 
 # Common login-time plumbing every Wayland compositor wants on a bare install.
 install_session_prereqs() {
-    # polkit-kde ships the agent AND its /etc/xdg/autostart .desktop itself —
-    # no manual wiring needed. (polkit-gnome is orphaned, EPEL-only: not on F44,
-    # which is why the first attempt failed with "No match for argument".)
+    # polkit-kde ships the agent (polkit-gnome is orphaned, EPEL-only).
+    # BUT its autostart file has OnlyShowIn=KDE; — XDG autostart SKIPS it in a
+    # niri/Hyprland/MangoWC session (VM-proven: package installed, error
+    # persisted). Copy the .desktop without the OnlyShowIn line so the agent
+    # starts in every session; the copy shadows the original by name.
     install_packages \
         xdg-desktop-portal \
         polkit \
@@ -92,4 +94,14 @@ install_session_prereqs() {
         pipewire \
         pipewire-pulseaudio \
         wireplumber
+
+    local src="${POLKIT_AGENT_DESKTOP:-/etc/xdg/autostart/polkit-kde-authentication-agent-1.desktop}"
+    local dst="${XDG_AUTOSTART_DIR:-/etc/xdg/autostart}/polkit-kde-authentication-agent-1.desktop"
+    # src and dst are the same file in production — the condition to rewrite
+    # is "the file still contains OnlyShowIn", not "dst lacks it".
+    if [[ -f "$src" ]] && grep -q "^OnlyShowIn=" "$src" 2>/dev/null; then
+        info "Making polkit agent session-agnostic (stripping OnlyShowIn=KDE)..."
+        sudo mkdir -p "$(dirname "$dst")"
+        grep -v '^OnlyShowIn=' "$src" | sudo tee "$dst" >/dev/null
+    fi
 }