diff --git a/.changeset/relay-keyring-session.md b/.changeset/relay-keyring-session.md
new file mode 100644
index 0000000..bc19c38
--- /dev/null
+++ b/.changeset/relay-keyring-session.md
@@ -0,0 +1,5 @@
+---
+"grok-bot-cli": patch
+---
+
+Isolate relay workers by their desktop keyring environment so headless MCP callers cannot replace the authenticated worker used by desktop CLI callers.
diff --git a/src/core/relay/profile.js b/src/core/relay/profile.js
index 39a18be..9b2070d 100644
--- a/src/core/relay/profile.js
+++ b/src/core/relay/profile.js
@@ -30,6 +30,9 @@ export function relayProfile(env = process.env) {
     "GROK_BOT_ALLOW_ANY_GATEWAY",
     "GROK_BOT_TEST",
     "NODE_ENV",
+    // Secret Service credentials depend on the caller's desktop session.
+    "DBUS_SESSION_BUS_ADDRESS",
+    "DISPLAY",
   ];
   return digest(
     JSON.stringify([
diff --git a/test/relay-worker.test.js b/test/relay-worker.test.js
index d00df70..3a3f172 100644
--- a/test/relay-worker.test.js
+++ b/test/relay-worker.test.js
@@ -25,6 +25,8 @@ test("profile shares hosts but isolates endpoint, auth overrides and caller rest
     { GROK_BOT_GATEWAY_HEADERS: '{"x-route":"secret"}' },
     { CODEX_APP_SERVER_SOCK: "/other.sock" },
     { GROK_BOT_TEST: "0" },
+    { DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/1000/bus" },
+    { DISPLAY: ":0" },
   ])
     assert.notEqual(base, relayProfile({ ...env, ...extra }));
   assert.ok(