diff --git a/private_dot_config/private_fish/config.fish b/private_dot_config/private_fish/config.fish
index d0f5a51..8779760 100644
--- a/private_dot_config/private_fish/config.fish
+++ b/private_dot_config/private_fish/config.fish
@@ -275,7 +275,11 @@ fish_add_path $HOME/.antigravity/antigravity/bin
 source ~/.orbstack/shell/init2.fish 2>/dev/null || :
 
 # GitHub MCP plugin auth — pull PAT from keychain (avoids plaintext in config files)
-set -gx GITHUB_PERSONAL_ACCESS_TOKEN (security find-generic-password -s codex-github-mcp-pat -w 2>/dev/null)
+if type -q security
+    set -l github_pat (security find-generic-password -s codex-github-mcp-pat -w 2>/dev/null)
+    test -n "$github_pat"
+    and set -gx GITHUB_PERSONAL_ACCESS_TOKEN "$github_pat"
+end
 
 
 # >>> grok installer >>>