diff --git a/home/roles/emacs/doom/config.el b/home/roles/emacs/doom/config.el
index e132a44..3919559 100644
--- a/home/roles/emacs/doom/config.el
+++ b/home/roles/emacs/doom/config.el
@@ -95,14 +95,15 @@
 
 ;; Define sync wrapper before use-package (so keybinding works)
 (defun my/org-caldav-sync-with-rbw ()
-  "Run org-caldav-sync with credentials from rbw."
+  "Run org-caldav-sync with credentials from rbw embedded in URL."
   (interactive)
   (require 'org-caldav)
   (let* ((password (my/get-rbw-password "nextcloud-caldav"))
-         (auth-string (base64-encode-string (format "johno:%s" password) t)))
-    ;; Set up URL basic auth cache (format: ((SERVER (PATH . BASE64-AUTH))))
-    (setq url-http-basic-auth-storage
-          `(("nextcloud.johnogle.info:443" ("/" . ,auth-string))))
+         ;; Embed credentials in URL (url-encode password in case of special chars)
+         (encoded-pass (url-hexify-string password)))
+    (setq org-caldav-url
+          (format "https://johno:%s@nextcloud.johnogle.info/remote.php/dav/calendars/johno"
+                  encoded-pass))
     (org-caldav-sync)))
 
 (use-package! org-caldav
@@ -114,7 +115,7 @@
          (:prefix ("a" . "agenda/calendar")
           :desc "Sync CalDAV" "s" #'my/org-caldav-sync-with-rbw)))
   :config
-  ;; Nextcloud CalDAV base URL
+  ;; Nextcloud CalDAV base URL (credentials added dynamically by sync wrapper)
   (setq org-caldav-url "https://nextcloud.johnogle.info/remote.php/dav/calendars/johno")
 
   ;; Timezone for iCalendar export