diff --git a/home/roles/emacs/doom/config.el b/home/roles/emacs/doom/config.el
index 0759b0b..f5a23b0 100644
--- a/home/roles/emacs/doom/config.el
+++ b/home/roles/emacs/doom/config.el
@@ -88,13 +88,26 @@
 ;; 1. Create Nextcloud app password: Settings -> Security -> Devices & sessions
 ;; 2. Store in rbw: rbw add nextcloud-caldav (put app password as the secret)
 ;; 3. Run: doom sync
-;; 4. Test: M-x org-caldav-sync
+;; 4. Test: M-x my/org-caldav-sync-with-rbw (or SPC o a s)
 ;;
 ;; Note: Conflict resolution is "Org always wins" - treat Org as source of truth
 ;; for entries that originated in Org.
+
+;; Define sync wrapper before use-package (so keybinding works)
+(defun my/org-caldav-sync-with-rbw ()
+  "Run org-caldav-sync with credentials from rbw."
+  (interactive)
+  (require 'org-caldav)
+  (let* ((password (my/get-rbw-password "nextcloud-caldav"))
+         (auth-entry (list "nextcloud.johnogle.info:443"
+                           (cons "johno" password))))
+    ;; Set up URL auth cache
+    (setq url-http-basic-auth-storage (list auth-entry))
+    (org-caldav-sync)))
+
 (use-package! org-caldav
   :after org
-  :commands (org-caldav-sync)
+  :commands (org-caldav-sync my/org-caldav-sync-with-rbw)
   :init
   (map! :leader
         (:prefix ("o" . "open")
@@ -104,17 +117,6 @@
   ;; Nextcloud CalDAV base URL
   (setq org-caldav-url "https://nextcloud.johnogle.info/remote.php/dav/calendars/johno")
 
-  ;; Configure auth using rbw (bypasses need for GPG/.authinfo.gpg)
-  (defun my/org-caldav-sync-with-rbw ()
-    "Run org-caldav-sync with credentials from rbw."
-    (interactive)
-    (let* ((password (my/get-rbw-password "nextcloud-caldav"))
-           (auth-entry (list "nextcloud.johnogle.info:443"
-                             (cons "johno" password))))
-      ;; Set up URL auth cache
-      (setq url-http-basic-auth-storage (list auth-entry))
-      (org-caldav-sync)))
-
   ;; Timezone for iCalendar export
   (setq org-icalendar-timezone "America/Los_Angeles")