diff --git a/home/roles/emacs/doom/config.el b/home/roles/emacs/doom/config.el
index 7623942..f3f6561 100644
--- a/home/roles/emacs/doom/config.el
+++ b/home/roles/emacs/doom/config.el
@@ -187,10 +187,13 @@
   )
 
 (defun my/get-rbw-password (alias)
-  "Return the password for ALIAS via rbw, unlocking the vault only if needed."
-  (let* ((cmd     (format "rbw get %s 2>&1" alias))
-         (output  (shell-command-to-string cmd)))
-    (string-trim output)))
+  "Return the password for ALIAS via rbw, unlocking the vault only if needed.
+Returns nil and signals an error if the entry is not found."
+  (let* ((cmd (format "rbw get %s 2>/dev/null" (shell-quote-argument alias)))
+         (output (string-trim (shell-command-to-string cmd))))
+    (if (string-empty-p output)
+        (user-error "rbw: no entry found for '%s' - run: rbw add %s" alias alias)
+      output)))
 
 (after! gptel
   :config