diff --git a/modules/services/proton-pass-agent.nix b/modules/services/proton-pass-agent.nix
index 2467ce685e..8be70b488d 100644
--- a/modules/services/proton-pass-agent.nix
+++ b/modules/services/proton-pass-agent.nix
@@ -94,10 +94,15 @@ in
         Unit = {
           Description = "Proton Pass SSH agent";
           Documentation = "https://protonpass.github.io/pass-cli/commands/ssh-agent/#ssh-agent-integration";
+          # Retry forever: the agent exits as long as `pass-cli login` has not
+          # been run, which would otherwise exhaust systemd's start rate limit
+          # and leave the unit dead until it is restarted manually.
+          StartLimitIntervalSec = 0;
         };
         Service = {
           ExecStart = lib.concatStringsSep " " cmd;
           Restart = "on-failure";
+          RestartSec = 10;
           KeyringMode = "shared";
         };
       };
diff --git a/tests/modules/services/proton-pass-agent/basic-service-expected.service b/tests/modules/services/proton-pass-agent/basic-service-expected.service
index 38aa1450d5..62dda03222 100644
--- a/tests/modules/services/proton-pass-agent/basic-service-expected.service
+++ b/tests/modules/services/proton-pass-agent/basic-service-expected.service
@@ -5,7 +5,9 @@ WantedBy=default.target
 ExecStart=@proton-pass-cli@/bin/pass-cli ssh-agent start --socket-path %t/proton-pass-agent/socket
 KeyringMode=shared
 Restart=on-failure
+RestartSec=10
 
 [Unit]
 Description=Proton Pass SSH agent
 Documentation=https://protonpass.github.io/pass-cli/commands/ssh-agent/#ssh-agent-integration
+StartLimitIntervalSec=0
diff --git a/tests/modules/services/proton-pass-agent/full-service-expected.service b/tests/modules/services/proton-pass-agent/full-service-expected.service
index f57af28d93..d41cd3a5a8 100644
--- a/tests/modules/services/proton-pass-agent/full-service-expected.service
+++ b/tests/modules/services/proton-pass-agent/full-service-expected.service
@@ -5,7 +5,9 @@ WantedBy=default.target
 ExecStart=@proton-pass-cli@/bin/pass-cli ssh-agent start --socket-path %t/proton-pass-agent/socket --share-id 123456789 --vault-name MySshKeyVault --refresh-interval 7200 --create-new-identities MySshKeyVault
 KeyringMode=shared
 Restart=on-failure
+RestartSec=10
 
 [Unit]
 Description=Proton Pass SSH agent
 Documentation=https://protonpass.github.io/pass-cli/commands/ssh-agent/#ssh-agent-integration
+StartLimitIntervalSec=0