diff --git a/meta/recipes-gnome/gcr/gcr/0001-gcr-initialize-libgcrypt-from-the-secret-exchange.patch b/meta/recipes-gnome/gcr/gcr/0001-gcr-initialize-libgcrypt-from-the-secret-exchange.patch
new file mode 100644
index 0000000000..3a55cf30aa
--- /dev/null
+++ b/meta/recipes-gnome/gcr/gcr/0001-gcr-initialize-libgcrypt-from-the-secret-exchange.patch
@@ -0,0 +1,81 @@
+From e8b729cc6ceddd22b5160f27396cf07cecd977ad Mon Sep 17 00:00:00 2001
+From: Markus Volk <f_l_k@t-online.de>
+Date: Tue, 15 Sep 2026 18:24:45 +0200
+Subject: [PATCH] gcr: initialize libgcrypt from the secret exchange
+
+gnome-shell logs this on the first keyring prompt:
+
+    gnome-shell: Libgcrypt warning: missing initialization - please fix the application
+
+gcr3 initialized libgcrypt from the class_init of GcrSecretExchange
+(gcr/gcr-secret-exchange.c:847). That call is gone in gcr 4, leaving
+only _gcr_initialize_library(), which is reached from the certificate,
+parser and importer paths but never from the prompt path.
+
+On top of that the guard in _gcr_initialize_library() is inverted, in
+gcr3 as much as in gcr 4:
+
+    static gint gcr_initialize = 0;
+    if (g_atomic_int_add (&gcr_initialize, 1) == 0)
+            return;
+
+g_atomic_int_add() returns the value from before the addition, so the
+first call returns without ever reaching egg_libgcrypt_initialize() and
+only the second one initializes anything.
+
+This is not what breaks the keyring - the secret exchange was tested
+against both gcr3 and gcr 4 and transfers the secret correctly either
+way - but libgcrypt then runs without the egg secure memory allocators,
+so passwords end up in ordinary swappable heap instead of locked pages.
+
+Fix the guard and initialize from the secret exchange again.
+
+Upstream-Status: Pending
+
+AI-Generated: Uses Claude Code (Claude Opus 5)
+---
+ gcr/gcr-library.c         | 3 ++-
+ gcr/gcr-secret-exchange.c | 9 +++++++++
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/gcr/gcr-library.c b/gcr/gcr-library.c
+index 560772b..9d03f25 100644
+--- a/gcr/gcr-library.c
++++ b/gcr/gcr-library.c
+@@ -125,7 +125,8 @@ _gcr_initialize_library (void)
+ {
+ 	static gint gcr_initialize = 0;
+ 
+-	if (g_atomic_int_add (&gcr_initialize, 1) == 0)
++	/* Initialize on the first call, do nothing on every call after it */
++	if (g_atomic_int_add (&gcr_initialize, 1) != 0)
+ 		return;
+ 
+ #ifdef WITH_GCRYPT
+diff --git a/gcr/gcr-secret-exchange.c b/gcr/gcr-secret-exchange.c
+index 943b2af..3e5f889 100644
+--- a/gcr/gcr-secret-exchange.c
++++ b/gcr/gcr-secret-exchange.c
+@@ -21,6 +21,8 @@
+ 
+ #include "gcr-secret-exchange.h"
+ 
++#include "gcr-internal.h"
++
+ #include "egg/egg-crypto.h"
+ #include "egg/egg-dh.h"
+ #include "egg/egg-fips.h"
+@@ -817,6 +819,13 @@ gcr_secret_exchange_class_init (GcrSecretExchangeClass *klass)
+ 	klass->decrypt_transport_data = gcr_secret_exchange_default_decrypt_transport_data;
+ 	klass->encrypt_transport_data = gcr_secret_exchange_default_encrypt_transport_data;
+ 
++	/*
++	 * The exchange is the only part of the library that some callers ever
++	 * touch - gnome-shell through keyring.js for one - so initialize
++	 * libgcrypt here as well. gcr3 did this and gcr-4 dropped it.
++	 */
++	_gcr_initialize_library ();
++
+ 	/**
+ 	 * GcrSecretExchange:protocol:
+ 	 *
diff --git a/meta/recipes-gnome/gcr/gcr_4.4.1.bb b/meta/recipes-gnome/gcr/gcr_4.4.1.bb
index 93028d2497..aedbe60b69 100644
--- a/meta/recipes-gnome/gcr/gcr_4.4.1.bb
+++ b/meta/recipes-gnome/gcr/gcr_4.4.1.bb
@@ -17,6 +17,7 @@ inherit gnomebase gi-docgen vala gobject-introspection lib_package
 UPSTREAM_CHECK_REGEX = "gcr-(?P<pver>\d+\.\d+\.(?!9\d+)\d+(\.\d+)?)"
 
 SRC_URI[archive.sha256sum] = "c4442c15d4330f17a1f5194df08c576877af68412ab2521446a93bd5e24c931b"
+SRC_URI += "file://0001-gcr-initialize-libgcrypt-from-the-secret-exchange.patch"
 
 PACKAGECONFIG ??= "${@bb.utils.contains('GI_DATA_ENABLED', 'True', 'vapi', '', d)}"
 PACKAGECONFIG[ssh_agent] = "-Dssh_agent=true,-Dssh_agent=false,libsecret"