diff --git a/docs/plugins/onepassword.md b/docs/plugins/onepassword.md
index 9bf0dfd18b54..d56b01a534de 100644
--- a/docs/plugins/onepassword.md
+++ b/docs/plugins/onepassword.md
@@ -35,6 +35,10 @@ variables or resolve OpenClaw config secrets.
   value.
 - The plugin invokes `op` once per cache miss. It does not retry rate limits or
   other failures.
+- Each `op` call runs with a minimal environment that disables 1Password
+  desktop-app integration (`OP_LOAD_DESKTOP_APP_SETTINGS=false`,
+  `OP_BIOMETRIC_UNLOCK_ENABLED=false`), so a 1Password app installed on the
+  Gateway host never triggers biometric or macOS permission dialogs.
 
 Give the service account read access only to the vaults and items registered in
 the plugin config.
diff --git a/extensions/onepassword/src/op-client.test.ts b/extensions/onepassword/src/op-client.test.ts
index ec65942e13ed..910219fa4497 100644
--- a/extensions/onepassword/src/op-client.test.ts
+++ b/extensions/onepassword/src/op-client.test.ts
@@ -67,7 +67,12 @@ describe("OpClient", () => {
         "--cache=false",
       ],
       {
-        env: { OP_SERVICE_ACCOUNT_TOKEN: fixtureAuth, HOME: root },
+        env: {
+          OP_SERVICE_ACCOUNT_TOKEN: fixtureAuth,
+          HOME: root,
+          OP_LOAD_DESKTOP_APP_SETTINGS: "false",
+          OP_BIOMETRIC_UNLOCK_ENABLED: "false",
+        },
         timeoutMs: 1234,
         maxBufferBytes: 1024 * 1024,
       },
diff --git a/extensions/onepassword/src/op-client.ts b/extensions/onepassword/src/op-client.ts
index aefd25d4c6fa..35466e9396ec 100644
--- a/extensions/onepassword/src/op-client.ts
+++ b/extensions/onepassword/src/op-client.ts
@@ -241,6 +241,12 @@ export class OpClient {
         env: {
           OP_SERVICE_ACCOUNT_TOKEN: token,
           HOME: this.home,
+          // Force the pure service-account path. Without both overrides, op
+          // 2.35 on macOS still reads the 1Password desktop app's settings and
+          // can block on a per-PID App Data Protection dialog until a human
+          // answers, hanging the broker for timeoutMs on Mac gateway hosts.
+          OP_LOAD_DESKTOP_APP_SETTINGS: "false",
+          OP_BIOMETRIC_UNLOCK_ENABLED: "false",
         },
         timeoutMs: this.timeoutMs,
         maxBufferBytes: MAX_STDOUT_BYTES,