Age can't access Yubikey during stage 1, but age-plugin-yubikey can

Help
1

Aight, hopefully the last question I’ll ask for a while. I have managed to get age-plugin-yubikey working during stage 1, but now age itself can’t seem to use it to decrypt my secret, with the error:

age: error: yubikey plugin: Could not open YubiKey with serial 31312153
age: report unexpected or unhelpful errors at https://filippo.io/age/report

The identity on the Yubikey itself is being accessed just fine, however, and I’m using the same age package that can decrypt the secrets in the agenix activationScripts, so I’m not sure what’s happening there. Something tells me that the plugin and package paths I’m adding to boot.initrd.systemd.storePath aren’t the same paths that are wrapping the age package:

# Adapted From: https://github.com/ryantm/agenix/issues/237#issuecomment-3468459734
age.package = (cfg.plugins.ageBin.withPlugins (apkgs: cfg.plugins.packages)).overrideAttrs (old: {
  meta = (old.meta or { }) // {
    mainProgram = "age";
  };
});

Should I be using the apkgs argument instead of directly using cfg.plugins.packages, or is there a way I can add the paths wrapping the age package to the storePaths?

Sorry for the ramble. Just trying to wrap my head around this.

2

Welp. Found the problem. Needed to run pcscd before every Yubikey access, i.e. once before running age-plugin-yubikey, once before the wrapped age command, etc. Anybody have any pointers on what to research regarding this?