diff --git a/.gitignore b/.gitignore
index d2e7f5d3b..d930940a7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 # AI
 .claude
 .devenv.nix
+objectstore
 
 # Nix
 .devenv
diff --git a/home-manager/services/cliproxyapi/default.nix b/home-manager/services/cliproxyapi/default.nix
index 66b1b049a..3f40f77af 100644
--- a/home-manager/services/cliproxyapi/default.nix
+++ b/home-manager/services/cliproxyapi/default.nix
@@ -9,10 +9,16 @@ in
     config = {
       ProgramArguments = [
         "${pkgs.bash}/bin/bash"
-        "${./start.sh}"
+        "${./scripts/start.sh}"
       ];
       Environment = {
-        PATH = "${lib.makeBinPath [ pkgs.gnused ]}:/opt/homebrew/bin:/usr/local/bin";
+        HOME = "/Users/shunkakinoki";
+        PATH = "${
+          lib.makeBinPath [
+            pkgs.gnused
+            pkgs.coreutils
+          ]
+        }:/opt/homebrew/bin:/usr/local/bin:/usr/bin";
       };
       KeepAlive = true;
       RunAtLoad = true;
@@ -34,7 +40,7 @@ in
           pkgs.bash
         ]
       }";
-      ExecStart = "${pkgs.bash}/bin/bash ${./start.sh}";
+      ExecStart = "${pkgs.bash}/bin/bash ${./scripts/start.sh}";
       Restart = "always";
       RestartSec = 3;
     };
diff --git a/home-manager/services/cliproxyapi/start.sh b/home-manager/services/cliproxyapi/scripts/start.sh
similarity index 76%
rename from home-manager/services/cliproxyapi/start.sh
rename to home-manager/services/cliproxyapi/scripts/start.sh
index 6cf66b488..1220c2452 100755
--- a/home-manager/services/cliproxyapi/start.sh
+++ b/home-manager/services/cliproxyapi/scripts/start.sh
@@ -24,13 +24,6 @@ export OBJECTSTORE_BUCKET="${OBJECTSTORE_BUCKET:-${AWS_S3_BUCKET:-}}"
 export OBJECTSTORE_ACCESS_KEY="${OBJECTSTORE_ACCESS_KEY:-${AWS_ACCESS_KEY_ID:-}}"
 export OBJECTSTORE_SECRET_KEY="${OBJECTSTORE_SECRET_KEY:-${AWS_SECRET_ACCESS_KEY:-}}"
 
-# Backup auth files to R2 before starting service
-# This protects against race condition deletions
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-if [ -x "$SCRIPT_DIR/scripts/backup-auth.sh" ]; then
-  bash "$SCRIPT_DIR/scripts/backup-auth.sh"
-fi
-
 # Generate config from template with secrets injected
 if [ -f "$TEMPLATE" ]; then
   sed \
@@ -38,12 +31,9 @@ if [ -f "$TEMPLATE" ]; then
     -e "s|__CLIPROXY_MANAGEMENT_PASSWORD__|${CLIPROXY_MANAGEMENT_PASSWORD:-}|g" \
     -e "s|__ZAI_API_KEY__|${ZAI_API_KEY:-}|g" \
     "$TEMPLATE" >"$CONFIG"
-fi
-
-# Recover auth files from backup if they're missing
-# This handles race condition where files get deleted during config reload
-if [ -x "$SCRIPT_DIR/scripts/recover-auth.sh" ]; then
-  bash "$SCRIPT_DIR/scripts/recover-auth.sh"
+  # Also copy to objectstore config location (cliproxyapi uses this for persistence)
+  mkdir -p "$CONFIG_DIR/objectstore/config"
+  cp "$CONFIG" "$CONFIG_DIR/objectstore/config/config.yaml"
 fi
 
 # Change to config dir so logs are created there