diff --git a/apps/desktop/src/lib/cryptoBackend.ts b/apps/desktop/src/lib/cryptoBackend.ts
index 776fea0..bb527d8 100644
--- a/apps/desktop/src/lib/cryptoBackend.ts
+++ b/apps/desktop/src/lib/cryptoBackend.ts
@@ -25,5 +25,13 @@ export async function createLibsodiumBackend(): Promise<CryptoBackend> {
       s.crypto_box_open_easy(ciphertext, nonce, senderPublicKey, recipientPrivateKey),
     secretbox: (plaintext, nonce, key) => s.crypto_secretbox_easy(plaintext, nonce, key),
     secretboxOpen: (ciphertext, nonce, key) => s.crypto_secretbox_open_easy(ciphertext, nonce, key),
+    pwhashConsts: {
+      OPSLIMIT_MODERATE: s.crypto_pwhash_OPSLIMIT_MODERATE,
+      MEMLIMIT_MODERATE: s.crypto_pwhash_MEMLIMIT_MODERATE,
+      ALG_ARGON2ID13: s.crypto_pwhash_ALG_ARGON2ID13,
+    },
+    pwhash: (outLen, password, salt, opslimit, memlimit, alg) =>
+      s.crypto_pwhash(outLen, password, salt, opslimit, memlimit, alg),
+    scalarMultBase: (priv) => s.crypto_scalarmult_base(priv),
   };
 }
diff --git a/apps/desktop/src/lib/userIdentity.ts b/apps/desktop/src/lib/userIdentity.ts
index a2c76ea..58177de 100644
--- a/apps/desktop/src/lib/userIdentity.ts
+++ b/apps/desktop/src/lib/userIdentity.ts
@@ -3,7 +3,7 @@ import {
   resetUserKey, tryUnlockUserKey, uploadUserKeyBlob,
 } from '@chat-app/shared/auth';
 import {
-  generateRecoveryCode, generateUserKeyPair, normalizeRecoveryCode,
+  generateRecoveryCode, generateUserKeyPair, getCryptoBackend, normalizeRecoveryCode,
   openUserKey, sealUserKey,
 } from '@chat-app/shared/crypto';
 import { migrateOwnLegacyBundles } from '@chat-app/shared/chat';
@@ -50,7 +50,7 @@ export async function setupNewUserIdentity(p: SetupParams): Promise<SetupResult>
 export async function ensureLegacyMigrated(userId: string): Promise<void> {
   const priv = await devLocalSecretStore.getSecret(cacheKey(userId));
   if (!priv) return;
-  const pub = await derivePublicKey(priv);
+  const pub = derivePublicKey(priv);
   await runLegacyMigration(userId, priv, pub);
 }
 
@@ -105,7 +105,7 @@ export async function changePin(params: {
   const fresh = await sealUserKey({ privateKey: cached, pin: params.newPin });
   await uploadUserKeyBlob(supabase, {
     userId: params.userId,
-    publicKey: await derivePublicKey(cached),
+    publicKey: derivePublicKey(cached),
     sealedPrivateKey: fresh.sealedPrivateKey,
     salt: fresh.salt,
     kdfParams: fresh.kdfParams,
@@ -122,7 +122,7 @@ export async function regenerateRecoveryCode(params: { userId: string }): Promis
   const sealed = await sealUserKey({ privateKey: cached, pin: normalizeRecoveryCode(recoveryCode) });
   await uploadUserKeyBlob(supabase, {
     userId: params.userId,
-    publicKey: await derivePublicKey(cached),
+    publicKey: derivePublicKey(cached),
     sealedPrivateKey: blob.sealedPrivateKey,
     salt: blob.salt,
     kdfParams: blob.kdfParams,
@@ -247,12 +247,10 @@ async function runLegacyMigration(
 export async function retryLegacyMigration(userId: string): Promise<LegacyMigrationReport> {
   const priv = await devLocalSecretStore.getSecret(cacheKey(userId));
   if (!priv) throw new Error('user key not cached locally — re-login required');
-  const pub = await derivePublicKey(priv);
+  const pub = derivePublicKey(priv);
   return runLegacyMigration(userId, priv, pub);
 }
 
-async function derivePublicKey(privateKey: Uint8Array): Promise<Uint8Array> {
-  const sodium = (await import('libsodium-wrappers-sumo')).default;
-  await sodium.ready;
-  return sodium.crypto_scalarmult_base(privateKey);
+function derivePublicKey(privateKey: Uint8Array): Uint8Array {
+  return getCryptoBackend().scalarMultBase(privateKey);
 }