diff --git a/config.el b/config.el
index 93a7304..73bff49 100644
--- a/config.el
+++ b/config.el
@@ -1732,16 +1732,40 @@ current frame."
 
 ;;; --- Tier 1: High impact ---
 
-;; org-caldav — CalDAV sync for org
+;; org-caldav — CalDAV sync for org (Baikal server, Digest auth)
+;; Credentials: add to ~/.authinfo:
+;;   machine cal.apps.sukany.cz login martin password YOUR_PASSWORD
 (use-package! org-caldav
-  :commands org-caldav-sync
+  :commands (org-caldav-sync my/org-caldav-sync)
   :config
   (setq org-caldav-url "https://cal.apps.sukany.cz/dav.php/calendars/martin"
         org-caldav-calendar-id "default"
         org-caldav-inbox "~/org/caldav-inbox.org"
         org-caldav-files '("~/org/personal.org" "~/org/work.org")
-        org-caldav-sync-direction 'twoway))
-(map! :leader "o c" #'org-caldav-sync)
+        org-caldav-sync-direction 'twoway)
+
+  ;; Baikal uses Digest auth. Pre-register credentials from ~/.authinfo
+  ;; so Emacs url package doesn't prompt interactively.
+  (defun my/caldav-setup-digest-auth ()
+    "Load Digest auth credentials for Baikal from auth-source (~/.authinfo)."
+    (require 'url-auth)
+    (let* ((found (car (auth-source-search :host "cal.apps.sukany.cz"
+                                           :user "martin" :max 1)))
+           (pass  (when found
+                    (let ((s (plist-get found :secret)))
+                      (if (functionp s) (funcall s) s)))))
+      (when pass
+        (add-to-list 'url-digest-auth-user-pass
+                     (cons (cons "cal.apps.sukany.cz" "BaikalDAV")
+                           (cons "martin" pass))))))
+
+  (defun my/org-caldav-sync ()
+    "Sync org-caldav after pre-registering Baikal Digest auth."
+    (interactive)
+    (my/caldav-setup-digest-auth)
+    (org-caldav-sync)))
+
+(map! :leader "o c" #'my/org-caldav-sync)
 
 ;; envrc — direnv integration
 (use-package! envrc