diff --git a/sys/modules/opus/security.lua b/sys/modules/opus/security.lua
index b99500f..8bdcbe4 100644
--- a/sys/modules/opus/security.lua
+++ b/sys/modules/opus/security.lua
@@ -64,6 +64,7 @@ function Security.updatePassword(password)
 		hash = derived:toHex(),
 		salt = salt,
 		iter = PBKDF2_ITERATIONS,
+		trustKey = SHA.compute(password),
 	}
 	Config.update('os', config)
 end
@@ -72,4 +73,15 @@ function Security.getPassword()
 	return Config.load('os').password
 end
 
+-- Returns the trust key for ChaCha20-based trust protocol.
+-- Compatible with both new (PBKDF2 table) and legacy (SHA-256 string) formats.
+function Security.getTrustKey()
+	local stored = Security.getPassword()
+	if type(stored) == 'table' then
+		return stored.trustKey
+	end
+	-- Legacy: the stored string IS the SHA-256 hex
+	return stored
+end
+
 return Security