--- a/internal/providers/bitwarden/setup.go
+++ b/internal/providers/bitwarden/setup.go
@@ -34,7 +34,7 @@
 func Setup() {
 	LoadConfig()
 
-	initItems()
+	// Vault access is initiated by an explicit query, never daemon startup.
 }
 
 func LoadConfig() {
--- a/internal/providers/bitwarden/query.go
+++ b/internal/providers/bitwarden/query.go
@@ -7,6 +7,7 @@
 	"net"
 	"os/exec"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/abenz1267/elephant/v2/pkg/common"
@@ -20,7 +21,24 @@
 	Folder string `json:"folder"`
 }
 
+var itemsMu sync.Mutex
+
 func initItems() {
+	itemsMu.Lock()
+	defer itemsMu.Unlock()
+	initItemsLocked()
+}
+
+func items() []RbwItem {
+	itemsMu.Lock()
+	defer itemsMu.Unlock()
+	if cachedItems == nil {
+		initItemsLocked()
+	}
+	return cachedItems
+}
+
+func initItemsLocked() {
 	cachedItems = nil
 	cmd := exec.Command("rbw", "list", "--raw")
 	output, err := cmd.CombinedOutput()
@@ -40,7 +58,7 @@
 
 	entries := []*pb.QueryResponse_Item{}
 
-	for k, v := range cachedItems {
+	for k, v := range items() {
 		var subtexts []string
 		actions := []string{ActionCopyPassword, ActionCopyTotp, ActionSyncVault}
 		if config.AutoTypeSupport {