diff --git a/core/core.el b/core/core.el
index 278b5bb34..476363332 100644
--- a/core/core.el
+++ b/core/core.el
@@ -105,6 +105,17 @@ melodramatic ex-vimmer disappointed with the text-editor status quo."
  url-cache-directory          (concat doom-cache-dir "url/")
  url-configuration-directory  (concat doom-etc-dir "url/"))
 
+(after! epa
+  (setq epa-file-encrypt-to (or epa-file-encrypt-to user-mail-address)
+        ;; With GPG 2.1, this lets Emacs prompt for gpg key passphrases
+        epa-pinentry-mode 'loopback))
+
+(defun doom*no-authinfo-for-tramp (orig-fn &rest args)
+  "Don't look into .authinfo for local sudo TRAMP buffers."
+  (let ((auth-sources (if (equal tramp-current-method "sudo") nil auth-sources)))
+    (apply orig-fn args)))
+(advice-add #'tramp-read-passwd :around #'doom*no-authinfo-for-tramp)
+
 ;; move custom defs out of init.el
 (setq custom-file (concat doom-etc-dir "custom.el"))
 (load custom-file t t)
diff --git a/modules/lang/org/config.el b/modules/lang/org/config.el
index 182afcf31..c249d3063 100644
--- a/modules/lang/org/config.el
+++ b/modules/lang/org/config.el
@@ -28,8 +28,7 @@
   :commands org-crypt-use-before-save-magic
   :config
   (setq org-tags-exclude-from-inheritance '("crypt")
-        org-crypt-key user-mail-address
-        epa-file-encrypt-to user-mail-address))
+        org-crypt-key user-mail-address))
 
 (def-package! org-bullets
   :commands org-bullets-mode)