diff --git a/apps/server/src/provider/cursorCredentialStore.ts b/apps/server/src/provider/cursorCredentialStore.ts
index c071e2a88578..b237fda3c0e8 100644
--- a/apps/server/src/provider/cursorCredentialStore.ts
+++ b/apps/server/src/provider/cursorCredentialStore.ts
@@ -1,3 +1,5 @@
+import * as NodeModule from "node:module";
+
 const CACHE_MS = 5 * 60_000;
 
 /** Share one Keychain request across usage history and limits in this server process. */
@@ -22,8 +24,12 @@ export function makeCachedCursorAccessTokenReader(
   };
 }
 
+// `import()` cannot load file-backed packages inside the single-executable CLI;
+// `require` reads the real filesystem.
+const requireForKeyring = NodeModule.createRequire(import.meta.url);
+
 /** Read the Cursor CLI's default macOS credential without invoking the shared security binary. */
 export const readMacCursorAccessToken = makeCachedCursorAccessTokenReader(async () => {
-  const { AsyncEntry } = await import("@napi-rs/keyring");
+  const { AsyncEntry } = requireForKeyring("@napi-rs/keyring") as typeof import("@napi-rs/keyring");
   return (await new AsyncEntry("cursor-access-token", "cursor-user").getPassword()) ?? null;
 });