diff --git a/hosts/thinkpad/modules/security/default.nix b/hosts/thinkpad/modules/security/default.nix
index 2823578..29e2fdf 100644
--- a/hosts/thinkpad/modules/security/default.nix
+++ b/hosts/thinkpad/modules/security/default.nix
@@ -9,6 +9,15 @@
       abrmd.enable = true;
       tctiEnvironment.enable = true;
     };
+    pam = {
+      u2f = {
+        enable = true;
+      };
+      services = {
+        login.u2fAuth = true;
+        sudo.u2fAuth = true;
+      };
+    };
   };
   services = {
     fprintd.enable = true; # log in using fingerprint