{config, ...}: {
  security.pam = {
    services = {
      swaylock = {};
      sudo = {
        u2fAuth = true;
      };
      login = {
        u2fAuth = true;
      };
    };
    u2f = {
      enable = true;
      cue = true;
      authFile = config.age.secrets.pamu2f-mappings.path;
    };
  };
}