diff --git a/configs/pkgs.nix b/configs/pkgs.nix
index 4142612..7b019d7 100644
--- a/configs/pkgs.nix
+++ b/configs/pkgs.nix
@@ -49,6 +49,7 @@
     ntp
     offpunk
     openssl
+    pam_u2f
     ops
     pandoc
     pciutils
diff --git a/configuration.nix b/configuration.nix
index c903cae..f919b7d 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -125,6 +125,11 @@
   services.tailscale.enable = true;
   services.syncthing.enable = true;
 
+  security.pam.u2f = {
+    enable = true;
+    settings.cue = true;
+  };
+
   programs.gnupg.agent = {
     enable = true;
     enableSSHSupport = true;