diff --git a/modules/nixos/configs/yubikey.nix b/modules/nixos/configs/yubikey.nix
index 00b08a1..3e76638 100644
--- a/modules/nixos/configs/yubikey.nix
+++ b/modules/nixos/configs/yubikey.nix
@@ -9,6 +9,11 @@ let cfg = config.local.yubikey; in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.yubikey-manager pkgs.yubikey-personalization ];
 
+    security.pam.u2f = {
+      enable = true;
+      control = "required";
+    };
+
     services.udev.packages = [ pkgs.yubikey-personalization ];
     security.pam.services = {
       login.u2fAuth = true;