diff --git a/hosts/lift/configuration.nix b/hosts/lift/configuration.nix
index 3aed95b..ff21711 100644
--- a/hosts/lift/configuration.nix
+++ b/hosts/lift/configuration.nix
@@ -32,6 +32,11 @@
     password=${config.sops.placeholder."samba/password"}
   '';
 
+  security.pam.services = {
+    login.u2fAuth = true;
+    sudo.u2fAuth = true;
+  };
+
   fileSystems."/mnt/media" = {
     device = "//dalinar.home.johannes-rothe.de/media";
     fsType = "cifs";