{
  config,
  lib,
  pkgs,
  ...
}:
lib.mkIf config.u.has.yubikey {
  environment.systemPackages = [
    pkgs.yubikey-manager
    pkgs.yubioath-flutter
    pkgs.pam_u2f
  ];
  services.pcscd.enable = true;
  services.udev.packages = [pkgs.yubikey-personalization];
  services.yubikey-agent.enable = true;
  security.pam = {
    u2f = {
      enable = true;
      settings.cue = true;
    };
    services.login.u2fAuth = false;
    services.physlock.u2fAuth = false;
  };
  programs.yubikey-touch-detector.enable = true;
}