diff --git a/host/ThinkPad/configuration.nix b/host/ThinkPad/configuration.nix
index 40dd792..d7952e4 100644
--- a/host/ThinkPad/configuration.nix
+++ b/host/ThinkPad/configuration.nix
@@ -9,6 +9,7 @@
       ./modules/swap.nix
       ./modules/intel.nix
       ./modules/nvidia.nix
+      ./modules/fingerprint.nix
 
     (import ../modules/common.nix {
       inherit lib;
diff --git a/host/ThinkPad/modules/fingerprint.nix b/host/ThinkPad/modules/fingerprint.nix
new file mode 100644
index 0000000..d3fb2df
--- /dev/null
+++ b/host/ThinkPad/modules/fingerprint.nix
@@ -0,0 +1,16 @@
+{ config, ... }: {
+  services.fprintd.enable = true;
+
+  security.pam.services.sudo.fprintAuth = true;
+
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if (action.id == "net.reactivated.fprint.device.enroll" &&
+          subject.isInGroup("fprint")) {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+
+  users.users.kirill.extraGroups = [ "fprint" ];
+}