{
  config,
  lib,
  ...
}:
with lib;
mkIf (elem "fprintd" config.machine.services) {
  security.pam.services =
    let
      unlock = [
        "sudo"
        "i3lock"
        "login"
        "lightdm"
      ];
    in
    listToAttrs (
      forEach unlock (n: {
        name = n;
        value = {
          fprintAuth = true;
        };
      })
    );

  services.fprintd = {
    enable = true;
  };
}