diff --git a/features/hardware-auth/default.nix b/features/hardware-auth/default.nix
new file mode 100644
index 0000000..1156f41
--- /dev/null
+++ b/features/hardware-auth/default.nix
@@ -0,0 +1,52 @@
+{...}: {
+  config.flake.modules.nixos.hardware-auth = {
+    lib,
+    config,
+    pkgs,
+    ...
+  }: {
+    options.azos.hardware-auth.enable = lib.mkOption {
+      default = false;
+      example = true;
+      type = lib.types.bool;
+      description = ''
+        Enables YubiKey (U2F/FIDO2) as a "sufficient" PAM factor ahead of
+        the password, for both sudo and login (which greetd/tuigreet
+        substacks) -- touch the key to auth, or just type your password as
+        normal if it's not plugged in.
+
+        After enabling and rebuilding, enroll each key on the new machine
+        (per-user, not machine-wide state, so this must be redone per
+        machine):
+
+          mkdir -p ~/.config/Yubico
+          pamu2fcfg > ~/.config/Yubico/u2f_keys
+
+        To add a second/backup key without overwriting the first:
+
+          pamu2fcfg -n >> ~/.config/Yubico/u2f_keys
+
+        Test with `sudo true` (touching the key) before trusting it on the
+        greeter -- a login lockout is harder to recover from than a failed
+        sudo in an already-open session.
+      '';
+    };
+
+    config = lib.mkIf config.azos.hardware-auth.enable {
+      # Default NixOS PAM rule ordering already tries u2f before pam_unix
+      # (password), both "sufficient" -- so YubiKey touch wins first,
+      # password always remains as fallback.
+      #
+      # Fingerprint (fprintd) is deliberately not wired up here: lauretta's
+      # reader is a Synaptics Metallica MIS (06cb:009a), a match-on-chip
+      # sensor unsupported by upstream libfprint. The only known fix is an
+      # unofficial python-validity + open-fprintd stack, not packaged in
+      # nixpkgs and fragile enough (suspend/resume, PAM lockout risk) to not
+      # be worth it for now.
+      security.pam.u2f = {
+        enable = true;
+        settings.cue = true;
+      };
+    };
+  };
+}
diff --git a/features/kubernetes/default.nix b/features/kubernetes/default.nix
index 9918fb7..ef38325 100644
--- a/features/kubernetes/default.nix
+++ b/features/kubernetes/default.nix
@@ -6,7 +6,7 @@
     ...
   }: {
     options.azos.kubectl.enable = lib.mkOption {
-      default = true;
+      default = false;
       type = lib.types.bool;
     };
     config = lib.mkIf config.azos.kubectl.enable {
diff --git a/features/qutebrowser/default.nix b/features/qutebrowser/default.nix
index dfed6e7..9de15d5 100644
--- a/features/qutebrowser/default.nix
+++ b/features/qutebrowser/default.nix
@@ -5,7 +5,7 @@
     ...
   }: {
     options.azos.qutebrowser-config.enable = lib.mkOption {
-      default = true;
+      default = false;
       type = lib.types.bool;
     };
     config = lib.mkIf config.azos.qutebrowser-config.enable {
diff --git a/features/snx-rs/default.nix b/features/snx-rs/default.nix
index e09efc0..9bb147f 100644
--- a/features/snx-rs/default.nix
+++ b/features/snx-rs/default.nix
@@ -9,7 +9,7 @@
   in {
     options.azos.snx-rs = {
       enable = lib.mkOption {
-        default = true;
+        default = false;
         type = lib.types.bool;
       };
       server = lib.mkOption {
diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index 66d79b8..3e1c6dc 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -21,6 +21,7 @@
     suiteModules.nixos.binfmt
     suiteModules.nixos.attic
     suiteModules.nixos.printing
+    suiteModules.nixos.hardware-auth
   ];
 
   boot.loader.grub = {
@@ -95,6 +96,7 @@
   azos.suites.exwm.enable = true;
   azos.attic.enable = true;
   azos.printing.enable = true;
+  azos.hardware-auth.enable = true;
 
   home-manager = {
     extraSpecialArgs = {inherit inputs outputs suiteModules pkgs;};