diff --git a/modules/yubikey/default.nix b/modules/yubikey/default.nix
index 83a612c..e507939 100644
--- a/modules/yubikey/default.nix
+++ b/modules/yubikey/default.nix
@@ -28,8 +28,10 @@ in
       {
         security.pam.u2f = {
           enable = true;
-          cue = true;
           control = "required";
+          settings = {
+            cue = true;
+          };
         };
 
         # Lock when removing yubikey