diff --git a/modules/yubikey/default.nix b/modules/yubikey/default.nix
index d05aa1a..6e7d613 100644
--- a/modules/yubikey/default.nix
+++ b/modules/yubikey/default.nix
@@ -26,9 +26,10 @@ in
     (mkIf
       conf.yubikey.login
       {
-        security.pam.services = {
-          login.u2fAuth = true;
-          sudo.u2fAuth = true;
+        security.pam.u2f = {
+          enable = true;
+          cue = true;
+          control = "required";
         };
       })
   ]