diff --git a/lib/mksystem.nix b/lib/mksystem.nix
index e2480ce..c3c39a5 100644
--- a/lib/mksystem.nix
+++ b/lib/mksystem.nix
@@ -123,6 +123,13 @@ in
       ]
       ++ nixpkgs.lib.optionals darwin [
         inputs.nix-index-database.darwinModules.nix-index
+        {
+          # auth sudo via fingerprint
+          security.pam.services.sudo_local = {
+            reattach = true;
+            touchIdAuth = true;
+          };
+        }
       ]
       ++ custom;
   }