{ ... }:
{
  # Touch ID for sudo auth
  security.pam.services.sudo_local.touchIdAuth = true;
}