diff --git a/modules/yubikey.nix b/modules/yubikey.nix
new file mode 100644
index 0000000..93af310
--- /dev/null
+++ b/modules/yubikey.nix
@@ -0,0 +1,20 @@
+{ pkgs, username, ... }: {
+  config = {
+    security.pam.yubico = {
+      enable = true;
+      mode = "challenge-response";
+    };
+    services = {
+      udev.packages = [ pkgs.yubikey-personalization ];
+      pcscd.enable = true;
+    };
+    environment.persistence."/nix/persist".users.${username}.directories = [
+      ".yubico"
+    ];
+  };
+  home.home.packages = with pkgs; [
+    yubikey-personalization
+    yubico-pam
+    yubioath-desktop
+  ];
+}