diff --git a/hosts/decryption/default.nix b/hosts/decryption/default.nix
index 1a528d1..57ddc0e 100644
--- a/hosts/decryption/default.nix
+++ b/hosts/decryption/default.nix
@@ -14,7 +14,7 @@
     (flakeRoot + /hardware/gpu/nvidia.nix)
 
     (flakeRoot + /modules/common)
-    (flakeRoot + /modules/common/boot/systemd-boot.nix)
+    (flakeRoot + /modules/common/boot/secureboot.nix)
     (flakeRoot + /modules/common/system/audio.nix)
 
     (flakeRoot + /modules/desktop/environments/gnome.nix)
diff --git a/hosts/decryption/disks.nix b/hosts/decryption/disks.nix
index e256e9a..ecae831 100644
--- a/hosts/decryption/disks.nix
+++ b/hosts/decryption/disks.nix
@@ -1,4 +1,6 @@
 {
+  boot.initrd.systemd.enable = true;
+
   disko.devices = {
     disk = {
       main = {
@@ -36,7 +38,7 @@
 
                 settings = {
                   crypttabExtraOpts = [
-                    "tpm-device=auto"
+                    "tpm2-device=auto"
                     "token-timeout=10"
                   ];
                 };
@@ -69,6 +71,7 @@
         };
 
         swap = {
+          name = "swap";
           size = "32G";
 
           content = {
diff --git a/hosts/decryption/users/encode42.nix b/hosts/decryption/users/encode42.nix
index 21ac577..7af1f35 100644
--- a/hosts/decryption/users/encode42.nix
+++ b/hosts/decryption/users/encode42.nix
@@ -17,6 +17,8 @@
     (flakeRoot + /packages/desktop/steam.nix)
   ];
 
+  security.pam.services.login.unixAuth = false;
+
   home-manager.users.encode42 = {
     imports = [
       ../homes/encode42.nix
diff --git a/modules/common/boot/secureboot.nix b/modules/common/boot/secureboot.nix
index bede70e..63f2120 100644
--- a/modules/common/boot/secureboot.nix
+++ b/modules/common/boot/secureboot.nix
@@ -1,3 +1,6 @@
+# note: make sure to create secureboot keys before installation.
+# https://github.com/nix-community/lanzaboote/blob/b2f781751764ff57d54f7cf1910ae1bbf268ed1c/docs/QUICK_START.md
+
 {
   lib,
   lanzaboote,
@@ -16,7 +19,7 @@
   boot.lanzaboote = {
     enable = true;
 
-    pkiBundle = "/etc/secureboot";
+    pkiBundle = "/var/lib/sbctl";
   };
 
   environment.systemPackages = with pkgs; [
diff --git a/modules/common/boot/systemd-boot.nix b/modules/common/boot/systemd-boot.nix
index 03eb494..54cc6fa 100644
--- a/modules/common/boot/systemd-boot.nix
+++ b/modules/common/boot/systemd-boot.nix
@@ -9,4 +9,6 @@
     editor = false;
     configurationLimit = 6;
   };
+
+  boot.loader.timeout = 0;
 }
diff --git a/packages/common/yubikey.nix b/packages/common/yubikey.nix
index 1b59000..a70a482 100644
--- a/packages/common/yubikey.nix
+++ b/packages/common/yubikey.nix
@@ -11,6 +11,10 @@
     enable = true;
   };
 
+  security.pam.services = {
+    login.u2fAuth = true;
+  };
+
   services.udev.packages = with pkgs; [
     yubikey-personalization
   ];