diff --git a/hosts/thinkpad/home-manager/hyprland/default.nix b/hosts/thinkpad/home-manager/hyprland/default.nix
index 5459c8c..1701a0f 100644
--- a/hosts/thinkpad/home-manager/hyprland/default.nix
+++ b/hosts/thinkpad/home-manager/hyprland/default.nix
@@ -1,6 +1,7 @@
 # Home configurations for Hyprland. For system configs, see ./modules/hyprland
 {
   imports = [
+    ./hyprlock.nix
     ./hyprpanel.nix
     ./settings.nix
   ];
diff --git a/hosts/thinkpad/home-manager/hyprland/hyprlock.nix b/hosts/thinkpad/home-manager/hyprland/hyprlock.nix
new file mode 100644
index 0000000..409fcd3
--- /dev/null
+++ b/hosts/thinkpad/home-manager/hyprland/hyprlock.nix
@@ -0,0 +1,15 @@
+{ pkgs, lib, ... }:
+
+{
+  # TODO fingerprint prompt using $FPRINTPROMPT
+  programs.hyprlock = {
+    package = pkgs.unstable.hyprlock;
+    settings = {
+      auth."fingerprint:enabled" = true;
+      # Override removed settings shared config
+      general = lib.mkForce {
+        hide_cursor = true;
+      };
+    };
+  };
+}
diff --git a/hosts/thinkpad/security.nix b/hosts/thinkpad/security.nix
index bcfc93a..24d679d 100644
--- a/hosts/thinkpad/security.nix
+++ b/hosts/thinkpad/security.nix
@@ -2,27 +2,25 @@
 
 {
   security = {
-    pam = {
-      services = {
-        gdm-fingerprint.text = ''
-          auth       required                    pam_shells.so
-          auth       requisite                   pam_nologin.so
-          auth       requisite                   pam_faillock.so      preauth
-          auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
-          auth       optional                    pam_permit.so
-          auth       required                    pam_env.so
-          auth       [success=ok default=1]      ${pkgs.gdm}/lib/security/pam_gdm.so
-          auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so
+    pam.services = {
+      gdm-fingerprint.text = ''
+        auth       required                    pam_shells.so
+        auth       requisite                   pam_nologin.so
+        auth       requisite                   pam_faillock.so      preauth
+        auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
+        auth       optional                    pam_permit.so
+        auth       required                    pam_env.so
+        auth       [success=ok default=1]      ${pkgs.gdm}/lib/security/pam_gdm.so
+        auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so
 
-          account    include                     login
+        account    include                     login
 
-          password   required                    pam_deny.so
+        password   required                    pam_deny.so
 
-          session    include                     login
-          session    optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
-        '';
-        login.fprintAuth = false;
-      };
+        session    include                     login
+        session    optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
+      '';
+      login.fprintAuth = false;
     };
   };
 
@@ -37,9 +35,4 @@
     enable = true;
     tod.driver = pkgs.libfprint-2-tod1-goodix-550a; # Goodix 550a driver (from Lenovo)
   };
-
-  # however for focaltech 2808:a658, use fprintd with overidden package (without tod)
-  # services.fprintd.package = pkgs.fprintd.override {
-  #   libfprint = pkgs.libfprint-focaltech-2808-a658;
-  # };
 }
diff --git a/shared/home-manager/hyprland/hyprlock/default.nix b/shared/home-manager/hyprland/hyprlock/default.nix
index dbe7778..7002a80 100644
--- a/shared/home-manager/hyprland/hyprlock/default.nix
+++ b/shared/home-manager/hyprland/hyprlock/default.nix
@@ -14,7 +14,7 @@
 
       # GENERAL
       general = {
-        disable_loading_bar = true;
+        disable_loading_bar = true; # TODO removed in hyprlock 0.8
         hide_cursor = true;
       };