diff --git a/hosts/darwin-frieren/default.nix b/hosts/darwin-frieren/default.nix
index ea17f3b0..07790a55 100644
--- a/hosts/darwin-frieren/default.nix
+++ b/hosts/darwin-frieren/default.nix
@@ -1,4 +1,4 @@
-_:
+{ pkgs, ... }:
 #############################################################
 #
 #  Fern - MacBook Pro 2024 14-inch M4 Pro 48G, mainly for business.
@@ -11,4 +11,12 @@ in
   networking.hostName = hostname;
   networking.computerName = hostname;
   system.defaults.smb.NetBIOSName = hostname;
+
+  # CanoKey hardware security key: PC/SC tooling (`pcsc_scan`) for troubleshooting.
+  # The key itself uses the macOS built-in PC/SC + HID stacks; the FIDO2/WebAuthn
+  # udev rules used on Linux do not apply here.
+  environment.systemPackages = with pkgs; [
+    pcsclite
+    pcsc-tools
+  ];
 }
diff --git a/modules/nixos/desktop/canokey.nix b/modules/nixos/desktop/canokey.nix
new file mode 100644
index 00000000..ebc5cd58
--- /dev/null
+++ b/modules/nixos/desktop/canokey.nix
@@ -0,0 +1,43 @@
+{
+  pkgs,
+  config,
+  lib,
+  myvars,
+  ...
+}:
+let
+  cfg = config.modules.desktop.canokey;
+in
+{
+  options.modules.desktop.canokey = {
+    enable = lib.mkEnableOption "CanoKey hardware security key support";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.pcscd.enable = true;
+
+    # The FIDO2 udev rule below hands the key to the plugdev group.
+    users.users.${myvars.username}.extraGroups = [ "plugdev" ];
+
+    services.udev.extraRules = ''
+      # CanoKey - GnuPG/pcsclite
+      SUBSYSTEM!="usb", GOTO="canokey_rules_end"
+      ACTION!="add|change", GOTO="canokey_rules_end"
+      ATTRS{idVendor}=="20a0", ATTRS{idProduct}=="42d4", ENV{ID_SMARTCARD_READER}="1"
+      LABEL="canokey_rules_end"
+
+      # CanoKey - FIDO2
+      KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="20a0", ATTRS{idProduct}=="42d4", TAG+="uaccess", GROUP="plugdev", MODE="0660"
+
+      # CanoKey - WebUSB
+      # Upstream ships this as MODE:="0666" (world-writable), which lets any
+      # local user access the key; restrict it to the plugdev group instead.
+      SUBSYSTEMS=="usb", ATTR{idVendor}=="20a0", ATTR{idProduct}=="42d4", GROUP="plugdev", MODE="0660"
+    '';
+
+    environment.systemPackages = with pkgs; [
+      ccid
+      pcsc-tools
+    ];
+  };
+}
diff --git a/outputs/aarch64-linux/src/12kingdoms-shoukei.nix b/outputs/aarch64-linux/src/12kingdoms-shoukei.nix
index 5bbe0c2c..bc927e1e 100644
--- a/outputs/aarch64-linux/src/12kingdoms-shoukei.nix
+++ b/outputs/aarch64-linux/src/12kingdoms-shoukei.nix
@@ -34,6 +34,7 @@ let
           modules.secrets.preservation.enable = true;
           # not supported yet
           modules.desktop.gaming.enable = false;
+          modules.desktop.canokey.enable = true;
         }
       ];
     home-modules = map mylib.relativeToRoot [
diff --git a/outputs/x86_64-linux/src/idols-ai.nix b/outputs/x86_64-linux/src/idols-ai.nix
index 0ba71678..fc5e7101 100644
--- a/outputs/x86_64-linux/src/idols-ai.nix
+++ b/outputs/x86_64-linux/src/idols-ai.nix
@@ -34,6 +34,7 @@ let
           modules.secrets.desktop.enable = true;
           modules.secrets.preservation.enable = true;
           modules.desktop.gaming.enable = true;
+          modules.desktop.canokey.enable = true;
         }
       ];
     home-modules = map mylib.relativeToRoot [