diff --git a/README.md b/README.md
index f5a2d43..a734d25 100644
--- a/README.md
+++ b/README.md
@@ -47,3 +47,16 @@ sudo systemctl enable --now NetworkManager
 ```
 
 Wifi will drop for a few seconds and reconnect via iwd's stored profiles. If reconnection fails, re-enter the wifi password via `nm-applet` (tray icon) or `networkmanager_dmenu` (waybar network widget click).
+
+### One-time fingerprint setup
+
+After `install.sh` installs `fprintd`, enroll a finger and wire it into the sudo + lockscreen auth stacks:
+
+```bash
+fprintd-enroll                                  # interactive; touch the reader as prompted
+sudo bash scripts/enable-fingerprint.sh         # idempotent — safe to re-run
+```
+
+Test with `sudo true` (should prompt for fingerprint) or `Mod+Shift+E` to lock + touch the reader.
+
+To enroll additional fingers: `fprintd-enroll -f left-thumb` (or `right-thumb`, `left-index`, etc.).