diff --git a/named-hosts/matic/default.nix b/named-hosts/matic/default.nix
index 27f046364..8cd3f5543 100644
--- a/named-hosts/matic/default.nix
+++ b/named-hosts/matic/default.nix
@@ -82,6 +82,9 @@ inputs.nixpkgs.lib.nixosSystem {
 
         # Fingerprint authentication
         services.fprintd.enable = true;
+        security.pam.services.login.fprintAuth = true;
+        security.pam.services.gdm.fprintAuth = true;
+        security.pam.services.sudo.fprintAuth = true;
 
         # Firmware updates
         services.fwupd.enable = true;
diff --git a/named-hosts/matic/falcon.nix b/named-hosts/matic/falcon.nix
index 69bab8792..a029c69a4 100644
--- a/named-hosts/matic/falcon.nix
+++ b/named-hosts/matic/falcon.nix
@@ -17,19 +17,13 @@ let
     #!${pkgs.bash}/bin/sh
     set -euo pipefail
 
-    # Remove immutable attributes set by CrowdStrike (security feature)
-    if [ -d /opt/CrowdStrike ]; then
-      ${pkgs.e2fsprogs}/bin/chattr -i -R /opt/CrowdStrike 2>/dev/null || true
+    # Only initialize if not already set up (CrowdStrike protects its files)
+    if [ ! -f /opt/CrowdStrike/falcond ]; then
+      install -d -m 0770 /opt/CrowdStrike
+      cp -a ${falcon}/opt/CrowdStrike/. /opt/CrowdStrike/
+      chown -R root:root /opt/CrowdStrike
     fi
 
-    rm -rf /opt/CrowdStrike
-    install -d -m 0770 /opt/CrowdStrike
-
-    # Copy real files so Falcon can write falconstore/CsConfig
-    cp -a ${falcon}/opt/CrowdStrike/. /opt/CrowdStrike/
-
-    chown -R root:root /opt/CrowdStrike
-
     # load CID from /etc/falcon-sensor.env (root-only)
     . /etc/falcon-sensor.env