diff --git a/config-root.toml b/config-root.toml
index 80f8ead..3c52c22 100644
--- a/config-root.toml
+++ b/config-root.toml
@@ -17,6 +17,10 @@ workdir = "~/.config/sdotdrop"
 dst = "/etc/udev/rules.d/60-uinput-permissions.rules"
 src = "etc/udev/rules.d/60-uinput-permissions.rules"
 
+[dotfiles."f_yubikey_udev.rules"]
+dst = "/etc/udev/rules.d/20-yubikey.rules"
+src = "etc/udev/rules.d/20-yubikey.rules"
+
 [dotfiles.d_bin]
 dst = "/usr/local/bin"
 src = "usr/local/bin"
@@ -175,6 +179,7 @@ dotfiles = [
   "f_sshd_config",
   "f_logind.conf",
   "f_60-uinput-permissions.rules",
+  "f_yubikey_udev.rules",
   "f_freetype2.sh",
   "f_fonts.conf",
   "f_99-lowbat.rules",
@@ -206,4 +211,4 @@ include = ["Locale"]
 include = ["Pacman"]
 
 [profiles.mko-laptop]
-dotfiles = ["f_cpupower"]
+dotfiles = ["f_cpupower", "f_yubikey_udev.rules"]
diff --git a/root/etc/udev/rules.d/20-yubikey.rules b/root/etc/udev/rules.d/20-yubikey.rules
new file mode 100644
index 0000000..9246505
--- /dev/null
+++ b/root/etc/udev/rules.d/20-yubikey.rules
@@ -0,0 +1 @@
+ACTION=="remove", ENV{ID_BUS}=="usb", ENV{ID_MODEL_ID}=="0407", ENV{ID_VENDOR_ID}=="1050", RUN+="/usr/bin/loginctl lock-sessions"