diff --git a/group_vars/all b/group_vars/all
index 7c41d5c..7ce8a91 100644
--- a/group_vars/all
+++ b/group_vars/all
@@ -102,3 +102,5 @@ bootloader: grub
 
 postgresql:
     enable: True
+
+fingerprint: False
diff --git a/roles/thinkpad/tasks/main.yml b/roles/thinkpad/tasks/main.yml
index f9539eb..cafa7b0 100644
--- a/roles/thinkpad/tasks/main.yml
+++ b/roles/thinkpad/tasks/main.yml
@@ -25,15 +25,12 @@
   tags:
     - fingerprint
 
-- name: Enable sudo fingerprint authentication
-  lineinfile: dest=/etc/pam.d/sudo
-              state=present
-              insertbefore=BOF
-              line="auth            sufficient      pam_fprintd.so"
+- name: Push sudo authentication file
+  template: src=pam.d/sudo.j2 dest=/etc/pam.d/sudo
   tags:
     - fingerprint
 
-- name: Enable i3lock fingerprint authentication
-  copy: src=i3lock dest=/etc/pam.d/i3lock
+- name: Push i3lock authentication file
+  template: src=pam.d/i3lock.j2 dest=/etc/pam.d/i3lock
   tags:
     - fingerprint
diff --git a/roles/thinkpad/files/i3lock b/roles/thinkpad/templates/pam.d/i3lock.j2
similarity index 60%
rename from roles/thinkpad/files/i3lock
rename to roles/thinkpad/templates/pam.d/i3lock.j2
index e92d2ba..db2385c 100644
--- a/roles/thinkpad/files/i3lock
+++ b/roles/thinkpad/templates/pam.d/i3lock.j2
@@ -1,3 +1,7 @@
+{% if fingerprint == True %}
 auth required    pam_env.so
 auth sufficient  pam_unix.so try_first_pass likeauth nullok
 auth sufficient  pam_fprintd.so
+{% else %}
+auth include system-auth
+{% endif %}
diff --git a/roles/thinkpad/templates/pam.d/sudo.j2 b/roles/thinkpad/templates/pam.d/sudo.j2
new file mode 100644
index 0000000..f5b1198
--- /dev/null
+++ b/roles/thinkpad/templates/pam.d/sudo.j2
@@ -0,0 +1,6 @@
+{% if fingerprint == True %}
+auth            sufficient      pam_fprintd.so
+{% endif %}
+auth            include         system-auth
+account         include         system-auth
+session         include         system-auth