diff --git a/bin/omarchy-first-run b/bin/omarchy-first-run
index 40692c39..cd9f99d7 100755
--- a/bin/omarchy-first-run
+++ b/bin/omarchy-first-run
@@ -106,6 +106,8 @@ run_first_run_step "notify about pending migrations" omarchy-migrate-notify
 
 run_first_run_step "install Voxtype post-update hook" \
   omarchy-hook-install post-update "$OMARCHY_PATH/install/user/first-run/install-voxtype.hook"
+run_first_run_step "install fingerprint setup post-update hook" \
+  omarchy-hook-install post-update "$OMARCHY_PATH/install/user/first-run/setup-fingerprint.hook"
 
 run_first_run_step "enable user systemd units" \
   bash "$OMARCHY_PATH/install/user/first-run/enable-user-units.sh"
@@ -123,9 +125,6 @@ run_first_run_step "show welcome notification" \
 sleep 0.3
 run_first_run_step "show Wi-Fi/update notifications" \
   bash "$OMARCHY_PATH/install/user/first-run/wifi.sh"
-sleep 0.3
-run_first_run_step "invite fingerprint setup" \
-  bash "$OMARCHY_PATH/install/user/first-run/fingerprint.sh"
 
 if (( first_run_failed == 0 )); then
   omarchy-done mark "$FIRST_RUN_DONE"
diff --git a/install/user/first-run/fingerprint.sh b/install/user/first-run/fingerprint.sh
deleted file mode 100644
index fd1ddd4d..00000000
--- a/install/user/first-run/fingerprint.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-(
-  # Only invite when there's a reader to use and it isn't set up yet (the lock
-  # PAM file is the last thing the setup writes on success).
-  if omarchy-hw-fingerprint && [[ ! -f /etc/pam.d/omarchy-lock-fingerprint ]]; then
-    if [[ -n $(omarchy-notification-send -u critical -g 󰈷 "Setup Fingerprint Reader" "Enable sudo and unlocking with your fingerprint." -a) ]]; then
-      omarchy-launch-floating-terminal-with-presentation omarchy-setup-security-fingerprint
-    fi
-  fi
-) >/dev/null 2>&1 &
diff --git a/install/user/first-run/setup-fingerprint.hook b/install/user/first-run/setup-fingerprint.hook
new file mode 100644
index 00000000..5f75ee66
--- /dev/null
+++ b/install/user/first-run/setup-fingerprint.hook
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+set -e
+
+show_invitation() {
+  if [[ -n $(omarchy-notification-send -u critical -g 󰈷 "Setup Fingerprint Reader" "Enable sudo and unlocking with your fingerprint." -a) ]]; then
+    omarchy-launch-floating-terminal-with-presentation omarchy-setup-security-fingerprint
+  fi
+}
+
+if [[ ${1:-} == "--show" ]]; then
+  show_invitation
+# Only invite when there's a reader to use and it isn't set up yet (the lock
+# PAM file is the last thing the setup writes on success).
+elif omarchy-hw-fingerprint && [[ ! -f /etc/pam.d/omarchy-lock-fingerprint ]] &&
+  omarchy-done ensure fingerprint-setup-invitation; then
+  # Keep the notification action alive after the update terminal closes.
+  systemd-run --user --collect --quiet --service-type=exec \
+    --unit=omarchy-fingerprint-setup-invitation \
+    bash "$0" --show
+fi
diff --git a/test/shell.d/fingerprint-invitation-test.sh b/test/shell.d/fingerprint-invitation-test.sh
new file mode 100644
index 00000000..57f7fe0d
--- /dev/null
+++ b/test/shell.d/fingerprint-invitation-test.sh
@@ -0,0 +1,80 @@
+#!/bin/bash
+
+source "$(dirname "$0")/base-test.sh"
+
+# The hook guards on the real /etc/pam.d path, which can't be mocked via PATH.
+if [[ -f /etc/pam.d/omarchy-lock-fingerprint ]]; then
+  pass "fingerprint invitation test skipped: host already has fingerprint auth configured"
+  exit 0
+fi
+
+test_home=$(mktemp -d)
+test_bin=$(mktemp -d)
+log_file=$(mktemp)
+hw_marker=$(mktemp -u)
+hook_path="$test_home/.config/omarchy/hooks/post-update.d/setup-fingerprint.hook"
+
+cleanup() {
+  rm -rf "$test_home" "$test_bin"
+  rm -f "$log_file" "$hw_marker"
+}
+trap cleanup EXIT
+
+mkdir -p "$(dirname "$hook_path")"
+
+cat >"$test_bin/omarchy-hw-fingerprint" <<'EOF'
+#!/bin/bash
+[[ -f $TEST_HW_MARKER ]]
+EOF
+chmod +x "$test_bin/omarchy-hw-fingerprint"
+
+cat >"$test_bin/omarchy-notification-send" <<'EOF'
+#!/bin/bash
+echo notification >>"$TEST_LOG"
+echo action
+EOF
+chmod +x "$test_bin/omarchy-notification-send"
+
+cat >"$test_bin/omarchy-launch-floating-terminal-with-presentation" <<'EOF'
+#!/bin/bash
+echo launch >>"$TEST_LOG"
+EOF
+chmod +x "$test_bin/omarchy-launch-floating-terminal-with-presentation"
+
+cat >"$test_bin/systemd-run" <<'EOF'
+#!/bin/bash
+echo "systemd-run:$*" >>"$TEST_LOG"
+while (($# > 0)); do
+  [[ $1 == "bash" ]] && exec "$@"
+  shift
+done
+exit 1
+EOF
+chmod +x "$test_bin/systemd-run"
+
+run_invitation_hook() {
+  cp "$ROOT/install/user/first-run/setup-fingerprint.hook" "$hook_path"
+  HOME="$test_home" PATH="$test_bin:$ROOT/bin:$PATH" TEST_LOG="$log_file" TEST_HW_MARKER="$hw_marker" bash "$hook_path"
+}
+
+run_invitation_hook
+
+[[ ! -f $test_home/.local/state/omarchy/done/fingerprint-setup-invitation ]] || fail "fingerprint invitation stays pending without a reader"
+[[ ! -s $log_file ]] || fail "fingerprint invitation does nothing without a reader"
+
+touch "$hw_marker"
+run_invitation_hook
+
+[[ -f $test_home/.local/state/omarchy/done/fingerprint-setup-invitation ]] || fail "fingerprint invitation records completion"
+[[ -f $hook_path ]] || fail "fingerprint invitation keeps its hook installed"
+[[ $(grep -c '^systemd-run:' "$log_file") -eq 1 ]] || fail "fingerprint invitation uses a durable user service"
+grep -q -- '--user --collect --quiet --service-type=exec --unit=omarchy-fingerprint-setup-invitation' "$log_file" || fail "fingerprint invitation configures its user service"
+[[ $(grep -c '^notification$' "$log_file") -eq 1 ]] || fail "fingerprint invitation sends one notification"
+[[ $(grep -c '^launch$' "$log_file") -eq 1 ]] || fail "fingerprint invitation handles the notification action"
+
+HOME="$test_home" PATH="$test_bin:$ROOT/bin:$PATH" TEST_LOG="$log_file" TEST_HW_MARKER="$hw_marker" bash "$hook_path"
+
+[[ $(grep -c '^systemd-run:' "$log_file") -eq 1 ]] || fail "completed fingerprint invitation does not schedule again"
+[[ $(grep -c '^notification$' "$log_file") -eq 1 ]] || fail "completed fingerprint invitation hook does not notify again"
+
+pass "fingerprint invitation waits for a reader and only runs once"