diff --git a/bin/omarchy-hw-fingerprint b/bin/omarchy-hw-fingerprint
index c5f119d9..03af4fdb 100755
--- a/bin/omarchy-hw-fingerprint
+++ b/bin/omarchy-hw-fingerprint
@@ -30,7 +30,10 @@ for dev in /sys/bus/usb/devices/*; do
   if [[ -r $dev/product ]]; then
     product=$(<"$dev/product")
     product=${product,,}
-    [[ $product == *fingerprint* || $product == *biometric* ]] && exit 0
+    # Elan's match-on-chip readers report "ELAN:ARM-M4", the family name
+    # rather than the function. Elan is left out of the vendor list above
+    # on purpose, so without this they match nothing.
+    [[ $product == *fingerprint* || $product == *biometric* || $product == *elan:arm-m4* ]] && exit 0
   fi
 
   if [[ -r $dev/idVendor ]]; then
diff --git a/bin/omarchy-setup-security-fingerprint b/bin/omarchy-setup-security-fingerprint
index ffdbed34..dd4f428f 100755
--- a/bin/omarchy-setup-security-fingerprint
+++ b/bin/omarchy-setup-security-fingerprint
@@ -83,9 +83,6 @@ fi
 
 omarchy-pkg-add libfprint fprintd usbutils
 
-# Configure PAM
-setup_pam_config
-
 # Enroll first fingerprint
 echo -e "\e[32m\nLet's setup your right index finger as the first fingerprint.\e[0m"
 echo -e "Keep moving the finger around on sensor until the process completes.\n"
@@ -96,6 +93,12 @@ if sudo fprintd-enroll "$USER"; then
   # Verify
   echo -e "\nNow let's verify that it's working correctly.\n"
   if fprintd-verify; then
+    # PAM comes last, once a print is enrolled and verified. Detection only
+    # proves a reader is there, not that libfprint can drive it — an Elan MOC
+    # sensor outside the elanmoc table gets this far and then fails to enroll.
+    # Editing the stacks up front would leave those machines pointing at
+    # pam_fprintd with nothing to match.
+    setup_pam_config
     setup_lock_fingerprint_pam
     echo -e "\e[32m\nPerfect! Fingerprint authentication is now configured.\e[0m"
     echo "You can use your fingerprint for sudo, polkit, and lock screen (Super + Ctrl + L)."