diff --git a/bin/omarchy-first-run b/bin/omarchy-first-run
index b95849d3..40692c39 100755
--- a/bin/omarchy-first-run
+++ b/bin/omarchy-first-run
@@ -123,6 +123,9 @@ run_first_run_step "show welcome notification" \
 sleep 0.3
 run_first_run_step "show Wi-Fi/update notifications" \
   bash "$OMARCHY_PATH/install/user/first-run/wifi.sh"
+sleep 0.3
+run_first_run_step "invite fingerprint setup" \
+  bash "$OMARCHY_PATH/install/user/first-run/fingerprint.sh"
 
 if (( first_run_failed == 0 )); then
   omarchy-done mark "$FIRST_RUN_DONE"
diff --git a/bin/omarchy-hw-fingerprint b/bin/omarchy-hw-fingerprint
new file mode 100755
index 00000000..9984e9d5
--- /dev/null
+++ b/bin/omarchy-hw-fingerprint
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# omarchy:summary=Returns true when a fingerprint reader is present
+# omarchy:hidden=true
+
+# Detect straight from sysfs so this works before fprintd/usbutils are
+# installed (the fingerprint setup pulls those in). USB vendor IDs listed here
+# ship fingerprint readers; multi-purpose vendors (e.g. Elan/STMicro, which
+# also make USB touchscreens) are left out to avoid nagging laptops with no
+# reader — those still match on the product string below when present.
+fingerprint_vendors=" 27c6 138a 06cb 08ff 1c7a 147e "
+
+for dev in /sys/bus/usb/devices/*; do
+  # The device's own product descriptor usually names it, e.g. "Goodix
+  # Fingerprint USB Device" — driver-independent and vendor-agnostic.
+  if [[ -r $dev/product ]]; then
+    product=$(<"$dev/product")
+    product=${product,,}
+    [[ $product == *fingerprint* || $product == *biometric* ]] && exit 0
+  fi
+
+  if [[ -r $dev/idVendor ]]; then
+    vendor=$(<"$dev/idVendor")
+    [[ $fingerprint_vendors == *" $vendor "* ]] && exit 0
+  fi
+done
+
+exit 1
diff --git a/bin/omarchy-setup-security-fingerprint b/bin/omarchy-setup-security-fingerprint
index f56bf805..d02558dc 100755
--- a/bin/omarchy-setup-security-fingerprint
+++ b/bin/omarchy-setup-security-fingerprint
@@ -6,18 +6,6 @@
 set -e
 
 
-check_fingerprint_hardware() {
-  # Get fingerprint devices for the user
-  devices=$(fprintd-list "$USER" 2>/dev/null)
-
-  # Exit if no devices found
-  if [[ -z $devices ]]; then
-    echo -e "\e[31m\nNo fingerprint sensor detected.\e[0m"
-    return 1
-  fi
-  return 0
-}
-
 setup_pam_config() {
   # Configure sudo
   if ! grep -q pam_fprintd.so /etc/pam.d/sudo; then
@@ -72,6 +60,12 @@ EOF
 
 echo -e "\e[32mSetting up fingerprint scanner for authentication.\n\e[0m"
 
+# Bail before installing anything if there's no reader to talk to.
+if ! omarchy-hw-fingerprint; then
+  echo -e "\e[31mNo fingerprint sensor detected.\e[0m"
+  exit 1
+fi
+
 # Install required packages
 echo "Installing required packages..."
 
@@ -86,10 +80,6 @@ fi
 
 omarchy-pkg-add libfprint-git fprintd usbutils
 
-if ! check_fingerprint_hardware; then
-  exit 1
-fi
-
 # Configure PAM
 setup_pam_config
 
diff --git a/install/user/first-run/fingerprint.sh b/install/user/first-run/fingerprint.sh
new file mode 100644
index 00000000..7f5f5807
--- /dev/null
+++ b/install/user/first-run/fingerprint.sh
@@ -0,0 +1,9 @@
+(
+  # Only invite when there's a reader to use and it isn't set up yet (the lock
+  # PAM file is the last thing the setup writes on success).
+  if omarchy-hw-fingerprint && [[ ! -f /etc/pam.d/omarchy-lock-fingerprint ]]; then
+    if [[ -n $(omarchy-notification-send -u critical -g 󰈷 "Setup Fingerprint" "Click to unlock login, sudo, and the lock screen with your fingerprint." -a) ]]; then
+      omarchy-launch-floating-terminal-with-presentation omarchy-setup-security-fingerprint
+    fi
+  fi
+) >/dev/null 2>&1 &