diff --git a/shell/plugins/lock/Service.qml b/shell/plugins/lock/Service.qml
index 84203a8f..9ecb1cc0 100644
--- a/shell/plugins/lock/Service.qml
+++ b/shell/plugins/lock/Service.qml
@@ -424,7 +424,10 @@ Item {
         root.armBlankTimer()
         return
       }
-      if (root.lockRequested && !root.authenticating) root.runBlank()
+      // Only a password check in flight should hold the display up. The
+      // fingerprint PAM stays armed for the whole lock, so gating on
+      // `authenticating` here would keep the panel lit until unlock.
+      if (root.lockRequested && !root.authenticatingPassword) root.runBlank()
     }
   }
 
@@ -472,9 +475,9 @@ Item {
     }
   }
 
-  onAuthenticatingChanged: {
+  onAuthenticatingPasswordChanged: {
     if (!lockRequested) return
-    if (authenticating) idleBlankTimer.stop()
+    if (authenticatingPassword) idleBlankTimer.stop()
     else armBlankTimer()
   }
 
diff --git a/test/shell.d/lock-blank-fingerprint-test.sh b/test/shell.d/lock-blank-fingerprint-test.sh
new file mode 100755
index 00000000..1c9cd9d6
--- /dev/null
+++ b/test/shell.d/lock-blank-fingerprint-test.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+run_node_test <<'JS'
+const fs = require('fs')
+const serviceQml = fs.readFileSync(path.join(root, 'shell/plugins/lock/Service.qml'), 'utf8')
+
+// The fingerprint PAM stays armed for the whole lock waiting for a finger, so
+// `authenticating` is true from lock until unlock on every machine with a
+// reader enrolled. Gating the blank on it leaves the panel lit all night.
+assert(
+  /if \(root\.lockRequested && !root\.authenticatingPassword\) root\.runBlank\(\)/.test(serviceQml),
+  'only a password check in flight stops the blank timer from blanking'
+)
+
+assert(
+  !/idleBlankTimer[\s\S]*?!root\.authenticating\)/.test(serviceQml),
+  'the blank timer never gates on the combined authenticating state'
+)
+
+assert(
+  /onAuthenticatingPasswordChanged: \{\s*if \(!lockRequested\) return\s*if \(authenticatingPassword\) idleBlankTimer\.stop\(\)\s*else armBlankTimer\(\)/.test(serviceQml),
+  'the blank timer is held off by password entry and re-armed when it finishes'
+)
+
+assert(
+  !/onAuthenticatingChanged:/.test(serviceQml),
+  'the combined authenticating state no longer drives the blank timer'
+)
+JS