The reader is still reachable on an external keyboard or a docked laptop, so hiding the icon and skipping the scan just forced the password. sudo and polkit keep their pam_exec lid gates. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>