diff --git a/hardware-specific/onlykey.nix b/hardware-specific/onlykey.nix
index fa41e03..1a7d389 100644
--- a/hardware-specific/onlykey.nix
+++ b/hardware-specific/onlykey.nix
@@ -21,5 +21,7 @@
     onlykey-cli
   ];
 
+  security.pam.u2f.enable = true;
   hardware.onlykey.enable = true;
+  programs.i3lock.u2fSupport = true;
 }
diff --git a/program-config-files/i3.nix b/program-config-files/i3.nix
index b21ae42..237d6cb 100644
--- a/program-config-files/i3.nix
+++ b/program-config-files/i3.nix
@@ -100,6 +100,8 @@ pkgs.writeText "i3-conf" ''
   bindsym $mod+Shift+p mode "$mode_system"
   set $mode_system (l)ock, (s)uspend, (h)ibernate, (r)eboot, (S)hutdown
   mode "$mode_system" {
+        bindsym l exec --no-startup-id i3lock, mode "default"
+        bindsym s exec --no-startup-id systemctl suspend, mode "default"
         bindsym h exec --no-startup-id systemctl hibernate, mode "default"
         bindsym r exec --no-startup-id systemctl reboot, mode "default"
         bindsym Shift+s exec --no-startup-id systemctl poweroff, mode "default"