diff --git a/hosts/default.nix b/hosts/default.nix
index 1188b11..b2207e6 100644
--- a/hosts/default.nix
+++ b/hosts/default.nix
@@ -18,7 +18,7 @@
   # get these into the module system
   specialArgs = {inherit inputs self;};
 
-  # shared modules for all configurations
+  # shared modules for all configurations (personal + work)
   sharedModules = [
     ./aesthetic
     "${mod}/services/gnome-services.nix"
@@ -26,11 +26,6 @@
     "${home}"
     "${self}/work"
     inputs.sops-nix.nixosModules.sops
-    inputs.himmelblau.nixosModules.himmelblau
-    inputs.mdatp.nixosModules.mdatp
-    {
-      services.mdatp.enable = true;
-    }
   ];
 in {
   flake.nixosConfigurations = {
@@ -86,6 +81,22 @@ in {
         ];
     };
 
+    # Laptop work: laptop profile + work modules (himmelblau, cisco, mdatp)
+    laptop-work = nixosSystem {
+      inherit specialArgs;
+      modules =
+        laptop
+        ++ sharedModules
+        ++ [
+          "${mod}/services/location.nix"
+          {
+            work.cisco.enable = true;
+            work.himmelblau.enable = true;
+            work.mdatp.enable = true;
+          }
+        ];
+    };
+
     # Server: severijnse.eu (Hetzner) — fully isolated under servers/hetzner/.
     # Uses nixos-24.05 + disko + sops-nix and does NOT inherit the laptop's shared modules.
     hetzner = nixosSystem24 {
diff --git a/system/default.nix b/system/default.nix
index 704585e..c04780a 100644
--- a/system/default.nix
+++ b/system/default.nix
@@ -21,9 +21,10 @@ let
     ./services/pipewire.nix # audio
   ];
 
-  # Laptop-specific modules (battery, bluetooth)
+  # Laptop-specific modules (battery, bluetooth, fingerprint)
   laptop = [
     ./hardware/bluetooth.nix
+    ./hardware/fingerprint.nix
     ./services/power.nix
   ];
 in {
diff --git a/system/hardware/fingerprint.nix b/system/hardware/fingerprint.nix
new file mode 100644
index 0000000..082e786
--- /dev/null
+++ b/system/hardware/fingerprint.nix
@@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }:
+
+# Fingerprint scanner configuration
+#
+# Enable on laptops with a fingerprint reader:
+#   hardware.fingerprint.enable = true;
+#
+# For some sensors (Goodix, Elan, Synaptics), you may also need to set
+# the TOD driver:
+#   hardware.fingerprint.todDriver = pkgs.libfprint-2-tod1-goodix;
+#
+# Reference: https://wiki.nixos.org/wiki/Fingerprint_scanner
+
+let
+  cfg = config.hardware.fingerprint;
+in {
+  options.hardware.fingerprint = {
+    enable = lib.mkEnableOption "fingerprint scanner support (fprintd)";
+
+    todDriver = lib.mkOption {
+      description = "Touch OEM Drivers (TOD) package to use for the fingerprint sensor";
+      type = lib.types.nullOr lib.types.package;
+      default = null;
+      example = lib.literalExpression "pkgs.libfprint-2-tod1-goodix";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.fprintd.enable = true;
+
+    services.fprintd.tod = lib.mkIf (cfg.todDriver != null) {
+      enable = true;
+      driver = cfg.todDriver;
+    };
+  };
+}
diff --git a/work/cisco.nix b/work/cisco.nix
index f7915f6..2cd292a 100644
--- a/work/cisco.nix
+++ b/work/cisco.nix
@@ -17,7 +17,7 @@ let
 in {
   options.work.cisco = {
     enable = lib.mkEnableOption "Cisco Secure Client" // {
-      default = true;
+      default = false;
     };
 
     package = lib.mkOption {
diff --git a/work/default.nix b/work/default.nix
index 83ec763..26c7a5a 100644
--- a/work/default.nix
+++ b/work/default.nix
@@ -3,6 +3,7 @@
     ./overlay.nix
     ./cisco.nix
     ./himmelblau.nix
+    ./mdatp.nix
   ];
 
   # Create the work directory for the user
diff --git a/work/himmelblau.nix b/work/himmelblau.nix
index 56b9c79..01258ea 100644
--- a/work/himmelblau.nix
+++ b/work/himmelblau.nix
@@ -18,9 +18,13 @@
 let
   cfg = config.work.himmelblau;
 in {
+  imports = [
+    inputs.himmelblau.nixosModules.himmelblau
+  ];
+
   options.work.himmelblau = {
     enable = lib.mkEnableOption "Himmelblau Entra ID authentication" // {
-      default = true;
+      default = false;
     };
   };
 
diff --git a/work/mdatp.nix b/work/mdatp.nix
new file mode 100644
index 0000000..a81e021
--- /dev/null
+++ b/work/mdatp.nix
@@ -0,0 +1,22 @@
+{ config, lib, pkgs, inputs, ... }:
+
+# Microsoft Defender for Endpoint
+#
+# References:
+#   - https://github.com/epetousis/nix-mdatp
+
+let
+  cfg = config.work.mdatp;
+in {
+  imports = [
+    inputs.mdatp.nixosModules.mdatp
+  ];
+
+  options.work.mdatp = {
+    enable = lib.mkEnableOption "Microsoft Defender for Endpoint";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.mdatp.enable = true;
+  };
+}