diff --git a/home/programs/terminal/shell/zsh/rc/profile.zsh b/home/programs/terminal/shell/zsh/rc/profile.zsh
index de4a41f..1abf3fa 100644
--- a/home/programs/terminal/shell/zsh/rc/profile.zsh
+++ b/home/programs/terminal/shell/zsh/rc/profile.zsh
@@ -9,12 +9,12 @@ if [ -d "$HOME/.local/bin" ]; then
     PATH+=":${$(find -L ~/.local/bin -type d | tr '\n' ':')%%:}"
 fi
 
+# I'm using a greeter now, so the below is disabled.
 # Start graphical session automatically on tty1 if Hyprland or startx is available
-if [ "$(tty)" = "/dev/tty1" ] && [ "$UID" != 0 ]; then
-    if command -v Hyprland >/dev/null; then
-      ! pidof -s Hyprland >/dev/null 2>&1 && Hyprland
-    elif command -v startx >/dev/null; then
-      ! pidof -s Xorg >/dev/null 2>&1 && exec startx "$XINITRC"
-    fi
-fi
-
+#if [ "$(tty)" = "/dev/tty1" ] && [ "$UID" != 0 ]; then
+#    if command -v Hyprland >/dev/null; then
+#      ! pidof -s Hyprland >/dev/null 2>&1 && Hyprland
+#    elif command -v startx >/dev/null; then
+#      ! pidof -s Xorg >/dev/null 2>&1 && exec startx "$XINITRC"
+#    fi
+#fi
diff --git a/system/roles/workstation/display/default.nix b/system/roles/workstation/display/default.nix
index 638bb65..438f8c9 100644
--- a/system/roles/workstation/display/default.nix
+++ b/system/roles/workstation/display/default.nix
@@ -1,5 +1,6 @@
 {
   imports = [
+    ./login
     ./wayland
   ];
 }
diff --git a/system/roles/workstation/display/login/default.nix b/system/roles/workstation/display/login/default.nix
new file mode 100644
index 0000000..9163d23
--- /dev/null
+++ b/system/roles/workstation/display/login/default.nix
@@ -0,0 +1,6 @@
+{
+  imports = [
+    ./greetd.nix
+    ./pam.nix
+  ];
+}
diff --git a/system/roles/workstation/display/login/greetd.nix b/system/roles/workstation/display/login/greetd.nix
new file mode 100644
index 0000000..9590df6
--- /dev/null
+++ b/system/roles/workstation/display/login/greetd.nix
@@ -0,0 +1,58 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  inherit (lib) mkIf getExe;
+  inherit (lib.strings) concatStringsSep;
+
+
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+
+  sessionData = config.services.displayManager.sessionData.desktops;
+  sessionPaths = concatStringsSep ":" [
+    "${sessionData}/share/xsessions"
+    "${sessionData}/share/wayland-sessions"
+  ];
+
+  defaultSession = {
+    user = "greeter";
+    command = concatStringsSep " " [
+      (getExe pkgs.greetd.tuigreet)
+      "--time"
+      "--remember"
+      "--remember-user-session"
+      "--asterisks"
+      "--sessions '${sessionPaths}'"
+    ];
+  };
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    services.greetd = {
+      enable = true;
+      vt = 2;
+
+      # <https://man.sr.ht/~kennylevinsen/greetd/>
+      settings = {
+        # default session is what will be used if no session is selected
+        # in this case it'll be a TUI greeter
+        default_session = defaultSession;
+      };
+    };
+
+    # Suppress error messages on tuigreet. They sometimes obscure the TUI
+    # boundaries of the greeter.
+    # See: https://github.com/apognu/tuigreet/issues/68#issuecomment-1586359960
+    systemd.services.greetd.serviceConfig = {
+      Type = "idle";
+      StandardInputs = "tty";
+      StandardOutput = "tty";
+      StandardError = "journal";
+      TTYReset = true;
+      TTYVHangup = true;
+      TTYVTDisallocate = true;
+    };
+  };
+}
diff --git a/system/roles/workstation/display/login/pam.nix b/system/roles/workstation/display/login/pam.nix
new file mode 100644
index 0000000..7848f9a
--- /dev/null
+++ b/system/roles/workstation/display/login/pam.nix
@@ -0,0 +1,31 @@
+{lib, config, ...}: let
+  inherit (lib) mkIf;
+  deviceType = config.myOptions.device.roles.type;
+  acceptedTypes = ["laptop" "desktop"];
+in {
+  config = mkIf (builtins.elem deviceType acceptedTypes) {
+    # unlock GPG keyring on login
+    security.pam.services = let
+      gnupg = {
+        enable = true;
+        noAutostart = true;
+        storeOnly = true;
+      };
+    in {
+      login = {
+        enableGnomeKeyring = true;
+        inherit gnupg;
+      };
+
+      greetd = {
+        enableGnomeKeyring = true;
+        inherit gnupg;
+      };
+
+      tuigreet = {
+        enableGnomeKeyring = true;
+        inherit gnupg;
+      };
+    };
+  };
+}