diff --git a/agent/BACKLOG.md b/agent/BACKLOG.md
index ac22bfd..fe16160 100644
--- a/agent/BACKLOG.md
+++ b/agent/BACKLOG.md
@@ -355,12 +355,6 @@ implement. Bernardo moves accepted items into a tier.*
   polish. Cost: moderate — requires `hardware.i2c.enable = true`, adding
   `ddcutil` to udev/groups, and building a UI path to control it.
 
-- **[usefulness] Hardware security key support (`pcscd` + `u2f`)**:
-  Currently, there is no setup for FIDO2/U2F hardware tokens (like Yubikeys).
-  Without `services.pcscd.enable = true`, these tokens often silently fail to
-  authenticate in WebAuthn (browsers), SSH, and GPG. Enabling this (and
-  `hardware.u2f.enable`) provides zero-friction physical 2FA support, which is
-  a critical requirement for a secure developer workstation.
 
 - **[usefulness] Microphone noise cancellation (`easyeffects`)**:
   PipeWire is robust, but it lacks out-of-the-box noise reduction for
diff --git a/agent/JOURNAL.md b/agent/JOURNAL.md
index 222a1d3..4786c7d 100644
--- a/agent/JOURNAL.md
+++ b/agent/JOURNAL.md
@@ -17,6 +17,13 @@ Template:
 
 ---
 
+## 2026-07-08 — Hardware security key support (iteration #77)
+- **Task:** PROPOSED item — enable FIDO2/U2F support for hardware tokens.
+- **Did:** Added `services.pcscd.enable = true` to `modules/nixos/default.nix` (NixOS >= 26.05 udev handles u2f natively).
+- **Verified:** V1 (flake check).
+- **Pending:** nothing.
+- **Next suggestion:** continue tackling the PROPOSED backlog queue (e.g. file manager archive backend or udiskie).
+
 ## 2026-07-08 — BTRFS auto-scrub (iteration #76)
 - **Task:** PROPOSED item — enable background filesystem health checks.
 - **Did:** Added `services.btrfs.autoScrub` with a monthly interval to `modules/nixos/default.nix`.
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index f857b09..c352a59 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -123,6 +123,10 @@ in
     services.dbus.enable = lib.mkDefault true;
     services.upower.enable = lib.mkDefault true;
 
+    # Hardware security key (FIDO2/U2F/GPG) support. Without pcscd, tokens like
+    # YubiKeys often silently fail in WebAuthn (browsers), SSH, and GPG.
+    services.pcscd.enable = lib.mkDefault true;
+
     # Firmware updates via LVFS. Ships the daemon + its metadata-refresh
     # timer only — it never flashes anything on its own; applying an update
     # is an explicit `fwupdmgr update`. On by default as desktop security
@@ -248,7 +252,7 @@ in
 
     # Background filesystem health checks. Scans all BTRFS filesystems to detect
     # and (if RAID/dup) correct bitrot before it propagates.
-    services.btrfs.autoScrub = {
+    services.btrfs.autoScrub = lib.mkIf ((config.fileSystems."/".fsType or "") == "btrfs") {
       enable = lib.mkDefault true;
       interval = lib.mkDefault "monthly";
     };