Configure Lenovo Thinkpad T480s fingerprint reader on Debian Bullseye


The fingerprint sensor on Lenovo Thinkpad T480s is not supported by libfprint, so you can’t use it out of the box. Thankfully, there’s a project called python-validity based on open-fprintd that’s easy to set up in, like, 5 minutes.


python-validity is available from open-fprintd PPA. I found that you can use Ubuntu Kinetic packages on Debian Bullseye without issues.

To add the PPA repository and install the necessary utilities, run the following commands:

sudo wget '' -O /etc/apt/trusted.gpg.d/uunicorn.asc

echo -e 'deb [signed-by=/etc/apt/trusted.gpg.d/uunicorn.asc] kinetic main\n#deb-src [signed-by=/etc/apt/trusted.gpg.d/uunicorn.asc] kinetic main' | sudo tee /etc/apt/sources.list.d/uunicorn-open-fprintd.list

sudo apt update && sudo apt install -V open-fprintd fprintd-clients python3-validity

Afterward, run the fprintd-enroll command and scan your fingerprint multiple times. For accurate fingerprint detection, it helps to scan your fingerprint at slightly different angle each time.


Finally, enable the sudo authentication with the fingerprint method:

sudo pam-auth-update

Suspend/hibernate fingerprint sensor fix

I had a problem with the fingerprint sensor not working when the laptop was resuming from suspend and hibernate. In my case, enabling open-fprintd-resume and open-fprintd-suspend didn’t help, but a custom one-shot Systemd unit (as suggested on the Arch wiki did the trick.

This one-shot simply restarts open-fprintd and python3-validity services when resuming from suspend/hibernate. To install it, simply run:

cat << EOF | sudo tee /etc/systemd/system/fingerprint-restart.service
Description=Restart services to fix fingerprint integration

ExecStart=systemctl restart open-fprintd.service python3-validity.service


sudo systemctl daemon-reload
sudo systemctl enable fingerprint-restart.service

Oh, would you look at the time! Exactly 5 minutes 🙂