anchor.diff:      }
       ''}
   
  -    ${if (luks.yubikeySupport && (yubikey != null)) || (luks.gpgSupport && (gpgCard != null)) then ''
  +    ${optionalString (luks.fido2Support && (fido2.credential != null)) ''
  +
  +    open_with_hardware() {
  +      local passsphrase
  +
  +      if wait_fido2key ${toString fido2.gracePeriod}; then
  +          ${if fido2.passwordLess then ''
  +            export passphrase=""
  +          '' else ''
  +            echo -n "FIDO2 salt for ${device}: "
  +            read -rs passphrase
  +            echo
  +          ''}
  +            echo "Waiting for your FIDO2 device..."
  +            fido2luks -i open ${device} ${name} ${fido2.credential} --salt string:$passphrase
  +        else
  +            echo "No FIDO2 key found, falling back to normal open procedure"
  +            open_normally
  +        fi
  +    }
  +    ''}
  +
  +    ${if (luks.yubikeySupport && (yubikey != null)) || (luks.gpgSupport && (gpgCard != null)) || (luks.fido2Support && (fido2.credential != null)) then ''
       open_with_hardware
       '' else ''
       open_normally
  
positive.code:     umount /crypt-ramfs 2>/dev/null
    '';
  
    openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, gpgCard, fallbackToPassword, ... }: assert name' == name;
    let
      csopen   = "cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} ${optionalString (header != null) "--header=${header}"}";
      cschange = "cryptsetup luksChangeKey ${device} ${optionalString (header != null) "--header=${header}"}";
  
negative.code:         $out/bin/gpg-agent --version
          $out/bin/scdaemon --version
        ''}
        ${optionalString luks.fido2Support ''
          $out/bin/fido2luks --version
        ''}
      '';
  
      boot.initrd.preFailCommands = postCommands;
  