diff --git a/implementations/main.cpp b/implementations/main.cpp
index 12a7cd0..00c7eac 100644
--- a/implementations/main.cpp
+++ b/implementations/main.cpp
@@ -68,7 +68,7 @@ namespace {
 
 // Bumping this is what publishes a package: the registry answers 409 for a
 // version it already has, which a build treats as a no-op.
-constexpr const char* Version = "0.2.1";
+constexpr const char* Version = "0.2.2";
 
 bool g_verbose = false;
 // 500 ms was the research harness's pace, chosen so a human could read the
diff --git a/packaging/APKBUILD b/packaging/APKBUILD
index dcca2b0..c783055 100644
--- a/packaging/APKBUILD
+++ b/packaging/APKBUILD
@@ -10,7 +10,7 @@
 # Alpine, so an APKBUILD that compiled from source could not be built by
 # anyone but us either.
 pkgname=fingerprintd
-pkgver=0.2.1
+pkgver=0.2.2
 pkgrel=0
 pkgdesc="Fingerprint daemon for the Fairphone 6 (FocalTech FT9391 behind QTEE)"
 url="https://forgejo.catcrafts.net/Catcrafts/fingerprintd"
@@ -106,6 +106,8 @@ package() {
 	# Vendor directory, so /etc/pam.d still overrides it.
 	install -Dm644 fingerprint-auth.pam \
 		"$pkgdir"/usr/lib/pam.d/fingerprint-auth
+	install -Dm644 postlogin.pam \
+		"$pkgdir"/usr/lib/pam.d/postlogin
 
 	# Documentation, not configuration: shipping an /etc/fingerprintd/
 	# actions.conf would be shipping a root shell nobody asked for. The
diff --git a/packaging/make-bin-tarball.sh b/packaging/make-bin-tarball.sh
index d7098d3..47d3eb2 100755
--- a/packaging/make-bin-tarball.sh
+++ b/packaging/make-bin-tarball.sh
@@ -26,6 +26,7 @@ cp packaging/fingerprintd.service \
    packaging/fingerprintd.json \
    packaging/20-focal64.manifest \
    packaging/fingerprint-auth.pam \
+   packaging/postlogin.pam \
    packaging/actions.conf.example \
    "$stage/fingerprintd-$VER/"
 tar -C "$stage" -czf "fingerprintd-$VER.tar.gz" "fingerprintd-$VER"
diff --git a/packaging/postlogin.pam b/packaging/postlogin.pam
new file mode 100644
index 0000000..4496ac6
--- /dev/null
+++ b/packaging/postlogin.pam
@@ -0,0 +1,28 @@
+#%PAM-1.0
+# SPDX-License-Identifier: GPL-3.0-only
+# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
+#
+# The second service kscreenlocker names and Alpine does not provide.
+#
+# /etc/pam.d/kde-fingerprint is written for a Fedora/authselect layout. Its
+# auth stack is:
+#
+#     auth  substack  fingerprint-auth
+#     auth  include   postlogin
+#
+# Neither file exists on Alpine. With only the first supplied, a fingerprint
+# that MATCHED still came back as "Permission denied", because the include of
+# a missing service fails after the match has already succeeded -- which is a
+# confusing way to be told a file is absent.
+#
+# On Fedora postlogin does lastlog and umask bookkeeping. Nothing here needs
+# that. What is needed is that the seam exists and contributes nothing, so the
+# result of the stack stays the one the fingerprint substack produced.
+#
+# Vendor directory, so an administrator can still override it in /etc/pam.d.
+# Shipped here for the same reason as fingerprint-auth: this package is what
+# makes the fingerprint half of that stack mean anything.
+auth      optional  pam_permit.so
+account   optional  pam_permit.so
+password  optional  pam_permit.so
+session   optional  pam_permit.so