diff --git a/INSTALLATION.md b/INSTALLATION.md
index 568148c..9c929d8 100644
--- a/INSTALLATION.md
+++ b/INSTALLATION.md
@@ -158,6 +158,25 @@ $ sudo sbctl status                     # Secure Boot: ✓ Enabled
 - If it doesn't boot anymore, disabling Secure Boot in the firmware boots as before
 - Losing the keys isn't fatal: erase the keys in the firmware and start over at step 1
 
+## how to unlock the disk with the tpm (laptops)
+Needs Secure Boot first. The TPM releases the key only with the PIN and while
+the Secure Boot state (PCR 7) is unchanged. The passphrase stays as fallback.
+
+1. enroll the TPM with a PIN as an additional key slot
+```bash
+# asks for the current passphrase, then the new PIN
+$ sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
+```
+
+2. import `modules/nixos/tpm-unlock.nix` in the host's `configuration.nix`, rebuild and reboot
+
+- If the passphrase is suddenly asked for instead of the PIN, the Secure Boot
+  state changed. After a firmware update that's expected, otherwise investigate
+  before typing the passphrase. To re-enroll:
+```bash
+$ sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/disk/by-label/nixcrypt
+```
+
 ## how to upgrade the system
 ```bash
 $ cd /path/to/repo
diff --git a/hosts/krypton/configuration.nix b/hosts/krypton/configuration.nix
index 05059ae..ae8ddea 100644
--- a/hosts/krypton/configuration.nix
+++ b/hosts/krypton/configuration.nix
@@ -24,6 +24,7 @@
     ../../modules/nixos/services.nix
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
+    ../../modules/nixos/tpm-unlock.nix
     ../../modules/nixos/users.nix
     ../../modules/nixos/vial.nix
   ];
diff --git a/modules/nixos/tpm-unlock.nix b/modules/nixos/tpm-unlock.nix
new file mode 100644
index 0000000..419f261
--- /dev/null
+++ b/modules/nixos/tpm-unlock.nix
@@ -0,0 +1,8 @@
+# Unlock cryptroot with the TPM and a PIN, the passphrase stays as fallback.
+# The TPM only releases the key while PCR 7 (the Secure Boot state) matches,
+# so this needs lanzaboote.nix. Enrolled once per host with
+# `systemd-cryptenroll`, see INSTALLATION.md.
+
+{
+  boot.initrd.luks.devices."cryptroot".crypttabExtraOpts = [ "tpm2-device=auto" ];
+}