diff --git a/etc/default.nix b/etc/default.nix
index 3a4e2bdecac..e9de343f9c3 100644
--- a/etc/default.nix
+++ b/etc/default.nix
@@ -243,6 +243,7 @@ import ../helpers/make-etc.nix {
       "useradd"
       "chsh"
       "xlock"
+      "kde"
       "common"
       "common-console" # shared stuff for interactive local sessions
     ]
diff --git a/etc/pam.d/kde b/etc/pam.d/kde
new file mode 100644
index 00000000000..50f3cc5ce60
--- /dev/null
+++ b/etc/pam.d/kde
@@ -0,0 +1,4 @@
+auth     include        common
+account  include        common
+password include        common
+session  include        common
diff --git a/system/system.nix b/system/system.nix
index 7a40ba7c885..9a2bda52963 100644
--- a/system/system.nix
+++ b/system/system.nix
@@ -314,8 +314,9 @@ rec {
     setuidPrograms =
       config.security.setuidPrograms ++
       config.security.extraSetuidPrograms ++
-      pkgs.lib.optional (config.security.sudo.enable) "sudo" ++
-      (if (config.services.atd.enable) then [ "at" "atq" "atrm" ] else []);
+      pkgs.lib.optional config.security.sudo.enable "sudo" ++
+      pkgs.lib.optionals config.services.atd.enable ["at" "atq" "atrm"] ++
+      pkgs.lib.optional (config.services.xserver.sessionType == "kde") "kcheckpass";
 
     inherit (usersGroups) createUsersGroups usersList groupsList;