diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index ad77fb5..8850767 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -397,6 +397,8 @@ jobs:
             fi
             cp packaging/souveraine-verify-trail "$PKG_WORK/"
             cp packaging/souveraine-button "$PKG_WORK/"
+            cp packaging/souveraine-stepup.pam \
+               packaging/org.souveraine.stepup.policy "$PKG_WORK/"
             cp packaging/arch/PKGBUILD.prebuilt "$PKG_WORK/PKGBUILD"
             (
               cd "$PKG_WORK"
diff --git a/packaging/arch/PKGBUILD.prebuilt b/packaging/arch/PKGBUILD.prebuilt
index c2344a9..add6854 100644
--- a/packaging/arch/PKGBUILD.prebuilt
+++ b/packaging/arch/PKGBUILD.prebuilt
@@ -10,16 +10,18 @@ pkgdesc="Sovereign agent substrate — server, TUI, surfaces"
 arch=("${SOUVERAINE_PKGARCH:?CI must set SOUVERAINE_PKGARCH}")
 url="https://gitea.wiuf.net/Fimeg/souveraine"
 license=('MIT')
-depends=('gcc-libs' 'alsa-lib')
+depends=('gcc-libs' 'alsa-lib' 'pam')
 options=('!strip')
+backup=('etc/pam.d/souveraine-stepup')
 source=('souveraine-binary' 'souveraine.service'
         'souveraine-secrets-binary' 'souveraine-secrets.service'
         'souveraine-machined-binary' 'souveraine-machined.service'
         'souveraine-sessiond-binary' 'souveraine-sessiond.service'
         'souveraine-verify-trail' 'souveraine-button'
+        'souveraine-stepup.pam' 'org.souveraine.stepup.policy'
         'LICENSE')
 sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
-            'SKIP' 'SKIP' 'SKIP')
+            'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
 # sessiond is built and packaged for both supported architectures. Installing
 # its user unit does not enable or start it; activation remains target-owned.
 if [ "$CARCH" = aarch64 ]; then
@@ -92,5 +94,15 @@ package() {
     # check is not evidence (DEVICE-STATE-MACHINE.md §11).
     install -Dm755 "$srcdir/souveraine-verify-trail" \
         "$pkgdir/usr/bin/souveraine-verify-trail"
+
+    # Step-up authentication. Root-owned system config, so it can only arrive
+    # by package — rootfs-overlay/ reaches a device on flash and the phone does
+    # not flash (TASK-28). Both arches: the laptop authenticates by password
+    # until it has a second factor.
+    install -Dm644 "$srcdir/souveraine-stepup.pam" \
+        "$pkgdir/etc/pam.d/souveraine-stepup"
+    install -Dm644 "$srcdir/org.souveraine.stepup.policy" \
+        "$pkgdir/usr/share/polkit-1/actions/org.souveraine.stepup.policy"
+
     install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }
diff --git a/packaging/org.souveraine.stepup.policy b/packaging/org.souveraine.stepup.policy
new file mode 100644
index 0000000..375ac71
--- /dev/null
+++ b/packaging/org.souveraine.stepup.policy
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+  <vendor>SouveraineOS</vendor>
+  <vendor_url>https://gitea.wiuf.net/Fimeg/souveraine</vendor_url>
+
+  <!-- Fallback path for StepUpAuth on targets without a PamContext route.
+       auth_self, never auth_admin: step-up re-proves the user to themselves,
+       it does not escalate. Inactive sessions get nothing. -->
+  <action id="org.souveraine.stepup">
+    <description>Confirm a sensitive Souveraine action</description>
+    <message>Authentication is required to confirm this action</message>
+    <defaults>
+      <allow_any>no</allow_any>
+      <allow_inactive>no</allow_inactive>
+      <allow_active>auth_self</allow_active>
+    </defaults>
+  </action>
+</policyconfig>
diff --git a/packaging/souveraine-stepup.pam b/packaging/souveraine-stepup.pam
new file mode 100644
index 0000000..2823cfc
--- /dev/null
+++ b/packaging/souveraine-stepup.pam
@@ -0,0 +1,13 @@
+# Step-up authentication for SouveraineOS (SESSION-AUTHORITY-DOCTRINE §3).
+# Never unlocks the session; a success mints a short-lived in-memory grant.
+#
+# Same stack as the lock surface, for the same reason souveraine-sessiond gives:
+# step-up must accept exactly the credentials the lockscreen accepts, no more.
+#
+# The leading '-' loads the FPC factor only where it is installed, so one file
+# serves the phone and the laptop. The module is polkit-1-only today and
+# returns PAM_IGNORE here until its service allowlist is widened.
+-auth		sufficient	pam_fpc_polkit.so
+auth		include		login
+
+account		include		login