diff --git a/lyrathorpe/swaywm.nix b/lyrathorpe/swaywm.nix
index eb14ab9..200c91c 100644
--- a/lyrathorpe/swaywm.nix
+++ b/lyrathorpe/swaywm.nix
@@ -45,6 +45,25 @@ in
       font-awesome
     ];
 
+    # Wayland login screen (replaces console/getty login on every Sway host).
+    # greetd runs ReGreet inside the cage kiosk compositor; the Sway session is
+    # offered automatically because programs.sway registers itself via
+    # services.displayManager.sessionPackages. Hosts that turn off
+    # features.swayDesktop (e.g. EDaaS) keep plain TTY login.
+    programs.regreet.enable = true;
+    # cage reads the XKB_* environment at startup, so force the greeter onto the
+    # same Dvorak layout as the console (workstation.nix) and the Sway session
+    # (home/sway.nix) -- otherwise the password field would be QWERTY. This
+    # overrides the greetd command regreet sets with mkDefault.
+    services.greetd.settings.default_session.command =
+      let
+        greeter = pkgs.writeShellScript "regreet-cage" ''
+          export XKB_DEFAULT_LAYOUT=dvorak
+          exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} -s -- ${lib.getExe config.programs.regreet.package}
+        '';
+      in
+      "${greeter}";
+
     # Desktop portals: enables screen sharing (wlroots) and native file pickers
     # for Wayland apps such as Element and Firefox.
     xdg.portal = {