diff --git a/dotfiles/systemd-user/.config/systemd/user/swayidle-lock.service b/dotfiles/systemd-user/.config/systemd/user/swayidle-lock.service
new file mode 100644
index 0000000..6c40f1b
--- /dev/null
+++ b/dotfiles/systemd-user/.config/systemd/user/swayidle-lock.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=swayidle idle lock (locks via noctalia-shell IPC, suspends on lid)
+Documentation=https://github.com/swaywm/swayidle
+After=graphical-session.target
+
+[Service]
+# qs exists on dankware, bare noctalia CLI on blankpad; the fallback chain makes
+# this one unit correct on both hosts. deploy.sh enables it only where the
+# ExecStart binary resolves, so it stays inert until swayidle is installed.
+ExecStart=/usr/bin/swayidle -w \
+  timeout 300 'qs -c noctalia-shell ipc call lockScreen lock || noctalia msg session lock' \
+  before-sleep 'qs -c noctalia-shell ipc call lockScreen lock || noctalia msg session lock' \
+  after-resume 'qs -c noctalia-shell ipc call lockScreen lock || noctalia msg session lock'
+Restart=on-failure
+RestartSec=5s
+
+[Install]
+WantedBy=default.target