One morning my thumb stopped working. Specifically: Touch ID for sudo, the small quality-of-life trick that lets a fingerprint stand in for typing your password into the terminal forty times a day, was dead. Password prompt every time, like an animal.
The quiet “(a)” build
Nothing had changed overnight — except, of course, something had. sw_vers showed the build number ending in “(a)”, the quiet signature of a macOS Rapid Security Response: the small emergency patches Apple ships between real updates. It had installed itself overnight, done whatever re-staging it does, and moved on without leaving a note.
Two casualties, it turned out, and finding them was the fun part.
The file updates shouldn’t clobber
First: Touch ID for sudo lives in exactly one file, /etc/pam.d/sudo_local — a file Apple deliberately keeps separate from the main sudo config so that updates won’t clobber it. That’s its entire reason for existing. The security patch clobbered it anyway. File timestamps told the story: the template file sat there untouched from February, while my actual config had simply vanished during the patch’s re-staging. The fix is two lines — copy the template back, uncomment the line that enables fingerprint auth.
A broken Secure Enclave marriage
Except my thumb still didn’t work, which is how I learned there was a second casualty. bioutil swore Touch ID was enrolled and enabled. The sensor, though, is in my Magic Keyboard, and a fingerprint reader in an external keyboard doesn’t just send fingerprints over Bluetooth — it holds a cryptographic pairing with the Mac’s Secure Enclave, the dedicated security chip that keeps biometrics out of reach of the OS itself. The patch had reset that relationship. The keyboard and the Mac were still talking; they just no longer trusted each other with anything as intimate as my thumbprint.
Five seconds of USB-C
The fix for a broken Secure Enclave marriage is comically physical: plug the keyboard into the Mac with a USB-C cable for about five seconds. That’s it. The wired connection is the trusted channel for re-pairing, presence of the cable being proof you’re actually at the machine. Unplug, and the fingerprint works again.
Thirty-four minutes, start to finish, most of it spent proving what hadn’t broken. And the last five spent writing the whole diagnosis into my notes, because Rapid Security Responses will keep shipping and this one will absolutely do it again. Next time the fix is two commands and a cable, and the patch doesn’t get to take the morning.