diff --git a/modules/workstation-setup.nix b/modules/workstation-setup.nix
index 7f0f84e..ca9f81f 100644
--- a/modules/workstation-setup.nix
+++ b/modules/workstation-setup.nix
@@ -93,10 +93,23 @@ let
           raise SystemExit(code)
 
       def read_secret() -> str:
-          value = sys.stdin.readline()
-          if value == "":
+          # Read bytes so Nix/Python escaping cannot accidentally turn the
+          # line terminator into part of the FIDO2 PIN. QProcess terminates
+          # each secret with LF; tolerate CRLF as well.
+          raw = sys.stdin.buffer.readline()
+          if raw == b"":
               fail("INPUT_ERROR", 30)
-          return value.rstrip("\\r\\n")
+          if raw.endswith(bytes([10])):
+              raw = raw[:-1]
+          if raw.endswith(bytes([13])):
+              raw = raw[:-1]
+          try:
+              value = raw.decode("utf-8")
+          except UnicodeDecodeError:
+              fail("INPUT_ERROR", 30)
+          if chr(10) in value or chr(13) in value:
+              fail("INPUT_ERROR", 30)
+          return value
 
       new_pin = read_secret()
       confirmation = read_secret()
@@ -242,7 +255,7 @@ let
 
   workstationSetup = pkgs.stdenv.mkDerivation {
     pname = "nixos-workstations-setup";
-    version = "1.8.2";
+    version = "1.8.3";
 
     src = ../workstation-setup;