diff --git a/modules/workstation-setup.nix b/modules/workstation-setup.nix
index dd8119e..9688eec 100644
--- a/modules/workstation-setup.nix
+++ b/modules/workstation-setup.nix
@@ -212,7 +212,12 @@ let
     current_password=""
     token_pin=""
 
+    # Stream only non-sensitive progress markers to the GUI while keeping the
+    # complete homectl output in the private runtime log. This lets the wizard
+    # tell the user exactly when a physical touch is required, including when
+    # systemd-homed requests presence more than once during enrollment.
     set +e
+    set -o pipefail
     CREDENTIALS_DIRECTORY="$cred_dir" \
       LC_ALL=C LANG=C \
       ${pkgs.coreutils}/bin/timeout 120 \
@@ -221,8 +226,29 @@ let
         --fido2-with-client-pin=yes \
         --fido2-with-user-presence=yes \
         --fido2-with-user-verification=no \
-        >"$log_file" 2>&1
-    rc=$?
+        2>&1 | while IFS= read -r line || [ -n "$line" ]; do
+          ${pkgs.coreutils}/bin/printf '%s\n' "$line" >> "$log_file"
+
+          case "$line" in
+            *"Initializing FIDO2 credential on security token"*)
+              ${pkgs.coreutils}/bin/printf '%s\n' 'EVENT_FIDO_INITIALIZING'
+              ;;
+            *"Generating secret key on FIDO2 security token"*)
+              ${pkgs.coreutils}/bin/printf '%s\n' 'EVENT_FIDO_GENERATING'
+              ;;
+            *"Updating home directory"*)
+              ${pkgs.coreutils}/bin/printf '%s\n' 'EVENT_FIDO_UPDATING_HOME'
+              ;;
+            *"Synchronizing passwords and encryption keys"*)
+              ${pkgs.coreutils}/bin/printf '%s\n' 'EVENT_FIDO_SYNCHRONIZING'
+              ;;
+            *"confirm presence on security token"*)
+              ${pkgs.coreutils}/bin/printf '%s\n' 'EVENT_FIDO_TOUCH_REQUIRED'
+              ;;
+          esac
+        done
+    rc=''${PIPESTATUS[0]}
+    set +o pipefail
     set -e
 
     if [ "$rc" -eq 0 ]; then
@@ -255,7 +281,7 @@ let
 
   workstationSetup = pkgs.stdenv.mkDerivation {
     pname = "nixos-workstations-setup";
-    version = "1.8.4";
+    version = "1.8.5";
 
     src = ../workstation-setup;