diff --git a/cluster/services/irc/irc-host.nix b/cluster/services/irc/irc-host.nix
index b301303..3d26f8e 100644
--- a/cluster/services/irc/irc-host.nix
+++ b/cluster/services/irc/irc-host.nix
@@ -67,6 +67,12 @@ in {
     reloadServices = [ "ngircd" ];
     extraDomainNames = [ "irc.${domain}" ];
   };
+  security.pam.services.ngircd = {
+    text = ''
+      # verify IRC users via SSSD
+      auth required ${pkgs.sssd}/lib/security/pam_sss.so
+    '';
+  };
   age.secrets = { inherit (vars) ircPeerKey; };
   systemd.services.ngircd = {
     after = [ "acme-finished-${serverName}.target" "dhparams-gen-ngircd.service" ];