diff --git a/Cargo.lock b/Cargo.lock
index 7cdbe7a..8acebd1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -395,7 +395,7 @@ dependencies = [
 
 [[package]]
 name = "pam_fido2"
-version = "0.2.5"
+version = "0.2.7"
 dependencies = [
  "ctap_hmac 0.4.1 (registry+https://github.com/rust-lang/crates.io-index)",
  "ctrlc 3.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
diff --git a/Cargo.toml b/Cargo.toml
index e35fda3..597091c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "pam_fido2"
-version = "0.2.5"
+version = "0.2.7"
 authors = ["shimun <shimun@shimun.net>"]
 edition = "2018"
 
diff --git a/default.nix b/default.nix
new file mode 100644
index 0000000..d3497c5
--- /dev/null
+++ b/default.nix
@@ -0,0 +1,14 @@
+{ pkgs ? import <nixpkgs> { }
+, callPackage ? pkgs.callPackage
+, name ? "pam_fido2"
+}:
+let
+  crate2nix_tools = import "${builtins.fetchTarball { url = "https://github.com/kolloch/crate2nix/archive/0.8.0.tar.gz"; }}/tools.nix" { };
+  overrides = pkgs.defaultCrateOverrides // {
+    pam_fido2 = attrs: with pkgs; {
+      buildInputs = [ linux-pam ];
+    };
+  };
+  project = callPackage (crate2nix_tools.generatedCargoNix { name = name; src = "${./.}"; }) { defaultCrateOverrides = overrides; };
+in
+project.rootCrate.build
diff --git a/src/pamfido2.rs b/src/pamfido2.rs
index ea69e87..cde3a4e 100644
--- a/src/pamfido2.rs
+++ b/src/pamfido2.rs
@@ -90,13 +90,15 @@ impl Settings {
             let re = Regex::new(&pattern).expect(&["Invalid regex pattern:", &pattern].join(" "));
             if re.is_match(user) {
                 let mut parts = cred.split(":");
-                //TODO: use expect
-                let id = parts.by_ref().next().unwrap();
-                let key = parts.by_ref().next().unwrap();
-                creds.push(ctap::FidoCredential {
-                    id: hex::decode(id).unwrap(),
-                    public_key: hex::decode(key).ok(),
-                });
+                match (parts.by_ref().next(), parts.by_ref().next()) {
+                    (Some(id), Some(key)) => {
+                        creds.push(ctap::FidoCredential {
+                            id: hex::decode(id).unwrap(),
+                            public_key: hex::decode(key).ok(),
+                        });
+                    }
+                    _ => eprintln!("Failed to parse {}", cred),
+                }
             }
         }
         creds