diff --git a/Cargo.lock b/Cargo.lock
index 4e91439..b672735 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -298,6 +298,7 @@ dependencies = [
  "argon2",
  "authforge-common",
  "ctap-hid-fido2",
+ "data-encoding",
  "futures-util",
  "hex",
  "nix 0.28.0",
@@ -325,6 +326,7 @@ dependencies = [
  "futures-util",
  "gtk4",
  "libadwaita",
+ "qrcode",
  "tokio",
  "zbus",
 ]
@@ -1823,6 +1825,12 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "qrcode"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d68782463e408eb1e668cf6152704bd856c78c5b6417adaee3203d8f4c1fc9ec"
+
 [[package]]
 name = "quote"
 version = "1.0.45"
diff --git a/Cargo.toml b/Cargo.toml
index ba1b197..f0c85f7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -34,3 +34,5 @@ rusqlite = { version = "0.31", features = ["bundled"] }
 futures-util = "0.3"
 hex = "0.4"
 argon2 = "0.5"
+data-encoding = "2.6"
+qrcode = { version = "0.14", default-features = false, features = ["svg"] }
diff --git a/daemon/Cargo.toml b/daemon/Cargo.toml
index 5a85551..e0230fd 100644
--- a/daemon/Cargo.toml
+++ b/daemon/Cargo.toml
@@ -8,6 +8,10 @@ license.workspace = true
 name = "authforged"
 path = "src/main.rs"
 
+[features]
+default = ["totp"]
+totp = ["dep:data-encoding"]
+
 [dependencies]
 authforge-common = { path = "../common" }
 zbus = { workspace = true }
@@ -27,6 +31,7 @@ toml = { workspace = true }
 ctap-hid-fido2 = { workspace = true }
 hex = { workspace = true }
 argon2 = { workspace = true }
+data-encoding = { workspace = true, optional = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }
diff --git a/debian/control b/debian/control
index da98765..305b77d 100644
--- a/debian/control
+++ b/debian/control
@@ -31,6 +31,7 @@ Description: Turnkey FIDO2/U2F/TOTP MFA for Linux desktops (metapackage)
 Package: authforge-daemon
 Architecture: any
 Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-u2f, libfido2-1, dbus, policykit-1
+Recommends: libpam-google-authenticator
 Description: System daemon for authforge MFA management
  Provides the privileged D-Bus service that orchestrates enrollment,
  policy edits, and lockout-prevention checks.
diff --git a/gui/Cargo.toml b/gui/Cargo.toml
index 04f8b0d..ff72d28 100644
--- a/gui/Cargo.toml
+++ b/gui/Cargo.toml
@@ -8,6 +8,10 @@ license.workspace = true
 name = "authforge"
 path = "src/main.rs"
 
+[features]
+default = ["totp"]
+totp = ["dep:qrcode"]
+
 [dependencies]
 gtk = { package = "gtk4", version = "0.8" }
 adw = { package = "libadwaita", version = "0.6", features = ["v1_5"] }
@@ -16,3 +20,4 @@ anyhow = { workspace = true }
 zbus = { workspace = true }
 tokio = { workspace = true }
 futures-util = { workspace = true }
+qrcode = { workspace = true, optional = true }