diff --git a/crates/visaged/Cargo.toml b/crates/visaged/Cargo.toml
index 060faf8..f5072cc 100644
--- a/crates/visaged/Cargo.toml
+++ b/crates/visaged/Cargo.toml
@@ -46,3 +46,22 @@ assets = [
     ["../../packaging/debian/pam-auth-update", "usr/share/pam-configs/visage", "644"],
     ["../../README.md", "usr/share/doc/visage/README.md", "644"],
 ]
+
+# Fedora/RHEL RPM: `cargo generate-rpm -p crates/visaged` (paths are workspace-relative).
+[package.metadata.generate-rpm]
+name = "visage"
+auto-req = "no"
+requires = { pam = "*", dbus = "*", systemd = "*" }
+post_install_script = "systemctl daemon-reload >/dev/null 2>&1 || :"
+post_uninstall_script = "systemctl daemon-reload >/dev/null 2>&1 || :"
+assets = [
+  { source = "target/release/visaged", dest = "/usr/bin/visaged", mode = "755" },
+  { source = "target/release/visage",  dest = "/usr/bin/visage",  mode = "755" },
+  { source = "target/release/libpam_visage.so", dest = "/usr/lib64/security/pam_visage.so", mode = "644" },
+  { source = "packaging/dbus/org.freedesktop.Visage1.conf", dest = "/usr/share/dbus-1/system.d/org.freedesktop.Visage1.conf", mode = "644", config = true },
+  { source = "packaging/systemd/visaged.service",       dest = "/usr/lib/systemd/system/visaged.service",       mode = "644" },
+  { source = "packaging/systemd/visage-resume.service", dest = "/usr/lib/systemd/system/visage-resume.service", mode = "644" },
+  { source = "packaging/rpm/visage.pam", dest = "/usr/share/visage/pam.d/visage", mode = "644", doc = true },
+  { source = "README.md", dest = "/usr/share/doc/visage/README.md", mode = "644", doc = true },
+  { source = "LICENSE",   dest = "/usr/share/licenses/visage/LICENSE", mode = "644", doc = true },
+]
diff --git a/crates/visaged/tests/pam_control_contract.rs b/crates/visaged/tests/pam_control_contract.rs
index ce7c765..5087ad3 100644
--- a/crates/visaged/tests/pam_control_contract.rs
+++ b/crates/visaged/tests/pam_control_contract.rs
@@ -24,6 +24,7 @@ const DECLARING_FILES: &[&str] = &[
     "packaging/debian/pam-auth-update",
     "packaging/aur/visage.install",
     "packaging/nix/module.nix",
+    "packaging/rpm/visage.pam",
 ];
 
 /// Valid PAM actions, per `pam.conf(5)`. Anything else — including `end` — is
diff --git a/docs/operations-guide.md b/docs/operations-guide.md
index 298e992..1e5d57a 100644
--- a/docs/operations-guide.md
+++ b/docs/operations-guide.md
@@ -129,6 +129,27 @@ from `/etc/pam.d/system-auth` manually.
 
 ---
 
+### Fedora (RPM, build from source)
+
+```bash
+sudo dnf install pam-devel dbus-devel clang-devel
+cargo install cargo-generate-rpm
+cargo build --release --workspace
+cargo generate-rpm -p crates/visaged
+sudo dnf install ./target/generate-rpm/visage-*.rpm
+sudo systemctl enable --now visaged visage-resume
+```
+
+PAM is manual on Fedora: authselect owns `system-auth` and `password-auth` and overwrites
+edits there. Add the line from `/usr/share/visage/pam.d/visage` as the second line of each
+service you want (`sudo`, `polkit-1`, `gdm-password`):
+
+```text
+auth        [success=done default=ignore]    pam_visage.so
+```
+
+---
+
 ## First-Time Setup
 
 ### 1. Download models (one-time):
diff --git a/packaging/rpm/visage.pam b/packaging/rpm/visage.pam
new file mode 100644
index 0000000..280f9be
--- /dev/null
+++ b/packaging/rpm/visage.pam
@@ -0,0 +1,4 @@
+#%PAM-1.0
+# Fedora has no pam-auth-update and authselect owns system-auth. Add this line
+# as the second line of each service that should accept a face (sudo, polkit-1, gdm-password).
+auth        [success=done default=ignore]    pam_visage.so