There is a security risk associated with configuring auth sufficient pam_fprintd.so in /etc/pam.d/system-auth (see NVD - cve-2024-37408).
A safer approach may be to enable fingerprint authentication only in /etc/pam.d/polkit-1 (and in /etc/pam.d/sddm for login) and to use run0 instead of sudo (for tasks authenticated through fprintd). This reduces the risk of silently approving a privilege-escalation request other than the one the user intended.
For example, try running two commands simultaneously in different terminals (e.g. sudo whoami and echo Place your finger on the fingerprint reader;cat) and then authenticate with your fingerprint; see Fwd: Security vulnerability in fprintd.
Some information about run0: Sudo alternatives - #7 by triam; for common maintenance tasks, you can alias sudo to run0.
In minimal desktop environments or window managers, a PolicyKit authentication agent (e.g. polkit-gnome) is required to display authentication prompts.
In case of authentication problems with the CS9711 after resuming from sleep:
sudo tee /usr/lib/systemd/system-sleep/fprintd-fix <<'EOF'
#!/bin/sh
case "$1" in
post)
systemctl restart fprintd.service
;;
esac
EOF
sudo chmod +x /usr/lib/systemd/system-sleep/fprintd-fix