[Unit]
Description=Lock session after login
After=graphical-session.target

[Service]
Type=oneshot
ExecStart=/bin/sh -c 'sleep 2; /usr/bin/loginctl lock-session'

[Install]
WantedBy=graphical-session.target