You can alter your PAM configuration to require both: https://unix.stackexchange.com/a/572841
On my system, by default it lets you use either one to authenticate any time a password is needed, but this can be changed to require successful authentication using BOTH methods if desired.
I wasn't sure if you were wanting to require both, or just allow either one to be used, but both scenarios are trivial to configure.