[Unit]
Description=Lock on suspend
Before=sleep.target

[Service]
ExecStart=/usr/bin/loginctl lock-sessions
ExecStartPost=/usr/bin/sleep 2

[Install]
WantedBy=sleep.target