diff --git a/tools/arch/cockpit.pam b/tools/arch/cockpit.pam
index eaeef60ca669..b3b506af7ead 100644
--- a/tools/arch/cockpit.pam
+++ b/tools/arch/cockpit.pam
@@ -1,7 +1,7 @@
 #%PAM-1.0
 auth      include   system-remote-login
 # List of users to deny access to Cockpit, by default root is included.
-auth       required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
+account   required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
 account   include   system-remote-login
 password  include   system-remote-login
 session   include   system-remote-login
diff --git a/tools/cockpit.debian.pam b/tools/cockpit.debian.pam
index 8e33d4d8f457..249e591e22fb 100644
--- a/tools/cockpit.debian.pam
+++ b/tools/cockpit.debian.pam
@@ -3,7 +3,7 @@ auth       required     pam_sepermit.so
 auth       substack     common-auth
 auth       optional     pam_ssh_add.so
 # List of users to deny access to Cockpit, by default root is included.
-auth       required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
+account    required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
 account    required     pam_nologin.so
 account    include      common-account
 password   include      common-password
diff --git a/tools/cockpit.pam b/tools/cockpit.pam
index 1cf2c9f0a59b..20e1d5290b2c 100644
--- a/tools/cockpit.pam
+++ b/tools/cockpit.pam
@@ -4,7 +4,7 @@ auth       substack     password-auth
 auth       include      postlogin
 auth       optional     pam_ssh_add.so
 # List of users to deny access to Cockpit, by default root is included.
-auth       required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
+account    required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
 account    required     pam_nologin.so
 account    include      password-auth
 password   include      password-auth