diff --git a/system/etc.nix b/system/etc.nix
index 420ff1ff5c3e..c4f69ffd76d8 100644
--- a/system/etc.nix
+++ b/system/etc.nix
@@ -132,7 +132,8 @@ import ../helpers/make-etc.nix {
       "shadow"
       "sshd"
       "useradd"
+      "chsh"
       "common"
     ]
   );
-}
\ No newline at end of file
+}
diff --git a/system/etc/pam.d/chsh b/system/etc/pam.d/chsh
new file mode 100644
index 000000000000..b4aac2aba958
--- /dev/null
+++ b/system/etc/pam.d/chsh
@@ -0,0 +1,5 @@
+auth     sufficient     pam_rootok.so
+auth     required       pam_permit.so
+account  required       pam_permit.so
+password required       pam_permit.so
+session  required       pam_permit.so