diff --git a/mod/common/security.nix b/mod/common/security.nix
index 7b12773..7aab402 100644
--- a/mod/common/security.nix
+++ b/mod/common/security.nix
@@ -97,6 +97,11 @@ with lib;
         ];
       };
 
+      # Pam checks wether you have a blank password before prompting your
+      # credentials. This computes yescrypt hash of "" which causes annoying
+      # delay before prompting for the `doas` password.
+      pam.services.doas.allowNullPassword = lib.mkForce false;
+
       pki.certificateFiles = [ ../../pki/ca.cert ];
     };
   };