diff --git a/etc/default.nix b/etc/default.nix
index 6b8bc81503d..448fa993d73 100644
--- a/etc/default.nix
+++ b/etc/default.nix
@@ -226,7 +226,6 @@ import ../helpers/make-etc.nix {
       "shadow"
       "sshd"
       "lshd"
-      "lsh-pam-checkpw"
       "useradd"
       "chsh"
       "xlock"
diff --git a/etc/pam.d/lsh-pam-checkpw b/etc/pam.d/lsh-pam-checkpw
deleted file mode 100644
index 50f3cc5ce60..00000000000
--- a/etc/pam.d/lsh-pam-checkpw
+++ /dev/null
@@ -1,4 +0,0 @@
-auth     include        common
-account  include        common
-password include        common
-session  include        common
diff --git a/upstart-jobs/lshd.nix b/upstart-jobs/lshd.nix
index e2a61eed387..0a13d9ba7ee 100644
--- a/upstart-jobs/lshd.nix
+++ b/upstart-jobs/lshd.nix
@@ -31,6 +31,7 @@ start script
 end script
 
 respawn ${lsh}/sbin/lshd --daemonic \
+   --password-helper="${lsh}/sbin/lsh-pam-checkpw" \
    -p ${toString portNumber} \
    ${if interfaces == [] then ""
      else (concatStrings (map (i: "--interface=\"${i}\"")