diff --git a/src/login/systemd-user.in b/src/login/systemd-user.in
index 70ca709f51..6a4bc058e6 100644
--- a/src/login/systemd-user.in
+++ b/src/login/systemd-user.in
@@ -8,7 +8,12 @@
 {% endif %}
 account  required   pam_unix.so no_pass_expiry
 
-auth     required   pam_deny.so
+# systemd never invokes pam_authenticate() on this stack, but it does invoke pam_setcred(), which runs the
+# "auth" stack too. Hence an "auth" entry is needed that lets pam_setcred() succeed, without falling back to
+# the "other" service (which typically consists of pam_warn/pam_deny, and thus generates log noise).
+# pam_rootok's pam_sm_setcred() unconditionally succeeds, while its pam_sm_authenticate() only succeeds for
+# callers running as root (which the service manager does).
+auth     required   pam_rootok.so
 
 {% if HAVE_SELINUX %}
 session  required   pam_selinux.so close
diff --git a/src/run/systemd-run0.in b/src/run/systemd-run0.in
index 6ad114f0de..db9f2b4587 100644
--- a/src/run/systemd-run0.in
+++ b/src/run/systemd-run0.in
@@ -8,7 +8,12 @@
 {% endif %}
 account  required   pam_unix.so
 
-auth     required   pam_deny.so
+# systemd never invokes pam_authenticate() on this stack (authorization for run0 is done via polkit), but it
+# does invoke pam_setcred(), which runs the "auth" stack too. Hence an "auth" entry is needed that lets
+# pam_setcred() succeed, without falling back to the "other" service (which typically consists of
+# pam_warn/pam_deny, and thus generates log noise). pam_rootok's pam_sm_setcred() unconditionally succeeds,
+# while its pam_sm_authenticate() only succeeds for callers running as root (which the service manager does).
+auth     required   pam_rootok.so
 
 {% if HAVE_SELINUX %}
 session  required   pam_selinux.so close