diff --git a/gnu/services/base.scm b/gnu/services/base.scm
index 952f6f9ab2..30e50f4b9a 100644
--- a/gnu/services/base.scm
+++ b/gnu/services/base.scm
@@ -829,11 +829,18 @@ Return a service that sets up Unicode support in @var{tty} and loads
 (define (login-pam-service config)
   "Return the list of PAM service needed for CONF."
   ;; Let 'login' be known to PAM.
-  (list (unix-pam-service "login"
-                          #:allow-empty-passwords?
-                          (login-configuration-allow-empty-passwords? config)
-                          #:motd
-                          (login-configuration-motd config))))
+  (let ((base (unix-pam-service
+               "login"
+               #:allow-empty-passwords?
+               (login-configuration-allow-empty-passwords? config)
+               #:motd
+               (login-configuration-motd config))))
+    (list (pam-service
+           (inherit base)
+           (session (cons (pam-entry
+                           (control "required")
+                           (module "pam_loginuid.so"))
+                          (pam-service-session base)))))))
 
 (define login-service-type
   (service-type (name 'login)