diff --git a/debian/authforge.pam-config b/debian/authforge.pam-config
new file mode 100644
index 0000000..aece50b
--- /dev/null
+++ b/debian/authforge.pam-config
@@ -0,0 +1,13 @@
+Name: AuthForge first-login backstop
+Default: no
+Priority: 256
+Auth-Type: Primary
+Auth:
+        [success=ok default=die]               pam_authforge_pending.so
+Auth-Initial:
+        [success=ok default=die]               pam_authforge_pending.so
+Account-Type: Primary
+Account:
+        sufficient                              pam_unix.so
+Account-Initial:
+        sufficient                              pam_unix.so
diff --git a/debian/rules b/debian/rules
index ab24138..f56c536 100755
--- a/debian/rules
+++ b/debian/rules
@@ -30,6 +30,10 @@ override_dh_auto_install:
 	    debian/authforge-gui/etc/xdg/autostart/authforge-firstrun.desktop
 	# PAM
 	$(MAKE) -C pam install DESTDIR=$(CURDIR)/debian/authforge-pam
+	# Baseline pam-configs profile for pam-auth-update; daemon overwrites
+	# /usr/share/pam-configs/authforge at runtime when a real policy lands.
+	install -D -m 0644 debian/authforge.pam-config \
+	    debian/authforge-pam/usr/share/pam-configs/authforge
 	# D-Bus activation file
 	install -D -m 0644 debian/io.dangerousthings.AuthForge.service \
 	    debian/authforge-daemon/usr/share/dbus-1/system-services/io.dangerousthings.AuthForge.service