diff --git a/0006-totp-motd.patch b/0006-totp-motd.patch
new file mode 100644
index 0000000..0cf03ee
--- /dev/null
+++ b/0006-totp-motd.patch
@@ -0,0 +1,10 @@
+--- a/src/systemd/inactive.motd
++++ b/src/systemd/inactive.motd
+@@ -1,2 +1,7 @@
+ Activate the web console with: systemctl enable --now cockpit.socket
+ 
++Note: Cockpit disallows root login by default.
++To create a regular user and optionally enable 2FA run both:
++
++jeos-config user
++jeos-config otp
diff --git a/cockpit.changes b/cockpit.changes
index 920db96..8f1b897 100644
--- a/cockpit.changes
+++ b/cockpit.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Mon Sep 30 07:08:12 UTC 2024 - Alice Brooks <alice.brooks@suse.com>
+
+- add 0006-totp-motd.patch for guidance to enabling totp to the mtod
+
 -------------------------------------------------------------------
 Wed Sep 18 12:37:18 UTC 2024 - Jan Zerebecki <jan.suse@zerebecki.de>
 
diff --git a/cockpit.spec b/cockpit.spec
index ba164c2..aadc09e 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -68,6 +68,7 @@ Patch5:         storage-btrfs.patch
 # SLE Micro specific patches
 Patch101:       hide-pcp.patch
 Patch102:       0002-selinux-temporary-remove-setroubleshoot-section.patch
+Patch107:       0006-totp-motd.patch
 # For anything based on SLES 15 codebase (including Leap, SLE Micro)
 Patch103:       0004-leap-gnu18-removal.patch
 Patch104:       selinux_libdir.patch
@@ -229,6 +230,7 @@ BuildRequires:  python3-tox-current-env
 %patch -P 4 -p1
 %patch -P 5 -p1
 %patch -P 106 -p1
+%patch -P 107 -p1
 
 # SLE Micro specific patches
 %if 0%{?is_smo}
@@ -526,6 +528,7 @@ Requires: cockpit-bridge >= %{version}-%{release}
 Requires: shadow-utils
 %endif
 Requires: grep
+Requires: jeos-firstboot
 Requires: /usr/bin/pwscore
 Requires: /usr/bin/date
 Provides: cockpit-shell = %{version}-%{release}