diff --git a/cockpit.changes b/cockpit.changes
index 8b2bc43..52637fe 100644
--- a/cockpit.changes
+++ b/cockpit.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Wed Aug  7 09:36:58 UTC 2024 - Jan Zerebecki <jan.suse@zerebecki.de>
+
+- load pam_oath for optional TOTP for authentication
+
 -------------------------------------------------------------------
 Wed Jul 31 08:23:43 UTC 2024 - Adam Majer <adam.majer@suse.de>
 
diff --git a/cockpit.pam b/cockpit.pam
index 376d79f..8eeed98 100644
--- a/cockpit.pam
+++ b/cockpit.pam
@@ -8,3 +8,4 @@ password include common-password
 session required pam_loginuid.so
 session optional pam_keyinit.so force revoke
 session include common-session
+auth [user_unknown=ignore success=ok] pam_oath.so usersfile=${HOME}/.pam_oath_usersfile window=20 digits=6
diff --git a/cockpit.spec b/cockpit.spec
index 3830600..7e88c31 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -558,6 +558,7 @@ Suggests: sssd-dbus >= 2.6.2
 %if 0%{?suse_version}
 Requires(pre): permissions
 Requires: distribution-logos
+Requires: pam_oath
 Requires: wallpaper-branding
 %endif
 # for cockpit-desktop