diff --git a/cockpit-no-pamoath.pam b/cockpit-no-pamoath.pam
new file mode 100644
index 0000000..376d79f
--- /dev/null
+++ b/cockpit-no-pamoath.pam
@@ -0,0 +1,10 @@
+#%PAM-1.0
+auth substack common-auth
+# List of users to deny access to Cockpit, by default root is included.
+auth    required pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
+account required pam_nologin.so
+account include common-account
+password include common-password
+session required pam_loginuid.so
+session optional pam_keyinit.so force revoke
+session include common-session
diff --git a/cockpit.spec b/cockpit.spec
index 5f48b92..060b3f7 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -55,6 +55,7 @@ Source0:        cockpit-%{version}.tar.gz
 Source1:        cockpit.pam
 Source2:        cockpit-rpmlintrc
 Source3:        cockpit-suse-theme.tar
+Source4:        cockpit-no-pamoath.pam
 Source10:       update_version.sh
 Source99:       README.packaging
 Source98:       package-lock.json
@@ -238,6 +239,8 @@ BuildRequires:  python3-tox-current-env
 
 %if 0%{?suse_version} > 1500
 cp %SOURCE1 tools/cockpit.pam
+%else
+cp %SOURCE4 tools/cockpit.pam
 %endif
 #
 local-npm-registry %{_sourcedir} install --include=dev --ignore-scripts