diff --git a/systemd-user b/systemd-user
index 2e1fb802..6a91d1e5 100644
--- a/systemd-user
+++ b/systemd-user
@@ -21,4 +21,5 @@ account  include  common-account
 session  required pam_selinux.so close
 session  required pam_selinux.so nottys open
 session  required pam_loginuid.so
+session  optional pam_keyinit.so force revoke
 session  include  common-session
diff --git a/systemd.changes b/systemd.changes
index 6c641cd6..27b768ca 100644
--- a/systemd.changes
+++ b/systemd.changes
@@ -1,3 +1,12 @@
+-------------------------------------------------------------------
+Fri Mar 31 12:55:21 UTC 2023 - Franck Bui <fbui@suse.com>
+
+- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
+
+  That way "systemd --user" instances get their own session keyring instead of
+  the user default session keyring. For some reasons cifscreds refuses to work
+  with the latter. That's what is expected for every PAM session anyway.
+
 -------------------------------------------------------------------
 Tue Mar 28 16:01:58 UTC 2023 - Franck Bui <fbui@suse.com>