diff --git a/unix_integration/pam_kanidm/Cargo.toml b/unix_integration/pam_kanidm/Cargo.toml
index 984a6b703..56f6ae3c9 100644
--- a/unix_integration/pam_kanidm/Cargo.toml
+++ b/unix_integration/pam_kanidm/Cargo.toml
@@ -35,6 +35,7 @@ maintainer = "James Hodgkinson <james@terminaloutcomes.com>"
 depends = ["libc6", "libpam0g"]
 section = "network"
 priority = "optional"
+maintainer-scripts = "debian/"
 assets = [
 	# Empty on purpose
 ]
diff --git a/unix_integration/pam_kanidm/debian/kanidm.pam b/unix_integration/pam_kanidm/debian/kanidm.pam
index 17da012b3..f2e5f4dc1 100644
--- a/unix_integration/pam_kanidm/debian/kanidm.pam
+++ b/unix_integration/pam_kanidm/debian/kanidm.pam
@@ -4,7 +4,7 @@ Priority: 128
 
 Auth-Type: Primary
 Auth:
-  [success=end new_authtok_reqd=done default=ignore]    pam_kanidm.so ignore_unknown_user
+  [success=end new_authtok_reqd=done default=ignore]    pam_kanidm.so ignore_unknown_user use_first_pass
 
 Account-Type: Primary
 Account:
diff --git a/unix_integration/pam_kanidm/debian/postinst b/unix_integration/pam_kanidm/debian/postinst
new file mode 100644
index 000000000..ecd061d5a
--- /dev/null
+++ b/unix_integration/pam_kanidm/debian/postinst
@@ -0,0 +1,29 @@
+#!/bin/sh
+# postinst script for libpam-kanidm
+#
+# see: dh_installdeb(1)
+
+set -e
+
+
+case "$1" in
+    configure)
+        echo "Updating PAM configuration"
+        pam-auth-update --package
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/unix_integration/resolver/debian/postinst b/unix_integration/resolver/debian/postinst
index cc7c10be6..d5d5b9562 100644
--- a/unix_integration/resolver/debian/postinst
+++ b/unix_integration/resolver/debian/postinst
@@ -8,13 +8,12 @@ set -e
 
 case "$1" in
     configure)
-        pam-auth-update --package
         echo "============================="
         echo "Thanks for installing Kanidm!"
         echo "============================="
         echo "Please ensure you modify the configuration files at /etc/kanidm/unixd and /etc/kanidm/config"
         echo "Full examples are in /usr/share/kanidm-unixd/"
-        echo "To configure nsswitch, please follow instructions in https://kanidm.github.io/kanidm/master/integrations/pam_and_nsswitch.html"
+        echo "PAM has already been autoconfigured by the libpam-kanidm package. To configure nsswitch, please follow instructions in https://kanidm.github.io/kanidm/master/integrations/pam_and_nsswitch.html"
     ;;
 
     abort-upgrade|abort-remove|abort-deconfigure)