diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix
index c2b8b6b3163..e06514bd934 100644
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@@ -629,7 +629,8 @@ in {
           content = "${base64}${sep}${base64}";
           mcf = "^${sep}${scheme}${sep}${content}$";
         in
-        if (user.hashedPassword != null
+        if (user.hashedPassword != null   # login disabled
+            && user.hashedPassword != ""  # login without password
             && builtins.match mcf user.hashedPassword == null)
         then
         ''