diff --git a/pam/gkr-pam-module.c b/pam/gkr-pam-module.c
index f50fab5..c387a3c 100644
--- a/pam/gkr-pam-module.c
+++ b/pam/gkr-pam-module.c
@@ -63,7 +63,8 @@
 
 enum {
 	ARG_AUTO_START          = 1 << 0,
-	ARG_IGNORE_SERVICE      = 1 << 1
+	ARG_IGNORE_SERVICE      = 1 << 1,
+	ARG_USE_AUTHTOK	        = 1 << 2
 };
 
 #define LOGIN_KEYRING		"login"
@@ -1037,8 +1038,14 @@ pam_chauthtok_update (pam_handle_t *ph, struct passwd *pwd, uint args)
 	if (ret != PAM_SUCCESS)
 		password = NULL;
 		
-	/* No password was entered, prompt for it */
 	if (password == NULL) {
+		/* No password was set, and we can't prompt for it */
+		if (args & ARG_USE_AUTHTOK) {
+			syslog (GKR_LOG_ERR, "gkr-pam: no password set, and use_authtok was specified");
+			return PAM_AUTHTOK_RECOVER_ERR;
+		}
+
+		/* No password was entered, prompt for it */
 		ret = prompt_password (ph);
 		if (ret != PAM_SUCCESS) {
 			syslog (GKR_LOG_ERR, "gkr-pam: couldn't get the password from user: %s", 
@@ -1059,8 +1066,10 @@ pam_chauthtok_update (pam_handle_t *ph, struct passwd *pwd, uint args)
 	 * the 'login' keyring match it is a priority. 
 	 */
 	ret = start_daemon_if_necessary (ph, pwd, original, &started_daemon);
-	if (ret != PAM_SUCCESS)
+	if (ret != PAM_SUCCESS) {
+		pam_set_item (ph, PAM_AUTHTOK, NULL);
 		return ret;
+	}
 	
 	ret = change_keyring_password (ph, pwd, password, original);
 
@@ -1069,8 +1078,10 @@ pam_chauthtok_update (pam_handle_t *ph, struct passwd *pwd, uint args)
 	if (started_daemon && !(args & ARG_AUTO_START))
 		stop_daemon (ph, pwd);
 
-	if (ret != PAM_SUCCESS)
+	if (ret != PAM_SUCCESS) {
+		pam_set_item (ph, PAM_AUTHTOK, NULL);
 		return ret;
+	}
 		
 	return PAM_SUCCESS;
 }
