diff --git a/scripts/install.sh b/scripts/install.sh
index 1936ce8..1f6d5e4 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -56,6 +56,17 @@ if [[ ! -f "${ENV_FILE}" ]]; then
   sudo chown root:"${SERVICE_GROUP}" "${ENV_FILE}"
 fi
 
+log "Ensuring minimal ENV defaults (PAM always on, allowed user)..."
+DEFAULT_USER="${SUDO_USER:-}"
+if [[ -n "${DEFAULT_USER}" ]]; then
+  if ! sudo grep -q "^SKD_AUTH_ALLOWED_USERS=" "${ENV_FILE}"; then
+    echo "SKD_AUTH_ALLOWED_USERS=${DEFAULT_USER}" | sudo tee -a "${ENV_FILE}" >/dev/null
+  fi
+fi
+if ! sudo grep -q "^SKD_AUTH_MODE=" "${ENV_FILE}"; then
+  echo "SKD_AUTH_MODE=pam" | sudo tee -a "${ENV_FILE}" >/dev/null
+fi
+
 log "Writing systemd unit to ${SYSTEMD_PATH}..."
 sudo tee "${SYSTEMD_PATH}" >/dev/null <<EOF
 [Unit]