diff --git a/README.md b/README.md
index 3cab6ec..2ef35e8 100644
--- a/README.md
+++ b/README.md
@@ -179,9 +179,9 @@ The following environment variables are supported:
 
    Username for the first user
 
- * `FIRST_USER_PASS` (Default: "raspberry")
+ * `FIRST_USER_PASS` (Default: unset)
 
-   Password for the first user
+   Password for the first user. If unset, the account is locked.
 
  * `WPA_ESSID`, `WPA_PASSWORD` and `WPA_COUNTRY` (Default: unset)
 
diff --git a/build.sh b/build.sh
index 4b75e79..014035c 100755
--- a/build.sh
+++ b/build.sh
@@ -224,7 +224,7 @@ export LOG_FILE="${WORK_DIR}/build.log"
 export TARGET_HOSTNAME=${TARGET_HOSTNAME:-raspberrypi}
 
 export FIRST_USER_NAME=${FIRST_USER_NAME:-pi}
-export FIRST_USER_PASS=${FIRST_USER_PASS:-raspberry}
+export FIRST_USER_PASS
 export RELEASE=${RELEASE:-bullseye}
 export WPA_ESSID
 export WPA_PASSWORD
diff --git a/stage1/01-sys-tweaks/00-run.sh b/stage1/01-sys-tweaks/00-run.sh
index 9c380ec..0f761bd 100755
--- a/stage1/01-sys-tweaks/00-run.sh
+++ b/stage1/01-sys-tweaks/00-run.sh
@@ -8,7 +8,10 @@ on_chroot << EOF
 if ! id -u ${FIRST_USER_NAME} >/dev/null 2>&1; then
 	adduser --disabled-password --gecos "" ${FIRST_USER_NAME}
 fi
-echo "${FIRST_USER_NAME}:${FIRST_USER_PASS}" | chpasswd
+
+if [ -n "${FIRST_USER_PASS}" ]; then
+	echo "${FIRST_USER_NAME}:${FIRST_USER_PASS}" | chpasswd
+fi
 echo "root:root" | chpasswd
 EOF