diff --git a/usr/libexec/security-misc/pam-info#security-misc-shared b/usr/libexec/security-misc/pam-info#security-misc-shared
index d55c6a93..6fd5d5f9 100755
--- a/usr/libexec/security-misc/pam-info#security-misc-shared
+++ b/usr/libexec/security-misc/pam-info#security-misc-shared
@@ -248,6 +248,9 @@ deny=3
 if test -f /etc/security/faillock.conf ; then
    deny_line=$(grep --invert-match "#" -- /etc/security/faillock.conf | grep -- "deny =") || true
    deny="$(printf '%s\n' "$deny_line" | str_replace "=" "" | str_replace "deny" "" | str_replace " " "")"
+   ## Restore the default if no uncommented 'deny =' line was found; an empty
+   ## value would slip past the numeric guard below and cause a false lockout.
+   [ -n "$deny" ] || deny=3
    ## Example:
    #deny=50
 fi