diff --git a/archlinux/PKGBUILD.install b/archlinux/PKGBUILD.install
index c3e9cdf..404c2d6 100644
--- a/archlinux/PKGBUILD.install
+++ b/archlinux/PKGBUILD.install
@@ -35,7 +35,7 @@ pre_install() {
     # Add qubes core related fstab entries
     echo "xen	/proc/xen	xenfs	defaults	0 0" >> /etc/fstab
 
-    usermod -p '' root
+    usermod -L root
     usermod -L user
 }
 
diff --git a/debian/qubes-core-agent-passwordless-root.preinst b/debian/qubes-core-agent-passwordless-root.preinst
index b72057e..ba7a6e9 100755
--- a/debian/qubes-core-agent-passwordless-root.preinst
+++ b/debian/qubes-core-agent-passwordless-root.preinst
@@ -33,8 +33,8 @@ set -e
 # https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html or
 # the debian-policy package
 
-if [ "$1" = "install" ] ; then
-    usermod -p '' root
+if [ "$1" = "install" ] || [ "$1" = "upgrade" ]; then
+    usermod -L root
 fi
 
 # dh_installdeb will replace this with shell code automatically
diff --git a/rpm_spec/core-agent.spec.in b/rpm_spec/core-agent.spec.in
index 5b642c4..2fe4ad1 100644
--- a/rpm_spec/core-agent.spec.in
+++ b/rpm_spec/core-agent.spec.in
@@ -288,7 +288,7 @@ usermod -L user
 
 %pre passwordless-root
 
-usermod -p '' root
+usermod -L root
 
 %install