diff --git a/entrypoint.sh.tmpl b/entrypoint.sh.tmpl
index a7a6bdf..0b35ead 100644
--- a/entrypoint.sh.tmpl
+++ b/entrypoint.sh.tmpl
@@ -31,11 +31,11 @@ echo 'auth-openid-base-uri=https://{{ env "DOMAIN" }}' >> /etc/rstudio/rserver.c
 
 {{ if eq (env "KEYCLOAK_ENABLED") "1" }}
 apt install -y libpam-script
-echo 'auth required pam_exec.so debug expose_authtok log=/tmp/pam_exec.log /opt/pam-exec-oauth2/pam-exec-oauth2 --debug' >> /etc/pam.d/common-auth
-echo 'auth required pam_script.so' >> /etc/pam.d/common-auth
 mkdir -p /opt/pam-exec-oauth2/
 wget https://github.com/WASHNote/pam-exec-oauth2/releases/download/v0.0.1/pam-exec-oauth2 -O /opt/pam-exec-oauth2/pam-exec-oauth2
 chmod +x /opt/pam-exec-oauth2/pam-exec-oauth2
+echo 'auth requisite pam_exec.so log=/tmp/pam_exec.log expose_authtok /opt/pam-exec-oauth2/pam-exec-oauth2 --verbose' > /etc/pam.d/common-auth
+echo 'auth requisite pam_script.so' >> /etc/pam.d/common-auth
 {{ end }}
 
 exec "$@"