diff --git a/res/lang/ar.ini b/res/lang/ar.ini
index fd51b51..009be7c 100644
--- a/res/lang/ar.ini
+++ b/res/lang/ar.ini
@@ -33,7 +33,6 @@ err_pam_abort = تم إلغاء معاملة PAM
 err_pam_acct_expired = الحساب منتهي الصلاحية
 err_pam_auth = خطأ في المصادقة (Authentication error)
 err_pam_authinfo_unavail = فشل في الحصول على معلومات المستخدم
-err_pam_authok_reqd = انتهت صلاحية رمز المصادقة (Token)
 err_pam_buf = خطأ في ذاكرة التخزين المؤقت (Buffer)
 err_pam_cred_err = فشل في تعيين بيانات الاعتماد (Credentials)
 err_pam_cred_expired = بيانات الاعتماد منتهية الصلاحية
@@ -77,6 +76,7 @@ shell = shell
 shutdown = ايقاف التشغيل
 sleep = وضع السكون
 toggle_password = إظهار/إخفاء كلمة المرور
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/bg.ini b/res/lang/bg.ini
index 1ac9246..66cba42 100644
--- a/res/lang/bg.ini
+++ b/res/lang/bg.ini
@@ -33,7 +33,6 @@ err_pam_abort = прекратена транзакция
 err_pam_acct_expired = изтекъл профил
 err_pam_auth = грешка при удостоверяването
 err_pam_authinfo_unavail = неуспешно получаване на информация за потребителя
-err_pam_authok_reqd = изтекъл жетон
 err_pam_buf = грешка в буфера на паметта
 err_pam_cred_err = неуспешно задаване на удостоверения
 err_pam_cred_expired = изтекли удостоверения
@@ -77,6 +76,7 @@ shell = обвивка
 shutdown = изключване
 sleep = заспиване
 toggle_password = превключване на паролата
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/cat.ini b/res/lang/cat.ini
index 3bf271b..f8684fb 100644
--- a/res/lang/cat.ini
+++ b/res/lang/cat.ini
@@ -33,7 +33,6 @@ err_pam_abort = transacció pam avortada
 err_pam_acct_expired = compte expirat
 err_pam_auth = error d'autenticació
 err_pam_authinfo_unavail = error en obtenir la informació de l'usuari
-err_pam_authok_reqd = token expirat
 err_pam_buf = error en la memòria intermèdia
 err_pam_cred_err = error en establir les credencials
 err_pam_cred_expired = credencials expirades
@@ -77,6 +76,7 @@ shell = shell
 shutdown = aturar
 sleep = suspendre
 toggle_password = mostrar/amagar contrasenya
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/cs.ini b/res/lang/cs.ini
index 4f9456c..3e5683e 100644
--- a/res/lang/cs.ini
+++ b/res/lang/cs.ini
@@ -33,7 +33,6 @@ err_pam_abort = pam transakce přerušena
 err_pam_acct_expired = platnost účtu vypršela
 err_pam_auth = chyba autentizace
 err_pam_authinfo_unavail = nelze získat informace o uživateli
-err_pam_authok_reqd = platnost tokenu vypršela
 err_pam_buf = chyba vyrovnávací paměti
 err_pam_cred_err = nelze nastavit pověření
 err_pam_cred_expired = platnost pověření vypršela
@@ -77,6 +76,7 @@ shell = příkazový řádek
 shutdown = vypnout
 sleep = uspat
 toggle_password = zobrazit/skrýt heslo
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/de.ini b/res/lang/de.ini
index ca3a0ef..18e8a29 100644
--- a/res/lang/de.ini
+++ b/res/lang/de.ini
@@ -33,7 +33,6 @@ err_pam_abort = PAM-Transaktion abgebrochen
 err_pam_acct_expired = Benutzerkonto abgelaufen
 err_pam_auth = Authentifizierungsfehler
 err_pam_authinfo_unavail = Abrufen der Benutzerinformationen fehlgeschlagen
-err_pam_authok_reqd = Passwort abgelaufen
 err_pam_buf = Speicherpufferfehler
 err_pam_cred_err = Fehler beim Setzen der Anmeldedaten
 err_pam_cred_expired = Anmeldedaten abgelaufen
@@ -77,6 +76,7 @@ shell = Shell
 shutdown = Herunterfahren
 sleep = Sleep
 toggle_password = Passwort anzeigen/verbergen
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/en.ini b/res/lang/en.ini
index b3d40f2..7ad3039 100644
--- a/res/lang/en.ini
+++ b/res/lang/en.ini
@@ -33,7 +33,6 @@ err_pam_abort = pam transaction aborted
 err_pam_acct_expired = account expired
 err_pam_auth = authentication error
 err_pam_authinfo_unavail = failed to get user info
-err_pam_authok_reqd = token expired
 err_pam_buf = memory buffer error
 err_pam_cred_err = failed to set credentials
 err_pam_cred_expired = credentials expired
@@ -77,6 +76,7 @@ shell = shell
 shutdown = shutdown
 sleep = sleep
 toggle_password = toggle password
+token_expired = password expired, please reset
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/eo.ini b/res/lang/eo.ini
index c8cbb96..4e18590 100644
--- a/res/lang/eo.ini
+++ b/res/lang/eo.ini
@@ -33,7 +33,6 @@ err_pam_abort = PAM-a transakcio malsukcesis
 err_pam_acct_expired = konto eksvalidiĝis
 err_pam_auth = aŭtentiga eraro
 err_pam_authinfo_unavail = malsukcesis preni uzantajn informojn
-err_pam_authok_reqd = memorsigno eksvalidiĝis
 err_pam_buf = bufra eraro
 err_pam_cred_err = malsukcesis agordi akreditaĵon
 err_pam_cred_expired = akreditaĵo eksvalidiĝis
@@ -77,6 +76,7 @@ shell = ŝelo
 shutdown = malŝalti
 sleep = memordormi
 toggle_password = montri/kaŝi pasvorton
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/es.ini b/res/lang/es.ini
index f587fe7..7565ec4 100644
--- a/res/lang/es.ini
+++ b/res/lang/es.ini
@@ -33,7 +33,6 @@ err_pam_abort = transacción pam abortada
 err_pam_acct_expired = cuenta expirada
 err_pam_auth = error de autenticación
 err_pam_authinfo_unavail = error al obtener información del usuario
-err_pam_authok_reqd = token expirado
 err_pam_buf = error de la memoria intermedia
 err_pam_cred_err = error al establecer las credenciales
 err_pam_cred_expired = credenciales expiradas
@@ -77,6 +76,7 @@ shell = shell
 shutdown = apagar
 sleep = suspender
 toggle_password = mostrar/ocultar contraseña
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/fr.ini b/res/lang/fr.ini
index 472115e..167645c 100644
--- a/res/lang/fr.ini
+++ b/res/lang/fr.ini
@@ -33,7 +33,6 @@ err_pam_abort = transaction pam avortée
 err_pam_acct_expired = compte expiré
 err_pam_auth = erreur d'authentification
 err_pam_authinfo_unavail = échec de l'obtention des infos utilisateur
-err_pam_authok_reqd = tiquet expiré
 err_pam_buf = erreur de mémoire tampon
 err_pam_cred_err = échec de la modification des identifiants
 err_pam_cred_expired = identifiants expirés
@@ -77,6 +76,7 @@ shell = shell
 shutdown = éteindre
 sleep = veille
 toggle_password = afficher le mot de passe
+token_expired = mot de passe expiré, veuillez le changer
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/it.ini b/res/lang/it.ini
index 9c9679d..28889ce 100644
--- a/res/lang/it.ini
+++ b/res/lang/it.ini
@@ -33,7 +33,6 @@ err_pam_abort = transazione PAM interrotta
 err_pam_acct_expired = account scaduto
 err_pam_auth = errore di autenticazione
 err_pam_authinfo_unavail = impossibile ottenere informazioni utente
-err_pam_authok_reqd = token scaduto
 err_pam_buf = errore buffer memoria
 err_pam_cred_err = impossibile impostare credenziali
 err_pam_cred_expired = credenziali scadute
@@ -77,6 +76,7 @@ shell = shell
 shutdown = arresto
 sleep = sospendi
 toggle_password = mostra/nascondi password
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/ja_JP.ini b/res/lang/ja_JP.ini
index a14feab..6551af7 100644
--- a/res/lang/ja_JP.ini
+++ b/res/lang/ja_JP.ini
@@ -33,7 +33,6 @@ err_pam_abort = PAMトランザクションが中断されました
 err_pam_acct_expired = アカウントの有効期限が切れています
 err_pam_auth = 認証エラー
 err_pam_authinfo_unavail = ユーザー情報の取得に失敗しました
-err_pam_authok_reqd = トークンの有効期限が切れています
 err_pam_buf = メモリバッファエラー
 err_pam_cred_err = 認証情報の設定に失敗しました
 err_pam_cred_expired = 認証情報の有効期限が切れています
@@ -77,6 +76,7 @@ shell = シェル
 shutdown = シャットダウン
 sleep = スリープ
 toggle_password = パスワードの表示/非表示
+
 wayland = Wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/ku.ini b/res/lang/ku.ini
index 0c39030..7fbf777 100644
--- a/res/lang/ku.ini
+++ b/res/lang/ku.ini
@@ -33,7 +33,6 @@ err_pam_abort = danûstendina pam hate têkbirin
 err_pam_acct_expired = dema jimarê derbas bûye
 err_pam_auth = şaşetiya piştrastkirinê
 err_pam_authinfo_unavail = zanyariyên bikarhêner nehatin girtin
-err_pam_authok_reqd = dema nîşandanê derbas bûye
 err_pam_buf = şaşetiya bîra demkî
 err_pam_cred_err = sazkirina rastkitinê têk çû
 err_pam_cred_expired = dema rastkitinê derbas bûye
@@ -77,6 +76,7 @@ shell = shell
 shutdown = vemirîne
 sleep = têxîne xewê
 toggle_password = şîfre nîşan bide/veşêre
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/lv.ini b/res/lang/lv.ini
index 8f54d89..6dc14d1 100644
--- a/res/lang/lv.ini
+++ b/res/lang/lv.ini
@@ -33,7 +33,6 @@ err_pam_abort = pam transakcija pārtraukta
 err_pam_acct_expired = konts novecojis
 err_pam_auth = autentifikācijas kļūda
 err_pam_authinfo_unavail = neizdevās iegūt lietotāja informāciju
-err_pam_authok_reqd = žetons beidzies
 err_pam_buf = atmiņas bufera kļūda
 err_pam_cred_err = neizdevās iestatīt akreditācijas datus
 err_pam_cred_expired = akreditācijas dati novecojuši
@@ -77,6 +76,7 @@ shell = terminālis
 shutdown = izslēgt
 sleep = snauda
 toggle_password = rādīt/slēpt paroli
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/pl.ini b/res/lang/pl.ini
index 536680d..0910ee7 100644
--- a/res/lang/pl.ini
+++ b/res/lang/pl.ini
@@ -33,7 +33,6 @@ err_pam_abort = transakcja pam przerwana
 err_pam_acct_expired = konto wygasło
 err_pam_auth = błąd uwierzytelniania
 err_pam_authinfo_unavail = nie udało się zdobyć informacji o użytkowniku
-err_pam_authok_reqd = token wygasł
 err_pam_buf = błąd bufora pamięci
 err_pam_cred_err = nie udało się ustawić uwierzytelnienia
 err_pam_cred_expired = uwierzytelnienie wygasło
@@ -77,6 +76,7 @@ shell = powłoka
 shutdown = wyłącz
 sleep = uśpij
 toggle_password = Pokaż/ukryj hasło
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/pt.ini b/res/lang/pt.ini
index 204a9f1..2b0ace4 100644
--- a/res/lang/pt.ini
+++ b/res/lang/pt.ini
@@ -33,7 +33,6 @@ err_pam_abort = transação pam abortada
 err_pam_acct_expired = conta expirada
 err_pam_auth = erro de autenticação
 err_pam_authinfo_unavail = erro ao obter informação do utilizador
-err_pam_authok_reqd = token expirado
 err_pam_buf = erro de buffer de memória
 err_pam_cred_err = erro ao definir credenciais
 err_pam_cred_expired = credenciais expiradas
@@ -77,6 +76,7 @@ shell = shell
 shutdown = encerrar
 sleep = suspender
 toggle_password = mostrar/ocultar palavra-passe
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/pt_BR.ini b/res/lang/pt_BR.ini
index af8c970..f79bb71 100644
--- a/res/lang/pt_BR.ini
+++ b/res/lang/pt_BR.ini
@@ -33,7 +33,6 @@ err_pam_abort = transação pam abortada
 err_pam_acct_expired = conta expirada
 err_pam_auth = erro de autenticação
 err_pam_authinfo_unavail = não foi possível obter informações do usuário
-err_pam_authok_reqd = token expirado
 err_pam_buf = erro de buffer de memória
 err_pam_cred_err = erro para definir credenciais
 err_pam_cred_expired = credenciais expiradas
@@ -77,6 +76,7 @@ shell = shell
 shutdown = desligar
 sleep = suspender
 toggle_password = mostrar/ocultar senha
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/ro.ini b/res/lang/ro.ini
index 3b771a8..318889f 100644
--- a/res/lang/ro.ini
+++ b/res/lang/ro.ini
@@ -33,7 +33,6 @@ err_pam_abort = tranzacţie pam anulată
 err_pam_acct_expired = cont expirat
 err_pam_auth = eroare de autentificare
 err_pam_authinfo_unavail = nu s-au putut obţine informaţii despre utilizator
-err_pam_authok_reqd = token expirat
 err_pam_buf = eroare de memorie (buffer)
 err_pam_cred_err = nu s-au putut seta date de identificare (credentials)
 err_pam_cred_expired = datele de identificare (credentials) au expirat
@@ -77,6 +76,7 @@ shell = shell
 shutdown = opreşte sistemul
 sleep = repaus
 toggle_password = afișare/ascundere parolă
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/ru.ini b/res/lang/ru.ini
index 014c170..359dd95 100644
--- a/res/lang/ru.ini
+++ b/res/lang/ru.ini
@@ -33,7 +33,6 @@ err_pam_abort = pam транзакция прервана
 err_pam_acct_expired = срок действия аккаунта истёк
 err_pam_auth = ошибка аутентификации
 err_pam_authinfo_unavail = не удалось получить информацию о пользователе
-err_pam_authok_reqd = токен истёк
 err_pam_buf = ошибка буфера памяти
 err_pam_cred_err = не удалось установить полномочия
 err_pam_cred_expired = полномочия истекли
@@ -77,6 +76,7 @@ shell = оболочка
 shutdown = выключить
 sleep = сон
 toggle_password = показать/скрыть пароль
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/sr.ini b/res/lang/sr.ini
index a2678bf..e82c4fa 100644
--- a/res/lang/sr.ini
+++ b/res/lang/sr.ini
@@ -33,7 +33,6 @@ err_pam_abort = pam transakcija prekinuta
 err_pam_acct_expired = nalog istekao
 err_pam_auth = greška pri autentikaciji
 err_pam_authinfo_unavail = neuspješno uzimanje informacija o korisniku
-err_pam_authok_reqd = token istekao
 err_pam_buf = greška bafera memorije
 err_pam_cred_err = neuspješno postavljanje kredencijala
 err_pam_cred_expired = kredencijali istekli
@@ -77,6 +76,7 @@ shell = shell
 shutdown = ugasi
 sleep = uspavaj
 toggle_password = prikaži/sakrij lozinku
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/sr_Cyrl.ini b/res/lang/sr_Cyrl.ini
index 6222b3d..2e869bb 100644
--- a/res/lang/sr_Cyrl.ini
+++ b/res/lang/sr_Cyrl.ini
@@ -33,7 +33,6 @@ err_pam_abort = pam трансакција прекинута
 err_pam_acct_expired = налог истекао
 err_pam_auth = грешка при аутентикацији
 err_pam_authinfo_unavail = неуспешно узимање информација о кориснику
-err_pam_authok_reqd = токен истекао
 err_pam_buf = грешка бафера меморије
 err_pam_cred_err = неуспешно постављање акредитива
 err_pam_cred_expired = акредитиви истекли
@@ -77,6 +76,7 @@ shell = shell
 shutdown = угаси
 sleep = успавај
 toggle_password = прикажи/сакриј лозинку
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/sv.ini b/res/lang/sv.ini
index 45e36d4..24fb6c9 100644
--- a/res/lang/sv.ini
+++ b/res/lang/sv.ini
@@ -33,7 +33,6 @@ err_pam_abort = pam-transaktion avbröts
 err_pam_acct_expired = kontot har löpt ut
 err_pam_auth = autentisering misslyckades
 err_pam_authinfo_unavail = hämtning av användarinformation misslyckades
-err_pam_authok_reqd = token har löpt ut
 err_pam_buf = minnesbufferfel
 err_pam_cred_err = inställning av inloggningsuppgifter misslyckades
 err_pam_cred_expired = inloggningsuppgifterna har löpt ut
@@ -77,6 +76,7 @@ shell = shell
 shutdown = stäng av
 sleep = viloläge
 toggle_password = visa/dölj lösenord
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/tr.ini b/res/lang/tr.ini
index 414f4d5..a0d344f 100644
--- a/res/lang/tr.ini
+++ b/res/lang/tr.ini
@@ -33,7 +33,6 @@ err_pam_abort = pam islemi durduruldu
 err_pam_acct_expired = hesabin suresi dolmus
 err_pam_auth = kimlik dogrulama hatasi
 err_pam_authinfo_unavail = kullanici bilgileri getirilirken hata olustu
-err_pam_authok_reqd = suresi dolmus token
 err_pam_buf = bellek arabellegi hatasi
 err_pam_cred_err = kimlik bilgileri ayarlanamadi
 err_pam_cred_expired = kimlik bilgilerinin suresi dolmus
@@ -77,6 +76,7 @@ shell = shell
 shutdown = makineyi kapat
 sleep = uykuya al
 toggle_password = parolayı göster/gizle
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/uk.ini b/res/lang/uk.ini
index 6baa469..b096b9a 100644
--- a/res/lang/uk.ini
+++ b/res/lang/uk.ini
@@ -33,7 +33,6 @@ err_pam_abort = pam транзакція перервана
 err_pam_acct_expired = термін дії акаунту вичерпано
 err_pam_auth = помилка автентифікації
 err_pam_authinfo_unavail = не вдалося отримати дані користувача
-err_pam_authok_reqd = термін дії токена вичерпано
 err_pam_buf = помилка буферу пам'яті
 err_pam_cred_err = не вдалося змінити облікові дані
 err_pam_cred_expired = термін дії повноважень вичерпано
@@ -77,6 +76,7 @@ shell = оболонка
 shutdown = вимкнути
 sleep = сплячий режим
 toggle_password = показати/приховати пароль
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/zh_CN.ini b/res/lang/zh_CN.ini
index 4562624..183ec89 100644
--- a/res/lang/zh_CN.ini
+++ b/res/lang/zh_CN.ini
@@ -33,7 +33,6 @@ err_pam_abort = PAM事务已中止
 err_pam_acct_expired = 帐户已过期
 err_pam_auth = 身份验证错误
 err_pam_authinfo_unavail = 获取用户信息失败
-err_pam_authok_reqd = 口令已过期
 err_pam_buf = 内存缓冲区错误
 err_pam_cred_err = 设置凭据失败
 err_pam_cred_expired = 凭据已过期
@@ -77,6 +76,7 @@ shell = shell
 shutdown = 关机
 sleep = 睡眠
 toggle_password = 显示/隐藏密码
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/res/lang/zh_TW.ini b/res/lang/zh_TW.ini
index 50d5f68..606b2a1 100644
--- a/res/lang/zh_TW.ini
+++ b/res/lang/zh_TW.ini
@@ -33,7 +33,6 @@ err_pam_abort = PAM 交易已中止
 err_pam_acct_expired = 帳號已過期
 err_pam_auth = 驗證錯誤
 err_pam_authinfo_unavail = 取得使用者資訊失敗
-err_pam_authok_reqd = 金鑰已過期
 err_pam_buf = 記憶體緩衝區錯誤
 err_pam_cred_err = 設定憑證失敗
 err_pam_cred_expired = 憑證已過期
@@ -77,6 +76,7 @@ shell = shell
 shutdown = 關機
 sleep = 睡眠
 toggle_password = 顯示/隱藏密碼
+
 wayland = wayland
 x11 = x11
 xinitrc = xinitrc
diff --git a/src/auth.zig b/src/auth.zig
index ef6af30..91f1cbc 100644
--- a/src/auth.zig
+++ b/src/auth.zig
@@ -29,7 +29,7 @@ pub const AuthOptions = struct {
 const PamAppdata = struct {
     username: []const u8,
     password: []const u8,
-    authreq_requested: bool,
+    new_authtok_requested: bool,
     authreq_responded: bool,
     new_password: []const u8,
 };
@@ -52,6 +52,7 @@ pub fn authenticate(
     current_environment: Environment,
     login: []const u8,
     password: []const u8,
+    maybe_new_password: ?[]const u8,
 ) !void {
     var tty_buffer: [3]u8 = undefined;
     const tty_str = try std.fmt.bufPrint(&tty_buffer, "{d}", .{options.tty});
@@ -69,7 +70,7 @@ pub fn authenticate(
     var credentials: PamAppdata = .{
         .username = login,
         .password = password,
-        .authreq_requested = false,
+        .new_authtok_requested = false,
         .authreq_responded = false,
         .new_password = "",
     };
@@ -98,9 +99,11 @@ pub fn authenticate(
     try log_file.info(io, "auth/pam", "validating account", .{});
     status = interop.pam.pam_acct_mgmt(handle, 0);
     if (status == interop.pam.PAM_NEW_AUTHTOK_REQD) {
-        // credentials.authreq_requested = true;
-        // credentials.new_password = "";
-        // status = interop.pam.pam_chauthtok(handle, interop.pam.PAM_CHANGE_EXPIRED_AUTHTOK);
+        if (maybe_new_password) |new_passwsord| {
+            credentials.new_authtok_requested = true;
+            credentials.new_password = new_passwsord;
+            status = interop.pam.pam_chauthtok(handle, interop.pam.PAM_CHANGE_EXPIRED_AUTHTOK);
+        }
     }
     if (status != interop.pam.PAM_SUCCESS) return pamDiagnose(status);
 
@@ -334,7 +337,7 @@ fn loginConv(
             },
             interop.pam.PAM_PROMPT_ECHO_OFF => {
                 var pass = data.password;
-                if (data.authreq_requested) {
+                if (data.new_authtok_requested) {
                     if (data.authreq_responded) {
                         pass = data.new_password;
                     }
diff --git a/src/config/Lang.zig b/src/config/Lang.zig
index c01cff0..d2a97e2 100644
--- a/src/config/Lang.zig
+++ b/src/config/Lang.zig
@@ -1,5 +1,5 @@
 //
-// NOTE: After editing this file, please run `/res/lang/normalize_lang_files.py`
+// NOTE: After editing this file, please run `res/lang/normalize_lang_files.py`
 //       to update all the language files accordingly.
 //
 
@@ -38,7 +38,6 @@ err_pam_abort: []const u8 = "pam transaction aborted",
 err_pam_acct_expired: []const u8 = "account expired",
 err_pam_auth: []const u8 = "authentication error",
 err_pam_authinfo_unavail: []const u8 = "failed to get user info",
-err_pam_authok_reqd: []const u8 = "token expired",
 err_pam_buf: []const u8 = "memory buffer error",
 err_pam_cred_err: []const u8 = "failed to set credentials",
 err_pam_cred_expired: []const u8 = "credentials expired",
@@ -82,6 +81,7 @@ shell: [:0]const u8 = "shell",
 shutdown: []const u8 = "shutdown",
 sleep: []const u8 = "sleep",
 toggle_password: []const u8 = "toggle password",
+token_expired: []const u8 = "password expired, please reset",
 wayland: []const u8 = "wayland",
 x11: []const u8 = "x11",
 xinitrc: [:0]const u8 = "xinitrc",
diff --git a/src/main.zig b/src/main.zig
index 1090d52..3ceebd2 100644
--- a/src/main.zig
+++ b/src/main.zig
@@ -113,6 +113,7 @@ const UiState = struct {
     login_text: ?*Text,
     password: *Text,
     password_widget: *Widget,
+    maybe_old_password: ?[]const u8,
     insert_mode: bool,
     edge_margin: Position,
     config: Config,
@@ -889,6 +890,9 @@ pub fn main(init: std.process.Init) !void {
     );
     defer state.password_label.deinit();
 
+    state.maybe_old_password = null;
+    defer if (state.maybe_old_password) |pass| state.allocator.free(pass);
+
     state.insert_mode = !state.config.vi_mode or state.config.vi_default_mode == .insert;
 
     state.password = try Text.init(
@@ -1633,7 +1637,8 @@ fn authenticate(ptr: *anyopaque) !bool {
                 auth_options,
                 current_environment,
                 if (state.login_text) |box| box.text.items else state.login.?.getCurrentUsername(),
-                password_text,
+                if (state.maybe_old_password) |pass| pass else password_text,
+                if (state.maybe_old_password != null) password_text else null,
             ) catch |err| {
                 shared_err.writeError(err);
 
@@ -1645,12 +1650,19 @@ fn authenticate(ptr: *anyopaque) !bool {
             std.process.exit(0);
         }
 
-        var session_status: c_int = undefined;
-        _ = std.posix.system.waitpid(session_pid, &session_status, 0);
-        // HACK: It seems like the session process is not exiting immediately after the waitpid call.
-        // This is a workaround to ensure the session process has exited before re-initializing the TTY.
-        state.io.sleep(.fromSeconds(1), .real) catch {};
-        session_pid = -1;
+        if (state.maybe_old_password) |pass| {
+            state.allocator.free(pass);
+            state.maybe_old_password = null;
+        }
+
+        if (session_pid != -1) {
+            var session_status: c_int = undefined;
+            _ = std.posix.system.waitpid(session_pid, &session_status, 0);
+            // HACK: It seems like the session process is not exiting immediately after the waitpid call.
+            // This is a workaround to ensure the session process has exited before re-initializing the TTY.
+            state.io.sleep(.fromSeconds(1), .real) catch {};
+            session_pid = -1;
+        }
 
         try state.log_file.reinit(state.io);
     }
@@ -1658,7 +1670,20 @@ fn authenticate(ptr: *anyopaque) !bool {
     try state.buffer.reclaim();
 
     const auth_err = shared_err.readError();
-    if (auth_err) |err| {
+    if (auth_err) |err| handle_error: {
+        if (err == error.PamNewAuthTokenRequired) {
+            try state.info_line.addMessage(
+                state.lang.token_expired,
+                state.config.bg,
+                state.config.fg,
+            );
+
+            state.maybe_old_password = try state.allocator.dupe(u8, state.password.text.items);
+            state.password.clear();
+            state.is_autologin = false;
+            break :handle_error;
+        }
+
         state.auth_fails += 1;
         state.buffer.setActiveWidget(state.password_widget);
 
@@ -2611,7 +2636,6 @@ fn getAuthErrorMsg(err: anyerror, lang: Lang) []const u8 {
         error.PamCredentialsInsufficient => lang.err_pam_cred_insufficient,
         error.PamCredentialsUnavailable => lang.err_pam_cred_unavail,
         error.PamMaximumTries => lang.err_pam_maxtries,
-        error.PamNewAuthTokenRequired => lang.err_pam_authok_reqd,
         error.PamPermissionDenied => lang.err_pam_perm_denied,
         error.PamSessionError => lang.err_pam_session,
         error.PamSystemError => lang.err_pam_sys,