diff --git a/lib/pam_get_authtok.c b/lib/pam_get_authtok.c
index 18a311a..1317d55 100644
--- a/lib/pam_get_authtok.c
+++ b/lib/pam_get_authtok.c
@@ -51,6 +51,7 @@ pam_get_authtok(pam_handle_t *pamh,
 	char **authtok,
 	const char *prompt)
 {
+	char *p;
 	int r;
 
 	if (pamh == NULL || authtok == NULL)
@@ -59,11 +60,13 @@ pam_get_authtok(pam_handle_t *pamh,
 	r = pam_get_item(pamh, PAM_AUTHTOK, (void **)authtok);
 	if (r == PAM_SUCCESS)
 		return (PAM_SUCCESS);
-	if (prompt == NULL)
-		pam_get_item(pamh, PAM_AUTHTOK_PROMPT, (void **)&prompt);
-	if (prompt == NULL)
-		prompt = "Password:";
-	if ((r = pam_prompt(pamh, authtok, 0, "%s", prompt)) != PAM_SUCCESS)
+	if (prompt == NULL) {
+		if (pam_get_item(pamh, PAM_AUTHTOK_PROMPT, (void **)&p) !=
+		    PAM_SUCCESS || p == NULL)
+			prompt = "Password:";
+	}
+	r = pam_prompt(pamh, authtok, 0, "%s", prompt ? prompt : p);
+	if (r != PAM_SUCCESS)
 		return (r);
 	return (pam_set_item(pamh, PAM_AUTHTOK, *authtok));
 }
diff --git a/lib/pam_get_user.c b/lib/pam_get_user.c
index 37624af..2817072 100644
--- a/lib/pam_get_user.c
+++ b/lib/pam_get_user.c
@@ -52,18 +52,22 @@ pam_get_user(pam_handle_t *pamh,
 	char **user,
 	const char *prompt)
 {
+	char *p;
 	int r;
 
 	if (pamh == NULL || user == NULL)
 		return (PAM_SYSTEM_ERR);
 
-	if ((r = pam_get_item(pamh, PAM_USER, (void **)user)) == PAM_SUCCESS)
+	r = pam_get_item(pamh, PAM_USER, (void **)user);
+	if (r == PAM_SUCCESS)
 		return (PAM_SUCCESS);
-	if (prompt == NULL)
-		pam_get_item(pamh, PAM_USER_PROMPT, (void **)&prompt);
-	if (prompt == NULL)
-		prompt = "Login: ";
-	if ((r = pam_prompt(pamh, user, 0, "%s", prompt)) != PAM_SUCCESS)
+	if (prompt == NULL) {
+		if (pam_get_item(pamh, PAM_USER_PROMPT, (void **)&p) !=
+		    PAM_SUCCESS || p == NULL)
+			prompt = "Login: ";
+	}
+	r = pam_prompt(pamh, user, 0, "%s", prompt ? prompt : p);
+	if (r != PAM_SUCCESS)
 		return (r);
 	return (pam_set_item(pamh, PAM_USER, *user));
 }