diff --git a/greetd/src/session/worker.rs b/greetd/src/session/worker.rs
index 5c16c31..e5fa436 100644
--- a/greetd/src/session/worker.rs
+++ b/greetd/src/session/worker.rs
@@ -90,6 +90,10 @@ fn worker(sock: &UnixDatagram) -> Result<(), Error> {
     }
     pam.acct_mgmt(PamFlag::NONE)?;
 
+    // Not the credentials you think.
+    pam.setcred(PamFlag::ESTABLISH_CRED)?;
+
+    // Mark authentication as a success.
     SessionChildToParent::Success.send(sock)?;
 
     // Fetch our arguments from the parent.
@@ -192,9 +196,6 @@ fn worker(sock: &UnixDatagram) -> Result<(), Error> {
     // Tell PAM what TTY we're targetting, which is used by logind.
     pam.set_item(PamItemType::TTY, &format!("/dev/tty{}", vt))?;
 
-    // Not the credentials you think.
-    pam.setcred(PamFlag::ESTABLISH_CRED)?;
-
     // Session time!
     pam.open_session(PamFlag::NONE)?;