diff --git a/data_safe_haven/resources/workspace/ansible/desired_state.yaml b/data_safe_haven/resources/workspace/ansible/desired_state.yaml
index 3c7f569e92..7d2d6ffa1f 100644
--- a/data_safe_haven/resources/workspace/ansible/desired_state.yaml
+++ b/data_safe_haven/resources/workspace/ansible/desired_state.yaml
@@ -66,9 +66,12 @@
         name: common-session
         type: session
         control: optional
-        module_path: pam_mkhomedir.so
+        module_path: pam_systemd.so
+        new_type: session
+        new_control: optional
+        new_module_path: pam_mkhomedir.so
         module_arguments: 'skel=/etc/skel umask=0022'
-        state: args_present
+        state: after
       notify: Update PAM auth
 
     - name: Don't prompt to change expired passwords via ldap