diff --git a/cloud-init/user-data-alpine.yml.tftpl b/cloud-init/user-data-alpine.yml.tftpl
index c805380..8d60b5d 100644
--- a/cloud-init/user-data-alpine.yml.tftpl
+++ b/cloud-init/user-data-alpine.yml.tftpl
@@ -58,6 +58,11 @@ runcmd:
   # Enable and start qemu-guest-agent via OpenRC
   - [ rc-update, add, qemu-guest-agent, default ]
   - [ rc-service, qemu-guest-agent, start ]
+  # Unlock the user account: cloud-init's lock_passwd: false is unreliable on
+  # Alpine (passwd -u refuses on passwordless accounts), so we force the shadow
+  # entry to "*" ourselves. "*" means: no password login possible, but pubkey
+  # auth works (unlike "!" which sshd treats as locked).
+  - [ sh, -c, "sed -i 's/^${username}:!:/${username}:*:/' /etc/shadow" ]
   # Enable and start Tailscale via OpenRC
   - [ rc-update, add, tailscale, default ]
   - [ rc-service, tailscale, start ]