diff --git a/modules/lamassu-lnbits.nix b/modules/lamassu-lnbits.nix
index 041c5c2..0c09e66 100644
--- a/modules/lamassu-lnbits.nix
+++ b/modules/lamassu-lnbits.nix
@@ -128,8 +128,8 @@ in
 
     skip2FA = mkOption {
       type = types.bool;
-      default = true;
-      description = "Skip 2FA authentication (useful for initial setup)";
+      default = false;
+      description = "Skip 2FA authentication (only enable for initial setup, then disable)";
     };
 
     database = {
@@ -252,7 +252,7 @@ in
         for i in {1..30}; do
           if ${pkgs.postgresql}/bin/psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='${cfg.database.user}'" | grep -q 1; then
             password=$(cat ${secretsDir}/lamassu-db-password)
-            ${pkgs.postgresql}/bin/psql -c "ALTER USER \"${cfg.database.user}\" WITH PASSWORD '$password';"
+            ${pkgs.postgresql}/bin/psql -v password="$password" -c "ALTER USER \"${cfg.database.user}\" WITH PASSWORD :'password';"
             exit 0
           fi
           sleep 1