diff --git a/models/settings.go b/models/settings.go
index 449ac91..6b9b384 100644
--- a/models/settings.go
+++ b/models/settings.go
@@ -37,4 +37,19 @@ type Settings struct {
 	Secrets    SecretsSettings `bson:"secrets" json:"secrets"`
 
 	WorkflowLogRetentionDays *int `bson:"workflow_log_retention_days,omitempty" json:"workflow_log_retention_days,omitempty"`
+
+	// LocalLoginEnabled is a pointer because it is absent on every settings
+	// document written before this feature existed, and a plain bool would read
+	// absent as disabled — turning off password login for the entire fleet at
+	// upgrade. Nil means enabled.
+	LocalLoginEnabled *bool `bson:"local_login_enabled,omitempty" json:"local_login_enabled,omitempty"`
+}
+
+// LocalLoginEnabled reads the setting with its absent-means-on default. Every
+// caller must go through this rather than dereferencing the field.
+func LocalLoginEnabled(s *Settings) bool {
+	if s == nil || s.LocalLoginEnabled == nil {
+		return true
+	}
+	return *s.LocalLoginEnabled
 }