diff --git a/qemu/README.md b/qemu/README.md
index a6f38e8..ea253c4 100644
--- a/qemu/README.md
+++ b/qemu/README.md
@@ -77,6 +77,11 @@ The VT cursor is kept off (`vt.global_cursor_default=0`): fbcon shares the
 virtio-gpu framebuffer with warden-ui and its blinking cursor would otherwise
 show up in screendumps at random (issue #18).
 
+The guest carries the panel's own `/etc/passwd`, `/etc/shadow` and
+`/etc/group` (root's md5-crypt of the documented default password), so a
+screen that verifies the root password against `/etc/shadow` behaves as it
+does on a panel instead of rejecting every attempt.
+
 ## Scenarios
 
 All take the virt-fragment `<zImage>`; `FLARE_EDGE=<checkout>` where noted.
diff --git a/qemu/rootfs/etc/group b/qemu/rootfs/etc/group
new file mode 100644
index 0000000..fd17e8f
--- /dev/null
+++ b/qemu/rootfs/etc/group
@@ -0,0 +1,8 @@
+root:x:0:
+daemon:x:1:
+bin:x:2:
+sys:x:3:
+mail:x:8:
+www-data:x:33:
+operator:x:37:
+nogroup:x:65534:
diff --git a/qemu/rootfs/etc/passwd b/qemu/rootfs/etc/passwd
new file mode 100644
index 0000000..d8281d2
--- /dev/null
+++ b/qemu/rootfs/etc/passwd
@@ -0,0 +1,9 @@
+root:x:0:0:root:/root:/bin/sh
+daemon:x:1:1:daemon:/usr/sbin:/bin/false
+bin:x:2:2:bin:/bin:/bin/false
+sys:x:3:3:sys:/dev:/bin/false
+sync:x:4:100:sync:/bin:/bin/sync
+mail:x:8:8:mail:/var/spool/mail:/bin/false
+www-data:x:33:33:www-data:/var/www:/bin/false
+operator:x:37:37:Operator:/var:/bin/false
+nobody:x:65534:65534:nobody:/home:/bin/false
diff --git a/qemu/rootfs/etc/shadow b/qemu/rootfs/etc/shadow
new file mode 100644
index 0000000..bee05e8
--- /dev/null
+++ b/qemu/rootfs/etc/shadow
@@ -0,0 +1,9 @@
+root:$1$wardenrs$F.aYwbBz69WjSvwa3RNRF1:19664::::::
+daemon:*:::::::
+bin:*:::::::
+sys:*:::::::
+sync:*:::::::
+mail:*:::::::
+www-data:*:::::::
+operator:*:::::::
+nobody:*:::::::