diff --git a/debian/changelog b/debian/changelog
index e7882c41..f34cc951 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -99,6 +99,8 @@ shadow (1:4.1.5-1) unstable; urgency=low
   * debian/control: depends on dpkg-dev (>= 1.16.1~) for including
     /usr/share/dpkg/buildflags.mk
   * debian/control: Standards-Version: bumped to 3.9.2. No changes.
+  * debian/login.defs: Set the default encryption method to SHA512.
+    Closes: #657717
 
   [ Christian Perrier ]
   * Use "linux-any" instead of a negated list of architectures in
diff --git a/debian/login.defs b/debian/login.defs
index 7b70c90e..968c6578 100644
--- a/debian/login.defs
+++ b/debian/login.defs
@@ -270,7 +270,7 @@ USERGROUPS_ENAB yes
 # Note: It is recommended to use a value consistent with
 # the PAM modules configuration.
 #
-#ENCRYPT_METHOD DES
+ENCRYPT_METHOD SHA512
 
 #
 # Only used if ENCRYPT_METHOD is set to SHA256 or SHA512.