diff --git a/meta-google/recipes-extended/pam/libpam_%.bbappend b/meta-google/recipes-extended/pam/libpam_%.bbappend
new file mode 100644
index 0000000..287dab7
--- /dev/null
+++ b/meta-google/recipes-extended/pam/libpam_%.bbappend
@@ -0,0 +1,15 @@
+# Remove cracklib from PAM, to avoid breaking PAM and further dependencies
+# This allows cracklib to be neatly severed from the system.
+
+EXTRA_OECONF:append:gbmc = " --disable-cracklib"
+
+DEPENDS:remove:gbmc = "cracklib"
+
+RDEPENDS:${PN}-runtime:remove:gbmc = "pam-plugin-cracklib-suffix"
+
+RDEPENDS:${PN}-xtests:remove:gbmc = "${MLPREFIX}pam-plugin-cracklib-${libpam_suffix}"
+
+do_install:append:gbmc() {
+    # Remove reference to cracklib library from PAM config file
+    sed -i '/pam_cracklib.so/d' ${D}${sysconfdir}/pam.d/common-password
+}