diff --git a/etc/security/access-security-misc.conf b/etc/security/access-security-misc.conf
index a081d33..a03a99f 100644
--- a/etc/security/access-security-misc.conf
+++ b/etc/security/access-security-misc.conf
@@ -18,7 +18,8 @@
 ## Allow members of group 'console' to use tty1 to tty7 and pts/0 to pts/9 and hvc0 to hvc9.
 ## Qubes has 'pts/0' when for example running "sudo" from a terminal emulator.
 ## Qubes uses 'hvc0' when using in dom0 "sudo xl console vm-name".
-+:console:tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9
+## When using systemd-nspawn (chroot) then `login` requires console 'console' to be permitted.
++:console:console tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9
 
 ## Everyone else except members of group 'console-unrestricted'
 ## are restricted from everything else.