diff --git a/NEWS b/NEWS
index 543baf5dbff..fcf97e5ea90 100644
--- a/NEWS
+++ b/NEWS
@@ -934,9 +934,7 @@ CHANGES WITH 258 in spe:
         * A new "org.freedesktop.machine1.register-machine" polkit action is
           used when checking for privileges to register a machine. Previously,
           "org.freedesktop.machine1.create-machine" was used for creation and
-          registration operations. The policy for the new action is more
-          permissive: active users are allowed to perform the action without
-          authentication.
+          registration operations.
 
         * systemd-machined now also tracks the "supervisor" process of a
           machine, i.e. the host process that manages the payload. This
diff --git a/src/machine/org.freedesktop.machine1.policy b/src/machine/org.freedesktop.machine1.policy
index d5b8d83d2aa..bba3da906ad 100644
--- a/src/machine/org.freedesktop.machine1.policy
+++ b/src/machine/org.freedesktop.machine1.policy
@@ -108,7 +108,7 @@
                 <defaults>
                         <allow_any>auth_admin</allow_any>
                         <allow_inactive>auth_admin</allow_inactive>
-                        <allow_active>yes</allow_active>
+                        <allow_active>auth_admin_keep</allow_active>
                 </defaults>
         </action>