diff --git a/lib/Service/IdentifyMethod/AbstractIdentifyMethod.php b/lib/Service/IdentifyMethod/AbstractIdentifyMethod.php
index 01e75dd001..07d9fee098 100644
--- a/lib/Service/IdentifyMethod/AbstractIdentifyMethod.php
+++ b/lib/Service/IdentifyMethod/AbstractIdentifyMethod.php
@@ -47,6 +47,7 @@ abstract class AbstractIdentifyMethod implements IIdentifyMethod {
 	 * @var string[]
 	 */
 	public array $availableSignatureMethods = [];
+	protected string $defaultSignatureMethod = '';
 	/**
 	 * @var AbstractSignatureMethod[]
 	 */
@@ -315,23 +316,17 @@ private function loadSavedSettings(): void {
 			}
 			return $carry;
 		}, []);
+		$enabled = false;
 		foreach ($this->availableSignatureMethods as $signatureMethodName) {
 			$this->signatureMethods[$signatureMethodName] =
 				$this->getEmptyInstanceOfSignatureMethodByName($signatureMethodName);
-		}
-		if (!isset($this->settings['signatureMethods']) || !is_array($this->settings['signatureMethods'])) {
-			return;
-		}
-		foreach ($this->settings['signatureMethods'] as $signatureMethodName => $settings) {
-			if (!in_array($signatureMethodName, $this->availableSignatureMethods)) {
-				unset($this->settings['signatureMethods'][$signatureMethodName]);
-				continue;
+			if (isset($this->settings[$signatureMethodName]['enabled']) && $this->settings[$signatureMethodName]['enabled']) {
+				$this->signatureMethods[$signatureMethodName]->enable();
+				$enabled = true;
 			}
-			$signatureMethod = $this->getEmptyInstanceOfSignatureMethodByName($signatureMethodName);
-			if (isset($settings['enabled']) && $settings['enabled']) {
-				$signatureMethod->enable();
-			}
-			$this->signatureMethods[$signatureMethodName] = $signatureMethod;
+		}
+		if (!$enabled && $this->defaultSignatureMethod) {
+			$this->signatureMethods[$this->defaultSignatureMethod]->enable();
 		}
 	}
 
diff --git a/lib/Service/IdentifyMethod/Account.php b/lib/Service/IdentifyMethod/Account.php
index d21ef1f3ea..505dc9e844 100644
--- a/lib/Service/IdentifyMethod/Account.php
+++ b/lib/Service/IdentifyMethod/Account.php
@@ -46,6 +46,7 @@ class Account extends AbstractIdentifyMethod {
 		ISignatureMethod::SIGNATURE_METHOD_EMAIL_TOKEN,
 		ISignatureMethod::SIGNATURE_METHOD_PASSWORD,
 	];
+	public string $defaultSignatureMethod = ISignatureMethod::SIGNATURE_METHOD_PASSWORD;
 	public function __construct(
 		protected IdentifyService $identifyService,
 		private IUserManager $userManager,
diff --git a/lib/Service/IdentifyMethod/Email.php b/lib/Service/IdentifyMethod/Email.php
index b73844589c..6985f7f700 100644
--- a/lib/Service/IdentifyMethod/Email.php
+++ b/lib/Service/IdentifyMethod/Email.php
@@ -40,6 +40,7 @@ class Email extends AbstractIdentifyMethod {
 		ISignatureMethod::SIGNATURE_METHOD_CLICK_TO_SIGN,
 		ISignatureMethod::SIGNATURE_METHOD_EMAIL_TOKEN,
 	];
+	public string $defaultSignatureMethod = ISignatureMethod::SIGNATURE_METHOD_EMAIL_TOKEN;
 	public function __construct(
 		protected IdentifyService $identifyService,
 		private IdentifyMethodMapper $identifyMethodMapper,
diff --git a/tests/integration/features/admin/initial_state.feature b/tests/integration/features/admin/initial_state.feature
index fc49785548..1d3d3365c6 100644
--- a/tests/integration/features/admin/initial_state.feature
+++ b/tests/integration/features/admin/initial_state.feature
@@ -6,8 +6,8 @@ Feature: admin/initial_state
     Then the response should contain the initial state "libresign-identify_methods" with the following values:
       """
       [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":false,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"}}}
+        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
+        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
       ]
       """
 
@@ -20,8 +20,8 @@ Feature: admin/initial_state
     And the response should contain the initial state "libresign-identify_methods" with the following values:
       """
       [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":false,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"}}}
+        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
+        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
       ]
       """
 
@@ -34,8 +34,8 @@ Feature: admin/initial_state
     And the response should contain the initial state "libresign-identify_methods" with the following values:
       """
       [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":false,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"}}}
+        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
+        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
       ]
       """
 
@@ -48,8 +48,8 @@ Feature: admin/initial_state
     And the response should contain the initial state "libresign-identify_methods" with the following values:
       """
       [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":false,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"}}}
+        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
+        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
       ]
       """
 
@@ -62,8 +62,8 @@ Feature: admin/initial_state
     And the response should contain the initial state "libresign-identify_methods" with the following values:
       """
       [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":false,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"}}}
+        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
+        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
       ]
       """
 
@@ -75,7 +75,7 @@ Feature: admin/initial_state
     And the response should contain the initial state "libresign-identify_methods" with the following values:
       """
       [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":false,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":false,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"}}}
+        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
+        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":false,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
       ]
       """
diff --git a/tests/integration/features/page/index.feature b/tests/integration/features/page/index.feature
index ce624488ab..6b16711e7e 100644
--- a/tests/integration/features/page/index.feature
+++ b/tests/integration/features/page/index.feature
@@ -10,7 +10,7 @@ Feature: page/sign_identify_default
     And the response should contain the initial state "libresign-identify_methods" with the following values:
       """
       [
-        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":false,"label":"Certificate with password","name":"password"}}},
-        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"}}}
+        {"name":"account","friendly_name":"Account","enabled":true,"mandatory":true,"signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":false,"label":"Email token","name":"emailToken"},"password":{"enabled":true,"label":"Certificate with password","name":"password"}}},
+        {"name":"email","friendly_name":"Email","enabled":false,"mandatory":true,"can_create_account":true,"test_url":"/index.php/settings/admin/mailtest","signatureMethods":{"clickToSign":{"enabled":false,"label":"Click to sign","name":"clickToSign"},"emailToken":{"enabled":true,"label":"Email token","name":"emailToken"}}}
       ]
       """