diff --git a/login/login.c b/login/login.c
index cf850aa..bab9575 100644
--- a/login/login.c
+++ b/login/login.c
@@ -212,7 +212,7 @@ void login_syslog(glome_login_config_t* config, pam_handle_t* pamh,
   if (config->options & SYSLOG) {
     va_list args;
     va_start(args, format);
-    vsyslog(priority, format, args);
+    vsyslog(LOG_MAKEPRI(LOG_AUTH, priority), format, args);
     va_end(args);
   }
 }
@@ -498,9 +498,6 @@ int login_run(glome_login_config_t* config, const char** error_tag) {
         config->options, config->username, config->login_path,
         config->auth_delay_sec);
   }
-  if (config->options & SYSLOG) {
-    openlog("glome-login", LOG_PID | LOG_CONS, LOG_AUTH);
-  }
 
   int r = login_authenticate(config, NULL, error_tag);
   if (r != 0) {
diff --git a/login/main.c b/login/main.c
index be6455c..e958c17 100644
--- a/login/main.c
+++ b/login/main.c
@@ -13,6 +13,7 @@
 // limitations under the License.
 
 #include <stdlib.h>
+#include <syslog.h>
 #include <unistd.h>
 
 #include "config.h"
@@ -65,6 +66,11 @@ int main(int argc, char* argv[]) {
     return EXITCODE_PANIC;
   }
 
+  // Initialize syslog, if we're going to log.
+  if (config.options & SYSLOG) {
+    openlog(NULL, LOG_PID | LOG_CONS, LOG_AUTH);
+  }
+
   const char* error_tag = NULL;
   int rc = login_run(&config, &error_tag);
   if (rc) {