diff --git a/patches/openwrt/hack/0002-base-files-disable-root-account.patch b/patches/openwrt/hack/0002-base-files-disable-root-account.patch
new file mode 100644
index 0000000000000000000000000000000000000000..fab526c1daaaed3057702114971709b6e92eac10
--- /dev/null
+++ b/patches/openwrt/hack/0002-base-files-disable-root-account.patch
@@ -0,0 +1,26 @@
+From be77444967f3e4445c8653ec3788207133a45c5c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= <karel.koci@nic.cz>
+Date: Mon, 12 Oct 2020 16:04:59 +0200
+Subject: [PATCH] base-files: disable root account
+
+In default on Turris OS configuration should be done through Foris to set
+all passwords (that includes Foris as well as system one if user
+chooses). This means that root login has to be disabled. This changes
+default to be so.
+---
+ package/base-files/files/etc/shadow | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/package/base-files/files/etc/shadow b/package/base-files/files/etc/shadow
+index 4b4154f..ac3b8a2 100644
+--- a/package/base-files/files/etc/shadow
++++ b/package/base-files/files/etc/shadow
+@@ -1,4 +1,4 @@
+-root::0:0:99999:7:::
++root:!:0:0:99999:7:::
+ daemon:*:0:0:99999:7:::
+ ftp:*:0:0:99999:7:::
+ network:*:0:0:99999:7:::
+-- 
+2.28.0
+
diff --git a/patches/openwrt/hack/0002-busybox-Provide-static-busybox-build.patch b/patches/openwrt/hack/0003-busybox-Provide-static-busybox-build.patch
similarity index 100%
rename from patches/openwrt/hack/0002-busybox-Provide-static-busybox-build.patch
rename to patches/openwrt/hack/0003-busybox-Provide-static-busybox-build.patch