diff --git a/ipaserver/install/ipa_replica_prepare.py b/ipaserver/install/ipa_replica_prepare.py
index a6f0f1e39..9467276f2 100644
--- a/ipaserver/install/ipa_replica_prepare.py
+++ b/ipaserver/install/ipa_replica_prepare.py
@@ -307,7 +307,7 @@ class ReplicaPrepare(admintool.AdminTool):
             if options.http_pin is None:
                 options.http_pin = installutils.read_password(
                     "Enter Apache Server private key unlock",
-                    confirm=False, validate=False)
+                    confirm=False, validate=False, retry=False)
                 if options.http_pin is None:
                     raise admintool.ScriptError(
                         "Apache Server private key unlock password required")
@@ -321,7 +321,7 @@ class ReplicaPrepare(admintool.AdminTool):
             if options.dirsrv_pin is None:
                 options.dirsrv_pin = installutils.read_password(
                     "Enter Directory Server private key unlock",
-                    confirm=False, validate=False)
+                    confirm=False, validate=False, retry=False)
                 if options.dirsrv_pin is None:
                     raise admintool.ScriptError(
                         "Directory Server private key unlock password required")
@@ -335,7 +335,7 @@ class ReplicaPrepare(admintool.AdminTool):
             if options.pkinit_pin is None:
                 options.pkinit_pin = installutils.read_password(
                     "Enter Kerberos KDC private key unlock",
-                    confirm=False, validate=False)
+                    confirm=False, validate=False, retry=False)
                 if options.pkinit_pin is None:
                     raise admintool.ScriptError(
                         "Kerberos KDC private key unlock password required")
diff --git a/ipaserver/install/ipa_server_certinstall.py b/ipaserver/install/ipa_server_certinstall.py
index 5ab47303a..0a8fb214a 100644
--- a/ipaserver/install/ipa_server_certinstall.py
+++ b/ipaserver/install/ipa_server_certinstall.py
@@ -92,7 +92,8 @@ class ServerCertInstall(admintool.AdminTool):
 
         if self.options.pin is None:
             self.options.pin = installutils.read_password(
-                "Enter private key unlock", confirm=False, validate=False)
+                "Enter private key unlock",
+                confirm=False, validate=False, retry=False)
             if self.options.pin is None:
                 raise admintool.ScriptError(
                     "Private key unlock password required")
diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
index 48e0b9b7d..6644a6b31 100644
--- a/ipaserver/install/server/install.py
+++ b/ipaserver/install/server/install.py
@@ -489,7 +489,7 @@ def install_check(installer):
         if options.http_pin is None:
             options.http_pin = installutils.read_password(
                 "Enter Apache Server private key unlock",
-                confirm=False, validate=False)
+                confirm=False, validate=False, retry=False)
             if options.http_pin is None:
                 raise ScriptError(
                     "Apache Server private key unlock password required")
@@ -505,7 +505,7 @@ def install_check(installer):
         if options.dirsrv_pin is None:
             options.dirsrv_pin = read_password(
                 "Enter Directory Server private key unlock",
-                confirm=False, validate=False)
+                confirm=False, validate=False, retry=False)
             if options.dirsrv_pin is None:
                 raise ScriptError(
                     "Directory Server private key unlock password required")
@@ -521,7 +521,7 @@ def install_check(installer):
         if options.pkinit_pin is None:
             options.pkinit_pin = read_password(
                 "Enter Kerberos KDC private key unlock",
-                confirm=False, validate=False)
+                confirm=False, validate=False, retry=False)
             if options.pkinit_pin is None:
                 raise ScriptError(
                     "Kerberos KDC private key unlock password required")