diff --git a/apps/settings/serializers/auth/ukey.py b/apps/settings/serializers/auth/ukey.py
index 1c6689965..c8b821fce 100644
--- a/apps/settings/serializers/auth/ukey.py
+++ b/apps/settings/serializers/auth/ukey.py
@@ -18,6 +18,7 @@ class UKeySettingSerializer(serializers.Serializer):
         help_text=_('Time-to-live (seconds) for authentication challenge codes')
     )
     AUTH_UKEY_DEFAULT_PIN = EncryptedField(
+        min_length=4, max_length=32,
         default='', allow_blank=True, label=_('UKey Default User PIN'),
         help_text=_('UKey default user PIN used for administrator reset')
     )