diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index ad8e7353b..dbbe6ecdd 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.132 2026/10/11 20:41:20 dtucker Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.133 2026/10/30 09:04:01 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -499,6 +499,18 @@ match_principals_command(struct passwd *user_pw, const struct sshkey *key,
 		free(av[i]);
 		av[i] = tmp;
 	}
+
+	/*
+	 * If AuthorizedPrincipalsCommand was specified without arguments
+	 * then pass the target username as a single argument, as is done
+	 * for AuthorizedKeysCommand.
+	 */
+	if (ac == 1) {
+		av = xreallocarray(av, ac + 2, sizeof(*av));
+		av[ac++] = xstrdup(user_pw->pw_name);
+		av[ac] = NULL;
+	}
+
 	/* Prepare a printable command for logs, etc. */
 	command = argv_assemble(ac, av);