diff --git a/_config/passwords.yml b/_config/passwords.yml
new file mode 100644
index 000000000..fc865200a
--- /dev/null
+++ b/_config/passwords.yml
@@ -0,0 +1,13 @@
+---
+Name: corepasswords
+---
+SilverStripe\Core\Injector\Injector:
+  SilverStripe\Security\PasswordValidator:
+    properties:
+      MinLength: 8
+      HistoricCount: 6
+
+# In the case someone uses `new PasswordValidator` instead of Injector, provide some safe defaults through config.
+SilverStripe\Security\PasswordValidator:
+  min_length: 8
+  historic_count: 6