diff --git a/api/utils/keys/hardwarekey/cliprompt.go b/api/utils/keys/hardwarekey/cliprompt.go
index 56526c7f2b247..69351826dbf41 100644
--- a/api/utils/keys/hardwarekey/cliprompt.go
+++ b/api/utils/keys/hardwarekey/cliprompt.go
@@ -93,6 +93,8 @@ func (c *cliPrompt) Touch(_ context.Context, keyInfo ContextualKeyInfo) error {
 // If an invalid PIN or PUK is provided, the user will be re-prompted until a
 // valid value is provided.
 func (c *cliPrompt) ChangePIN(ctx context.Context, _ ContextualKeyInfo) (*PINAndPUK, error) {
+	fmt.Fprintf(os.Stderr, "The default PIN %q is not supported.\n", DefaultPIN)
+
 	var pinAndPUK = &PINAndPUK{}
 	for {
 		fmt.Fprintf(c.writer, "Please set a new 6-8 character PIN.\n")
diff --git a/api/utils/keys/piv/yubikey.go b/api/utils/keys/piv/yubikey.go
index d00f27f569f16..194a9dbaa00f0 100644
--- a/api/utils/keys/piv/yubikey.go
+++ b/api/utils/keys/piv/yubikey.go
@@ -30,7 +30,6 @@ import (
 	"fmt"
 	"io"
 	"math/big"
-	"os"
 	"strings"
 	"sync"
 	"time"
@@ -474,10 +473,7 @@ func (y *YubiKey) checkOrSetPIN(ctx context.Context, prompt hardwarekey.Prompt,
 	}
 
 	switch pin {
-	case piv.DefaultPIN:
-		fmt.Fprintf(os.Stderr, "The default PIN %q is not supported.\n", piv.DefaultPIN)
-		fallthrough
-	case "":
+	case piv.DefaultPIN, "":
 		pin, err = y.setPINAndPUKFromDefault(ctx, prompt, keyInfo)
 		if err != nil {
 			return trace.Wrap(err)