diff --git a/src/etc/inc/system.inc b/src/etc/inc/system.inc
index 815603a82..a9225cc15 100644
--- a/src/etc/inc/system.inc
+++ b/src/etc/inc/system.inc
@@ -1138,7 +1138,7 @@ function system_login_configure($verbose = false)
     $etc_ttys_lines = explode("\n", file_get_contents('/etc/ttys'));
     $fd = fopen('/etc/ttys', 'w');
     $on_off_secure_u = $serial_enabled ? 'onifconsole secure' : 'off secure';
-    $on_off_secure_v = $virtual_enabled ? 'on  secure' : 'off secure';
+    $on_off_secure_v = $virtual_enabled ? 'onifexists secure' : 'off secure';
     /* XXX serial type uses 3wire nowadays */
     if (isset($config['system']['disableconsolemenu'])) {
         $console_type = 'Pc';
diff --git a/src/etc/rc.subr.d/recover b/src/etc/rc.subr.d/recover
index ad5f6a0d5..a057d5a09 100755
--- a/src/etc/rc.subr.d/recover
+++ b/src/etc/rc.subr.d/recover
@@ -160,15 +160,15 @@ $etc_ttys = <<<EOF
 # when going to single-user mode.
 console	none				unknown	off secure
 #
-ttyv0	"/usr/libexec/getty Pc"		xterm	on  secure
+ttyv0	"/usr/libexec/getty Pc"		xterm	onifexists secure
 # Virtual terminals
-ttyv1	"/usr/libexec/getty Pc"		xterm	on  secure
-ttyv2	"/usr/libexec/getty Pc"		xterm	on  secure
-ttyv3	"/usr/libexec/getty Pc"		xterm	on  secure
-ttyv4	"/usr/libexec/getty Pc"		xterm	on  secure
-ttyv5	"/usr/libexec/getty Pc"		xterm	on  secure
-ttyv6	"/usr/libexec/getty Pc"		xterm	on  secure
-ttyv7	"/usr/libexec/getty Pc"		xterm	on  secure
+ttyv1	"/usr/libexec/getty Pc"		xterm	onifexists secure
+ttyv2	"/usr/libexec/getty Pc"		xterm	onifexists secure
+ttyv3	"/usr/libexec/getty Pc"		xterm	onifexists secure
+ttyv4	"/usr/libexec/getty Pc"		xterm	onifexists secure
+ttyv5	"/usr/libexec/getty Pc"		xterm	onifexists secure
+ttyv6	"/usr/libexec/getty Pc"		xterm	onifexists secure
+ttyv7	"/usr/libexec/getty Pc"		xterm	onifexists secure
 ttyv8	"/usr/local/bin/xdm -nodaemon"	xterm	off secure
 # Serial terminals
 # The 'dialup' keyword identifies dialin lines to login, fingerd etc.