diff --git a/bumper/__init__.py b/bumper/__init__.py
index 4835994..f791f29 100644
--- a/bumper/__init__.py
+++ b/bumper/__init__.py
@@ -321,6 +321,11 @@ def main(argv=None):
             first_run()
             return
 
+        if not (
+            os.path.exists(os.path.join(data_dir, "passwd"))
+        ):
+            with open(os.path.join(data_dir, "passwd"), 'w'): pass
+
         parser = argparse.ArgumentParser()
         parser.add_argument(
             "--listen", type=str, default=None, help="start serving on address"
diff --git a/bumper/mqttserver.py b/bumper/mqttserver.py
index c7ff20e..bae05fe 100644
--- a/bumper/mqttserver.py
+++ b/bumper/mqttserver.py
@@ -255,7 +255,7 @@ class MQTTServer:
                 "auth": {
                     "allow-anonymous": False,
                     "password-file": os.path.join(
-                        os.path.dirname(os.path.realpath(__file__)), "passwd"
+                        os.path.join(bumper.data_dir, "passwd")
                     ),
                     "plugins": ["bumper"],  # No plugins == no auth
                 },