diff --git a/cdist/conf/type/__user/explorer/shadow b/cdist/conf/type/__user/explorer/shadow
index 73ce0e29..d516ed10 100755
--- a/cdist/conf/type/__user/explorer/shadow
+++ b/cdist/conf/type/__user/explorer/shadow
@@ -23,18 +23,24 @@
 
 name=$__object_id
 
-case $("$__explorer/os") in
-  'freebsd'|'netbsd'|'openbsd')
+case $("${__explorer}/os") in
+  freebsd|netbsd)
     database='passwd'
     ;;
-  # Default to using shadow passwords
+  openbsd)
+    database='master.passwd'
+    ;;
   *)
+    # Default to using shadow passwords
     database='shadow'
     ;;
 esac
 
-if command -v getent >/dev/null; then
-  getent "$database" "$name" || true
-elif [ -f /etc/shadow ]; then
-  grep "^${name}:" /etc/shadow || true
+if command -v getent >/dev/null 2>&1
+then
+  getent "${database}" "${name}" 2>/dev/null && exit || true  # fallback to file
+fi
+if test -n "${database}" -a -f "/etc/${database}"
+then
+  grep -e "^${name}:" "/etc/${database}" && exit || true  # ignore failure
 fi