diff --git a/nshlib/nsh_prompt.c b/nshlib/nsh_prompt.c
index 48566eea0..b8a671c54 100644
--- a/nshlib/nsh_prompt.c
+++ b/nshlib/nsh_prompt.c
@@ -218,8 +218,11 @@ void nsh_update_prompt(void)
  * Name: nsh_update_prompt_after_login
  *
  * Description:
- *   Enable privilege markers in the prompt and refresh it.  Boot and
- *   no-login sessions keep NSH_PROMPT_STRING (for example, "nsh> ").
+ *   Enable privilege markers in the prompt and refresh it.  Call this
+ *   after a successful console/telnet login or su.  nsh_consolemain
+ *   always passes NSH_LOGIN_LOCAL, so this must not run merely because
+ *   the session type is local.  Boot and no-login sessions keep
+ *   NSH_PROMPT_STRING (for example, "nsh> ").
  *
  ****************************************************************************/
 
diff --git a/nshlib/nsh_session.c b/nshlib/nsh_session.c
index cf71a7419..8d9d7a9f4 100644
--- a/nshlib/nsh_session.c
+++ b/nshlib/nsh_session.c
@@ -87,6 +87,15 @@ int nsh_session(FAR struct console_stdio_s *pstate,
           nsh_exit(vtbl, 1);
           return -1; /* nsh_exit does not return */
         }
+
+#ifdef CONFIG_SCHED_USER_IDENTITY
+      /* nsh_consolemain always passes NSH_LOGIN_LOCAL, even when console
+       * login is disabled.  Apply #/$ markers only after a real login
+       * so CI/NTFC still sees CONFIG_NSH_PROMPT_STRING at boot.
+       */
+
+      nsh_update_prompt_after_login();
+#endif
     }
   else
 #endif /* CONFIG_NSH_CONSOLE_LOGIN */
@@ -100,15 +109,12 @@ int nsh_session(FAR struct console_stdio_s *pstate,
           nsh_exit(vtbl, 1);
           return -1; /* nsh_exit does not return */
         }
-    }
-#endif /* CONFIG_NSH_TELNET_LOGIN */
 
 #ifdef CONFIG_SCHED_USER_IDENTITY
-  if (login != NSH_LOGIN_NONE)
-    {
       nsh_update_prompt_after_login();
-    }
 #endif
+    }
+#endif /* CONFIG_NSH_TELNET_LOGIN */
 
   if (login != NSH_LOGIN_NONE)
     {