diff --git a/mo/users.py b/mo/users.py
index 251fb3c4c920adfcffed8a6a44ccac7219f69455..6bbe2d245752129e42b76ad6be6c77ae4328dfe3 100644
--- a/mo/users.py
+++ b/mo/users.py
@@ -184,7 +184,7 @@ def validate_password(passwd: str) -> bool:
 
 
 def set_password(user: db.User, passwd: str, reset: bool = False):
-    salt = bcrypt.gensalt()
+    salt = bcrypt.gensalt(rounds=9)
     hashed = bcrypt.hashpw(passwd.encode('utf-8'), salt)
     user.password_hash = hashed.decode('us-ascii')
     if reset: