diff --git a/UPGRADE.md b/UPGRADE.md
index eb948bd25..c4d506ae5 100644
--- a/UPGRADE.md
+++ b/UPGRADE.md
@@ -12,6 +12,17 @@ Passport 12.0 no longer automatically loads migrations from its own migrations d
 php artisan vendor:publish --tag=passport-migrations
 ```
 
+### Password Grant Type
+
+The password grant type is disabled by default. You may enable it by calling the `enablePasswordGrant` method in the `boot` method of your application's `App\Providers\AppServiceProvider` class:
+
+```php
+public function boot(): void
+{
+    Passport::enablePasswordGrant();
+}
+```
+
 ## Upgrading To 11.0 From 10.x
 
 ### Minimum PHP Version
diff --git a/src/Passport.php b/src/Passport.php
index d437cd051..dc2bb1f9a 100644
--- a/src/Passport.php
+++ b/src/Passport.php
@@ -26,7 +26,7 @@ class Passport
      *
      * @var bool|null
      */
-    public static $passwordGrantEnabled = true;
+    public static $passwordGrantEnabled = false;
 
     /**
      * The default scope.
@@ -196,6 +196,18 @@ public static function enableImplicitGrant()
         return new static;
     }
 
+    /**
+     * Enable the password grant type.
+     *
+     * @return static
+     */
+    public static function enablePasswordGrant()
+    {
+        static::$passwordGrantEnabled = true;
+
+        return new static;
+    }
+
     /**
      * Set the default scope(s). Multiple scopes may be an array or specified delimited by spaces.
      *
diff --git a/tests/Feature/AccessTokenControllerTest.php b/tests/Feature/AccessTokenControllerTest.php
index 92218333c..50ea27ffb 100644
--- a/tests/Feature/AccessTokenControllerTest.php
+++ b/tests/Feature/AccessTokenControllerTest.php
@@ -106,6 +106,8 @@ public function testGettingAccessTokenWithPasswordGrant()
     {
         $this->withoutExceptionHandling();
 
+        Passport::enablePasswordGrant();
+
         $password = 'foobar123';
         $user = UserFactory::new()->create([
             'email' => 'foo@gmail.com',
@@ -153,6 +155,8 @@ public function testGettingAccessTokenWithPasswordGrant()
 
     public function testGettingAccessTokenWithPasswordGrantWithInvalidPassword()
     {
+        Passport::enablePasswordGrant();
+
         $password = 'foobar123';
         $user = UserFactory::new()->create([
             'email' => 'foo@gmail.com',
@@ -196,6 +200,8 @@ public function testGettingAccessTokenWithPasswordGrantWithInvalidPassword()
 
     public function testGettingAccessTokenWithPasswordGrantWithInvalidClientSecret()
     {
+        Passport::enablePasswordGrant();
+
         $password = 'foobar123';
         $user = UserFactory::new()->create([
             'email' => 'foo@gmail.com',