diff --git a/zkey/zkey-cryptsetup.1 b/zkey/zkey-cryptsetup.1
index 988ef76c..fd1741aa 100644
--- a/zkey/zkey-cryptsetup.1
+++ b/zkey/zkey-cryptsetup.1
@@ -180,6 +180,20 @@ and
 to control which part of the key file is used as passphrase. These options
 behave in the same way as with \fBcryptsetup\fP.
 .PP
+The
+.B reencipher
+command creates a new key slot with the re-enciphered secure AES volume key.
+The new key slot uses
+.B PBKDF2
+as password based key derivation function. LUKS2 volumes typically default to
+.B Argon2i
+as password based key derivation function,
+but this might cause out-of-memory errors when multiple encrypted volumes are
+unlocked automatically at boot through /etc/crypttab. Because PAES
+uses secure AES keys as volume keys, the security of the key derivation
+function used to encrypt the volume key in the LUKS key slots is of less
+relevance. 
+.PP
 .B Note:
 The \fBreencipher\fP command requires the CCA host library (libcsulcca.so)
 to be installed. For the supported environments and downloads, see:
@@ -288,6 +302,20 @@ and
 .B \-\-keyfile\-size
 to control which part of the key file is used as passphrase. These options
 behave in the same way the same as with \fBcryptsetup\fP.
+.PP
+The
+.B setkey
+command creates a new key slot with the re-enciphered secure AES volume key.
+The new key slot uses
+.B PBKDF2
+as password based key derivation function. LUKS2 volumes typically default to
+.B Argon2i
+as password based key derivation function,
+but this might cause out-of-memory errors when multiple encrypted volumes are
+unlocked automatically at boot through /etc/crypttab. Because PAES
+uses secure AES keys as volume keys, the security of the key derivation
+function used to encrypt the volume key in the LUKS key slots is of less
+relevance. 
 .
 .
 .
diff --git a/zkey/zkey-cryptsetup.c b/zkey/zkey-cryptsetup.c
index f7098f81..c269b8b7 100644
--- a/zkey/zkey-cryptsetup.c
+++ b/zkey/zkey-cryptsetup.c
@@ -1096,7 +1096,11 @@ static int put_vp_token(struct crypt_device *cd, int token,
  */
 static int open_device(const char *device, struct crypt_device **cd)
 {
-	const struct crypt_pbkdf_type *pbkdf;
+	const struct crypt_pbkdf_type pbkdf2 = {
+		.type = CRYPT_KDF_PBKDF2,
+		.hash = "sha256",
+		.time_ms = 2000,
+	};
 	struct crypt_device *cdev = NULL;
 	int rc;
 
@@ -1128,10 +1132,14 @@ static int open_device(const char *device, struct crypt_device **cd)
 		goto out;
 	}
 
-	pbkdf = crypt_get_pbkdf_type(cdev);
-	rc = crypt_set_pbkdf_type(cdev, pbkdf);
+	/*
+	 * Set PBKDF2 as default key derivation function. LUKS2 uses
+	 * Argon2i as default, but this might cause out-of-memory errors when
+	 * multiple LUKS2 volumes are opened automatically via /etc/crypttab
+	 */
+	rc = crypt_set_pbkdf_type(cdev, &pbkdf2);
 	if (rc != 0) {
-		warnx("Failed to set the PBKDF-type for device '%s': %s",
+		warnx("Failed to set the PBKDF for device '%s': %s",
 		      device, strerror(-rc));
 		goto out;
 	}