diff --git a/doc/sudo.cat b/doc/sudo.cat
index 747f72b71..a689a951c 100644
--- a/doc/sudo.cat
+++ b/doc/sudo.cat
@@ -261,9 +261,11 @@ DDEESSCCRRIIPPTTIIOONN
                  %%  two consecutive `%' characters are collapsed into a
                      single `%' character
 
-                 The custom prompt will override the system password prompt on
-                 systems that support PAM unless the _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e flag
-                 is disabled in _s_u_d_o_e_r_s.
+                 The custom prompt will override the default prompt specified
+                 by either the security policy or the SUDO_PROMPT environment
+                 variable.  On systems that use PAM, the custom prompt will
+                 also override the prompt specified by a PAM module unless the
+                 _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e flag is disabled in _s_u_d_o_e_r_s.
 
      --rr _r_o_l_e, ----rroollee=_r_o_l_e
                  Run the command with an SELinux security context that
@@ -629,4 +631,4 @@ DDIISSCCLLAAIIMMEERR
      file distributed with ssuuddoo or https://www.sudo.ws/license.html for
      complete details.
 
-Sudo 1.8.21                      July 20, 2017                     Sudo 1.8.21
+Sudo 1.8.21                      July 21, 2017                     Sudo 1.8.21
diff --git a/doc/sudo.man.in b/doc/sudo.man.in
index d43654bfc..699aa3508 100644
--- a/doc/sudo.man.in
+++ b/doc/sudo.man.in
@@ -21,7 +21,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.TH "SUDO" "8" "July 20, 2017" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
+.TH "SUDO" "8" "July 21, 2017" "Sudo @PACKAGE_VERSION@" "System Manager's Manual"
 .nh
 .if n .ad l
 .SH "NAME"
@@ -518,8 +518,12 @@ characters are collapsed into a single
 \(oq%\(cq
 character
 .PP
-The custom prompt will override the system password prompt on systems that
-support PAM unless the
+The custom prompt will override the default prompt specified by either
+the security policy or the
+\fRSUDO_PROMPT\fR
+environment variable.
+On systems that use PAM, the custom prompt will also override the prompt
+specified by a PAM module unless the
 \fIpassprompt_override\fR
 flag is disabled in
 \fIsudoers\fR.
diff --git a/doc/sudo.mdoc.in b/doc/sudo.mdoc.in
index 4f3ff9da9..e995264d6 100644
--- a/doc/sudo.mdoc.in
+++ b/doc/sudo.mdoc.in
@@ -19,7 +19,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.Dd July 20, 2017
+.Dd July 21, 2017
 .Dt SUDO @mansectsu@
 .Os Sudo @PACKAGE_VERSION@
 .Sh NAME
@@ -467,8 +467,12 @@ characters are collapsed into a single
 character
 .El
 .Pp
-The custom prompt will override the system password prompt on systems that
-support PAM unless the
+The custom prompt will override the default prompt specified by either
+the security policy or the
+.Ev SUDO_PROMPT
+environment variable.
+On systems that use PAM, the custom prompt will also override the prompt
+specified by a PAM module unless the
 .Em passprompt_override
 flag is disabled in
 .Em sudoers .
diff --git a/doc/sudoers.cat b/doc/sudoers.cat
index bd9750ec1..237c71979 100644
--- a/doc/sudoers.cat
+++ b/doc/sudoers.cat
@@ -1279,11 +1279,11 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
                        higher.
 
      passprompt_override
-                       The password prompt specified by _p_a_s_s_p_r_o_m_p_t will
-                       normally only be used if the password prompt provided
-                       by systems such as PAM matches the string "Password:".
-                       If _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e is set, _p_a_s_s_p_r_o_m_p_t will always
-                       be used.  This flag is _o_f_f by default.
+                       If set, the prompt specified by _p_a_s_s_p_r_o_m_p_t or the
+                       SUDO_PROMPT environment variable will always be used
+                       and will replace the prompt provided by a PAM module or
+                       other authentication method.  This flag is _o_f_f by
+                       default.
 
      path_info         Normally, ssuuddoo will tell the user when a command could
                        not be found in their PATH environment variable.  Some
@@ -1778,7 +1778,15 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
                        %%    two consecutive % characters are collapsed into a
                              single % character
 
-                       The default value is "Password:".
+                       On systems that use PAM for authentication, _p_a_s_s_p_r_o_m_p_t
+                       will only be used if the prompt provided by the PAM
+                       module matches the string "Password: " or "username's
+                       Password: ".  This ensures that the _p_a_s_s_p_r_o_m_p_t setting
+                       does not interfere with challenge-response style
+                       authentication.  The _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e flag can be
+                       used to change this behavior.
+
+                       The default value is "Password: ".
 
      privs             The default Solaris privileges to use when constructing
                        a new privilege set for a command.  This is passed to
@@ -2823,4 +2831,4 @@ DDIISSCCLLAAIIMMEERR
      file distributed with ssuuddoo or https://www.sudo.ws/license.html for
      complete details.
 
-Sudo 1.8.21                      July 20, 2017                     Sudo 1.8.21
+Sudo 1.8.21                      July 21, 2017                     Sudo 1.8.21
diff --git a/doc/sudoers.man.in b/doc/sudoers.man.in
index d5c82704f..193b2e18e 100644
--- a/doc/sudoers.man.in
+++ b/doc/sudoers.man.in
@@ -21,7 +21,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.TH "SUDOERS" "5" "July 20, 2017" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
+.TH "SUDOERS" "5" "July 21, 2017" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
 .nh
 .if n .ad l
 .SH "NAME"
@@ -2677,16 +2677,12 @@ by default.
 This setting is only supported by version 1.8.8 or higher.
 .TP 18n
 passprompt_override
-The password prompt specified by
+If set, the prompt specified by
 \fIpassprompt\fR
-will normally only be used if the password prompt provided by systems
-such as PAM matches the string
-\(LqPassword:\(Rq.
-If
-\fIpassprompt_override\fR
-is set,
-\fIpassprompt\fR
-will always be used.
+or the
+\fRSUDO_PROMPT\fR
+environment variable will always be used and will replace the
+prompt provided by a PAM module or other authentication method.
 This flag is
 \fIoff\fR
 by default.
@@ -3575,6 +3571,19 @@ characters are collapsed into a single
 \fR%\fR
 character
 .PP
+On systems that use PAM for authentication,
+\fIpassprompt\fR
+will only be used if the prompt provided by the PAM module matches the string
+\(LqPassword: \(Rq
+or
+\(Lqusername's Password: \(Rq.
+This ensures that the
+\fIpassprompt\fR
+setting does not interfere with challenge-response style authentication.
+The
+\fIpassprompt_override\fR
+flag can be used to change this behavior.
+.sp
 The default value is
 \(Lq\fR@passprompt@\fR\(Rq.
 .RE
diff --git a/doc/sudoers.mdoc.in b/doc/sudoers.mdoc.in
index 69c1ef974..532adfa8a 100644
--- a/doc/sudoers.mdoc.in
+++ b/doc/sudoers.mdoc.in
@@ -19,7 +19,7 @@
 .\" Agency (DARPA) and Air Force Research Laboratory, Air Force
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\"
-.Dd July 20, 2017
+.Dd July 21, 2017
 .Dt SUDOERS @mansectform@
 .Os Sudo @PACKAGE_VERSION@
 .Sh NAME
@@ -2514,16 +2514,12 @@ by default.
 .Pp
 This setting is only supported by version 1.8.8 or higher.
 .It passprompt_override
-The password prompt specified by
+If set, the prompt specified by
 .Em passprompt
-will normally only be used if the password prompt provided by systems
-such as PAM matches the string
-.Dq Password: .
-If
-.Em passprompt_override
-is set,
-.Em passprompt
-will always be used.
+or the
+.Ev SUDO_PROMPT
+environment variable will always be used and will replace the
+prompt provided by a PAM module or other authentication method.
 This flag is
 .Em off
 by default.
@@ -3348,8 +3344,21 @@ characters are collapsed into a single
 character
 .El
 .Pp
+On systems that use PAM for authentication,
+.Em passprompt
+will only be used if the prompt provided by the PAM module matches the string
+.Dq "Password: "
+or
+.Dq "username's Password: " .
+This ensures that the
+.Em passprompt
+setting does not interfere with challenge-response style authentication.
+The
+.Em passprompt_override
+flag can be used to change this behavior.
+.Pp
 The default value is
-.Dq Li @passprompt@ .
+.Dq Li "@passprompt@" .
 .It privs
 The default Solaris privileges to use when constructing a new
 privilege set for a command.
