diff --git a/default.yaml b/default.yaml
index 40d7cfce..b88a388d 100644
--- a/default.yaml
+++ b/default.yaml
@@ -372,7 +372,8 @@ accounts:
             max-attempts: 30
 
         # this is the bcrypt cost we'll use for account passwords
-        bcrypt-cost: 9
+        # (note that 4 is the lowest value allowed by the bcrypt library)
+        bcrypt-cost: 4
 
         # length of time a user has to verify their account before it can be re-registered
         verify-timeout: "32h"
diff --git a/traditional.yaml b/traditional.yaml
index 6e7c2ec3..d3a8ef55 100644
--- a/traditional.yaml
+++ b/traditional.yaml
@@ -344,7 +344,8 @@ accounts:
             max-attempts: 30
 
         # this is the bcrypt cost we'll use for account passwords
-        bcrypt-cost: 9
+        # (note that 4 is the lowest value allowed by the bcrypt library)
+        bcrypt-cost: 4
 
         # length of time a user has to verify their account before it can be re-registered
         verify-timeout: "32h"