diff --git a/packages/hydrojudge/src/hosts/hydro.ts b/packages/hydrojudge/src/hosts/hydro.ts
index 8c728d100..6de538f57 100644
--- a/packages/hydrojudge/src/hosts/hydro.ts
+++ b/packages/hydrojudge/src/hosts/hydro.ts
@@ -221,7 +221,8 @@ export default class Hydro implements Session {
     async login() {
         log.info('[%s] Updating session', this.config.host);
         const res = await this.post('login', {
-            uname: this.config.uname, password: this.config.password, rememberme: 'on',
+            uname: this.config.uname, password: this.config.password,
+            rememberme: 'on', judge: 'on',
         });
         const setCookie = res.headers['set-cookie'];
         await this.setCookie(Array.isArray(setCookie) ? setCookie.join(';') : setCookie);
diff --git a/packages/hydrooj/src/handler/user.ts b/packages/hydrooj/src/handler/user.ts
index 4b941de6e..d2e8565b7 100644
--- a/packages/hydrooj/src/handler/user.ts
+++ b/packages/hydrooj/src/handler/user.ts
@@ -57,13 +57,15 @@ class UserLoginHandler extends Handler {
     @param('redirect', Types.String, true)
     @param('tfa', Types.String, true)
     @param('authnChallenge', Types.String, true)
+    @param('judge', Types.Boolean, true)
     async post(
         domainId: string, uname: string, password: string, rememberme = false, redirect = '',
-        tfa = '', authnChallenge = '',
+        tfa = '', authnChallenge = '', judge = false,
     ) {
-        if (!system.get('server.login')) throw new BuiltinLoginError();
+        if (!judge && !system.get('server.login')) throw new BuiltinLoginError();
         let udoc = await user.getByEmail(domainId, uname);
         udoc ||= await user.getByUname(domainId, uname);
+        if (judge && !system.get('server.login') && !udoc?.hasPriv(PRIV.PRIV_JUDGE)) throw new BuiltinLoginError();
         if (!udoc) throw new UserNotFoundError(uname);
         if (system.get('system.contestmode') && !udoc.hasPriv(PRIV.PRIV_EDIT_SYSTEM)) {
             if (udoc._loginip && udoc._loginip !== this.request.ip) throw new ValidationError('ip');