Follow-up if someone else ends up w/ same problem. I spent the last few days trying to debug it with no luck. Here some things I have tried: emergency/rescue state from grub, ESC right after decrypting disk to get errors, logging in TTY, live-boot both via Ubuntu and Fedora (decrypt-->mount root --> bind --> chroot into specific deployment --> modify authselect configs --> authselect apply-changes --> unmount --> reboot). The last step actually got everything worse as I started having users not recognised in TTY. I have also tried replacing everything from /etc/pam.d or /authselect from the default usr/etc. I also noticed that when decrypting, var/home would not contain my users anymore (note that root/ostree/deployment-x/home symlinks to var/home). Luckily, my users data (home) was stored in another btrfs subvolume ( I originally installed the OS with automatic partitioning and no manual config). Lastly, I have tried to sudo touch autorelabel for potential SELinux. For my mental sanity, I ended up backing up my user data and doing a fresh install.