diff --git a/image.in/image-scripts.d/09-tcb-fix b/image.in/image-scripts.d/09-tcb-fix
deleted file mode 100755
index b50652ed..00000000
--- a/image.in/image-scripts.d/09-tcb-fix
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/sh -e
-# /etc/tcb/<user>/shadow* permissions can be wrong
-# if an account was created from installed package
-
-cd /etc/tcb
-for u in *; do
-	chown "$u":auth "$u"/shadow*
-done
diff --git a/image.in/image-scripts.d/99-tcb-fix b/image.in/image-scripts.d/99-tcb-fix
new file mode 100755
index 00000000..83bd59ee
--- /dev/null
+++ b/image.in/image-scripts.d/99-tcb-fix
@@ -0,0 +1,5 @@
+#!/bin/sh -e
+# drop intermediate files not needed in the image
+# which receive broken permissions in fakeroot environment
+
+rm -f /etc/tcb/*/shadow{-,.lock}
diff --git a/sub.in/stage2/image-scripts.d/99-tcb-fix b/sub.in/stage2/image-scripts.d/99-tcb-fix
new file mode 100755
index 00000000..83bd59ee
--- /dev/null
+++ b/sub.in/stage2/image-scripts.d/99-tcb-fix
@@ -0,0 +1,5 @@
+#!/bin/sh -e
+# drop intermediate files not needed in the image
+# which receive broken permissions in fakeroot environment
+
+rm -f /etc/tcb/*/shadow{-,.lock}