diff --git a/image.in/image-scripts.d/09-tcb-fix b/image.in/image-scripts.d/09-tcb-fix
new file mode 100755
index 00000000..b50652ed
--- /dev/null
+++ b/image.in/image-scripts.d/09-tcb-fix
@@ -0,0 +1,8 @@
+#!/bin/sh -e
+# /etc/tcb/<user>/shadow* permissions can be wrong
+# if an account was created from installed package
+
+cd /etc/tcb
+for u in *; do
+	chown "$u":auth "$u"/shadow*
+done