diff --git a/upstart-jobs/udev.nix b/upstart-jobs/udev.nix
index 7f84ed8e539..0bdb9b9cb74 100644
--- a/upstart-jobs/udev.nix
+++ b/upstart-jobs/udev.nix
@@ -26,6 +26,15 @@ let
     udev_rules=\"${udevRules}\"
   ";
 
+  # Dummy file indicating whether we've run udevtrigger/udevsettle.
+  # Since that *recreates* all device nodes with default permissions,
+  # it's not nice to do that when a user is logged in (it messes up
+  # the permissions set by pam_devperm).
+  # !!! Actually, this makes the udev configuration less declarative;
+  # changes may not take effect until the user reboots.  We should
+  # find a better way to preserve the permissions of logged-in users.
+  devicesCreated = "/var/run/devices-created";
+
 in
 
 {
@@ -49,8 +58,11 @@ start script
     # Let udev create device nodes for all modules that have already
     # been loaded into the kernel (or for which support is built into
     # the kernel).
-    ${udev}/sbin/udevtrigger
-    ${udev}/sbin/udevsettle # wait for udev to finish
+    if ! test -e ${devicesCreated}; then
+        ${udev}/sbin/udevtrigger
+        ${udev}/sbin/udevsettle # wait for udev to finish
+        touch ${devicesCreated}
+    fi
 
     # Kill udev, let Upstart restart and monitor it.  (This is nasty,
     # but we have to run udevtrigger first.  Maybe we can use