diff --git a/system/etc.nix b/system/etc.nix
index cddae796a9b..12f5b4371c9 100644
--- a/system/etc.nix
+++ b/system/etc.nix
@@ -73,6 +73,7 @@ import ../helpers/make-etc.nix {
     )
     [
       "login"
+      "su"
       "other"
       "passwd"
       "shadow"
diff --git a/system/etc/pam.d/su b/system/etc/pam.d/su
new file mode 100644
index 00000000000..3807b8a3d27
--- /dev/null
+++ b/system/etc/pam.d/su
@@ -0,0 +1,5 @@
+auth     sufficient     pam_rootok.so
+auth     required       @pam_unix2@/lib/security/pam_unix2.so nullok
+account  required       @pam_unix2@/lib/security/pam_unix2.so
+password required       @pam_unix2@/lib/security/pam_unix2.so nullok
+session  required       @pam_unix2@/lib/security/pam_unix2.so
diff --git a/system/system.nix b/system/system.nix
index fdca1eee0fa..2cfc6f2ee7c 100644
--- a/system/system.nix
+++ b/system/system.nix
@@ -166,6 +166,7 @@ rec {
     pkgs.pwdutils
     pkgs.rsync
     pkgs.strace
+    pkgs.su
     pkgs.sysklogd
     pkgs.udev
     pkgs.upstart