diff --git a/INSTALL.md b/INSTALL.md
index d354d2e0d..add976b4a 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -709,6 +709,11 @@ Defaults are listed in brackets after the description.
         enables extra checks to make sure the environment does not
         become corrupted.
 
+    --enable-postinstall=PATH
+        Enable the use of a postinstall script that is run after
+        the "install" target but before packages as built as part
+        of the "package" target.
+
     --enable-warnings
         Enable compiler warnings when building sudo with gcc or clang.
 
diff --git a/Makefile.in b/Makefile.in
index af5317e5c..1d771e18e 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -193,6 +193,9 @@ install: config.status ChangeLog pre-install install-nls
 	    exit $$?; \
 	done
 
+postinstall:
+	@POSTINSTALL@
+
 uninstall: uninstall-nls
 	for d in $(SUBDIRS); do \
 	    (cd $$d && exec $(MAKE) $@) && continue; \
@@ -394,6 +397,7 @@ force-dist: ChangeLog $(srcdir)/MANIFEST
 package: @PPFILES@
 	DESTDIR=$(abs_top_builddir)/destdir; rm -rf $$DESTDIR; \
 	$(MAKE) install INSTALL_OWNER= DESTDIR=$$DESTDIR && \
+	$(MAKE) postinstall INSTALL_OWNER= DESTDIR=$$DESTDIR && \
 	for p in @PPFILES@; do \
 	    $(SHELL) $(scriptdir)/pp $(PPFLAGS) --destdir=$$DESTDIR $$p \
 		srcdir=$(top_srcdir) \
diff --git a/configure b/configure
index d4ddc9f92..b8d109a91 100755
--- a/configure
+++ b/configure
@@ -848,6 +848,7 @@ SUDOERS_UID
 SUDOERS_MODE
 SHLIB_MODE
 SHLIB_ENABLE
+POSTINSTALL
 MANCOMPRESSEXT
 MANCOMPRESS
 MANDIRTYPE
@@ -1016,6 +1017,7 @@ enable_noargs_shell
 enable_shell_sets_home
 enable_path_info
 enable_env_debug
+enable_postinstall
 enable_zlib
 enable_env_reset
 enable_warnings
@@ -1726,6 +1728,7 @@ Optional Features:
                           Set $HOME to target user in shell mode
   --disable-path-info     Print 'command not allowed' not 'command not found'
   --enable-env-debug      Whether to enable environment debugging.
+  --enable-postinstall    Script to run after the install phase
   --enable-zlib[=PATH]    Whether to enable or disable zlib
   --enable-env-reset      Whether to enable environment resetting by default.
   --enable-warnings       Whether to enable compiler warnings
@@ -6615,6 +6618,21 @@ printf "%s\n" "$as_me: WARNING: ignoring unknown argument to --enable-env-debug:
 fi
 
 
+# Check whether --enable-postinstall was given.
+if test ${enable_postinstall+y}
+then :
+  enableval=$enable_postinstall;  case "$enableval" in
+    yes)	as_fn_error $? "must give --enable-postinstall an argument." "$LINENO" 5
+		;;
+    no)		as_fn_error $? "--enable-postinstall not supported." "$LINENO" 5
+		;;
+    *)		POSTINSTALL="$enableval"
+		;;
+  esac
+
+fi
+
+
 # Check whether --enable-zlib was given.
 if test ${enable_zlib+y}
 then :
diff --git a/configure.ac b/configure.ac
index c2f573818..1a3945406 100644
--- a/configure.ac
+++ b/configure.ac
@@ -51,6 +51,7 @@ AC_SUBST([MANTYPE])dnl
 AC_SUBST([MANDIRTYPE])dnl
 AC_SUBST([MANCOMPRESS])dnl
 AC_SUBST([MANCOMPRESSEXT])dnl
+AC_SUBST([POSTINSTALL])dnl
 AC_SUBST([SHLIB_ENABLE])dnl
 AC_SUBST([SHLIB_MODE])dnl
 AC_SUBST([SUDOERS_MODE])dnl
@@ -1267,6 +1268,18 @@ AC_ARG_ENABLE(env_debug,
   esac
 ])
 
+AC_ARG_ENABLE(postinstall,
+[AS_HELP_STRING([--enable-postinstall], [Script to run after the install phase])],
+[ case "$enableval" in
+    yes)	AC_MSG_ERROR([must give --enable-postinstall an argument.])
+		;;
+    no)		AC_MSG_ERROR([--enable-postinstall not supported.])
+		;;
+    *)		POSTINSTALL="$enableval"
+		;;
+  esac
+])
+
 AC_ARG_ENABLE(zlib,
 [AS_HELP_STRING([--enable-zlib[[=PATH]]], [Whether to enable or disable zlib])],
 [], [enable_zlib=yes])