diff --git a/deb/common/docker-ce.postinst b/deb/common/docker-ce.postinst
deleted file mode 100755
index eeef6ca801..0000000000
--- a/deb/common/docker-ce.postinst
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh
-set -e
-
-case "$1" in
-	configure)
-		if [ -z "$2" ]; then
-			if ! getent group docker > /dev/null; then
-				groupadd --system docker
-			fi
-		fi
-		;;
-	abort-*)
-		# How'd we get here??
-		exit 1
-		;;
-	*)
-		;;
-esac
-
-#DEBHELPER#
diff --git a/deb/common/rules b/deb/common/rules
index a25eae2e38..a138122923 100755
--- a/deb/common/rules
+++ b/deb/common/rules
@@ -133,6 +133,9 @@ override_dh_auto_install:
 	install -D -p -m 0755 engine/contrib/dockerd-rootless-setuptool.sh debian/docker-ce-rootless-extras/usr/bin/dockerd-rootless-setuptool.sh
 	# TODO: how can we install vpnkit?
 
+	# install systemd sysusers config
+	install -D -p -m 0644 engine/contrib/systemd-sysusers/docker.conf debian/docker-ce/usr/lib/sysusers.d/docker.conf
+
 override_dh_installinit:
 	# use "docker" as our service name, not "docker-ce"
 	dh_installinit --name=docker
diff --git a/rpm/SPECS/docker-ce.spec b/rpm/SPECS/docker-ce.spec
index fc8cf5e7b0..3bcbb2a92a 100644
--- a/rpm/SPECS/docker-ce.spec
+++ b/rpm/SPECS/docker-ce.spec
@@ -84,6 +84,9 @@ install -D -p -m 0755 $(readlink -f engine/bundles/dynbinary-daemon/dockerd) ${R
 install -D -p -m 0755 $(readlink -f engine/bundles/dynbinary-daemon/docker-proxy) ${RPM_BUILD_ROOT}%{_bindir}/docker-proxy
 install -D -p -m 0755 /usr/local/bin/docker-init ${RPM_BUILD_ROOT}%{_libexecdir}/docker/docker-init
 
+# install systemd sysusers config
+install -D -p -m 0644 engine/contrib/systemd-sysusers/docker.conf ${RPM_BUILD_ROOT}%{_sysusersdir}/docker.conf
+
 # install systemd scripts
 install -D -p -m 0644 engine/contrib/init/systemd/docker.service ${RPM_BUILD_ROOT}%{_unitdir}/docker.service
 install -D -p -m 0644 engine/contrib/init/systemd/docker.socket ${RPM_BUILD_ROOT}%{_unitdir}/docker.socket
@@ -100,14 +103,12 @@ mkdir -p ${RPM_BUILD_ROOT}/etc/docker
 %{_libexecdir}/docker/docker-init
 %{_unitdir}/docker.service
 %{_unitdir}/docker.socket
+%{_sysusersdir}/docker.conf
 %{_mandir}/man*/*
 %dir /etc/docker
 
 %post
 %systemd_post docker.service
-if ! getent group docker > /dev/null; then
-    groupadd --system docker
-fi
 
 %preun
 %systemd_preun docker.service docker.socket