diff --git a/debian/changelog b/debian/changelog
index 91cac108..d07f6256 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -31,6 +31,9 @@ shadow (1:4.1.4.3-1) UNRELEASED; urgency=low
     protect against mis-typed root login can use "requisite", but will be
     vulnerable to user enumeration attacks on insecure lines, and should use
     pam 1.1.0-4 at least. Closes: #574082, #531341
+  * debian/passwd.cron.daily: Handle the backups of the user and group
+    databases so that it can be removed from the standard daily cron job.
+    Closes: #554170
 
  -- Nicolas FRANCOIS (Nekral) <nicolas.francois@centraliens.net>  Sun, 24 Jan 2010 18:28:33 +0100
 
diff --git a/debian/passwd.cron.daily b/debian/passwd.cron.daily
new file mode 100644
index 00000000..ff66a7d9
--- /dev/null
+++ b/debian/passwd.cron.daily
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+cd /var/backups || exit 0
+
+for FILE in passwd group shadow gshadow; do
+        test -f /etc/$FILE              || continue
+        cmp -s $FILE.bak /etc/$FILE     && continue
+        cp -p $FILE $FILE.bak && chmod 600 $FILE.bak
+done