diff --git a/drbd-utils.changes b/drbd-utils.changes
index 3f23aae..b4cc0f9 100644
--- a/drbd-utils.changes
+++ b/drbd-utils.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Sep  5 07:42:21 UTC 2019 - ohering@suse.de
+
+- In our effort to make /etc fully admin controlled, move /etc/xen/scripts
+  to libexec/xen/scripts
+
 -------------------------------------------------------------------
 Tue Jun 11 12:42:01 UTC 2019 - Dominique Leuenberger <dimstar@opensuse.org>
 
diff --git a/drbd-utils.spec b/drbd-utils.spec
index 9f2882e..00ae445 100644
--- a/drbd-utils.spec
+++ b/drbd-utils.spec
@@ -121,6 +121,20 @@ make OPTFLAGS="%{optflags}" %{?_smp_mflags}
 mkdir -p %{buildroot}%{_localstatedir}/lib/drbd
 %ifnarch %ix86 x86_64
 rm -rf %{buildroot}%{_sysconfdir}/xen
+%else
+d=%{_libexecdir}/xen/scripts
+mkdir -p %{buildroot}$d
+mv %{buildroot}%{_sysconfdir}/xen/scripts/block-drbd %{buildroot}$d
+%if %{suse_version} > 1500
+rm -rf %{buildroot}%{_sysconfdir}/xen
+%else
+tee %{buildroot}%{_sysconfdir}/xen/scripts/block-drbd <<_EOS_
+#!/bin/sh
+# SUSE versions up to SLE15 populated /etc with files.
+# This wrapper exists to remain compatible with their expected script path
+exec $d/block-drbd "\$@"
+_EOS_
+%endif
 %endif
 
 %pre
@@ -169,9 +183,12 @@ ln -sf drbdmon-9.0.8.gz %{_mandir}/ja/man8/drbdmon.8.gz
 /sbin/drbdmon
 %endif
 %ifarch %ix86 x86_64
+%if %{suse_version} <= 1500
 %dir %attr(700,root,root) %{_sysconfdir}/xen
 %dir %{_sysconfdir}/xen/scripts
-%{_sysconfdir}/xen/scripts/block-drbd
+%attr(755,root,root) %{_sysconfdir}/xen/scripts/block-drbd
+%endif
+%{_libexecdir}/xen
 %endif
 %{_prefix}/lib/ocf/resource.d/linbit/drbd
 %{_prefix}/lib/ocf/resource.d/linbit/drbd.shellfuncs.sh